<div dir="ltr">I believe you. I'm not upset at all that things go sideways every now and again. I'm surprised it doesn't happen more.<div><br></div><div>Original failure (or, at least, first occurrence of "ERROR") follows:</div> <div><br></div><div>2013-08-13T13:56:07Z INFO [Setting up Firefox extension]<br></div><div>2013-08-13T13:56:07Z DEBUG Loading StateFile from '/var/lib/ipa/sysrestore/sysrestore.state'<br></div><div>2013-08-13T13:56:07Z INFO <a href="http://bl-1.com/click/load/U2ILOlY2ADdTO1A9BDQ-b0231">/usr/share/ipa/html/krb.js</a> exists, skipping install of Firefox extension</div> <div>2013-08-13T13:56:07Z INFO [Add missing CA DNS records]</div><div>2013-08-13T13:56:07Z ERROR Cannot connect to LDAP to add DNS records: cannot connect to u'ldapi://%2fvar%2frun%2fslapd-SPX-NET.socket': LDAP Server Down</div> <div>2013-08-13T13:56:07Z INFO [Enabling persistent search in DNS]<br></div><div>2013-08-13T13:56:07Z DEBUG [Saving StateFile to '/var/lib/ipa/sysupgrade/sysupgrade.state'</div><div>2013-08-13T13:56:07Z DEBUG Persistent search enabled</div> <div>2013-08-13T13:56:07Z DEBUG Connections set to 4 <br></div><div><br></div><div>Then it goes on for a while, leading to:</div><div><br></div><div>2013-08-13T13:56:11Z DEBUG Process finished, return code=1</div><div>2013-08-13T13:56:11Z DEBUG stdout=Error connecting to DBus.</div> <div>Please verify that the message bus (D-Bus) service is running.</div><div><br></div><div>2013-08-13T13:56:11Z DEBUG stderr=</div><div>2013-08-13T13:56:11Z ERROR cretmonger failed to start tracking certificate: Command '/usr/bin/getcert start-tracking -d /var/lib/pki-ca/alias -n auditSigningCert cert-pki-ca -c dogtag-ipa-retrieve-agent-submit -B /usr/lib64/ipa/certmonger/stop_pkicad -C /usr/lib64/ipa/certmonger/restart_pkicad "auditSigningCert cert-pki-ca" -P XXXXXXXX -T auditSigningCert cert-pki-ca' returned non-zero exit status 1</div> <div>2013-08-13T13:56:11Z DEBUG Starting external process</div><div>2013-08-13T13:56:11Z DEBUG args=/usr/bin/certutil -L -d/var/lib/pki-ca/alias -n ocspSigningCert cert-pki-ca</div><div>2013-08-13T13:56:11Z DEBUG Process finished, return code=0</div> <div><br></div><div>Does that help at all? Do you need more? <br></div><div><br></div><div>I'm upgrading a slave today and will try just doing the --upgrade (_if_ the automatic upgrade has issues again).</div><img alt="" width="1" height="1" src="http://bl-1.com/img/XG5cbgZgVWVTNVw7UmI-b0231.gif"></div> <div class="gmail_extra"><br clear="all"><div><div dir="ltr"><div><br></div><div><u><br></u></div><div><b>Bret Wortman</b></div><div><img src="http://damascusgrp.com/item/51f7de33e4b08d2bdb8b4860?format=1500w" width="200" height="53"><br> </div><div><a href="http://damascusgrp.com/" target="_blank">http://damascusgrp.com/</a><br></div><div><a href="http://about.me/wortmanbret" target="_blank">http://about.me/wortmanbret</a><br></div></div></div> <br><br><div class="gmail_quote">On Wed, Aug 14, 2013 at 9:10 AM, Rob Crittenden <span dir="ltr"><<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <div class="im">Bret Wortman wrote:<br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Rob, I got past this, as you indicated, by doing that after first running:<br> <br> # ipa-ldap-updater --ldapi ./schema.update<br> <br> Using a schema.update tip file I found in a note from you after some<br> hard core googling. Should that extra step have been necessary?<br> </blockquote> <br></div> No, it shouldn't be necessary. Can look in /var/log/ipaupgrade.log (likely humongous) for the original failure and post that section of the log?<br> <br> Updating schema is hard. We are actually completely revamping the way we handle schema changes between version which should be a lot more stable.<br> <br> rob<br> <br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> <br> <br> _<br> _<br> *Bret Wortman*<div class="im"><br> <br> <a href="http://damascusgrp.com/" target="_blank">http://damascusgrp.com/</a><br> <a href="http://about.me/wortmanbret" target="_blank">http://about.me/wortmanbret</a><br> <br> <br> On Tue, Aug 13, 2013 at 3:39 PM, Rob Crittenden <<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a><br></div><div class="im"> <mailto:<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>>> wrote:<br> <br> Bret Wortman wrote:<br> <br> I tried this, but no joy:<br> <br> # /usr/sbin/ipa-upgradeconfig --debug<br> :<br> :<br> DEBUG: caSignedLogCert.cfg<br></div> <<a href="http://bl-1.com/click/load/__VWRaa1w-b0221U28CYQNlAT4-b0231" target="_blank">http://bl-1.com/click/load/__<u></u>VWRaa1w-b0221U28CYQNlAT4-b0231</a><br> <<a href="http://bl-1.com/click/load/VWRaa1w-b0221U28CYQNlAT4-b0231" target="_blank">http://bl-1.com/click/load/<u></u>VWRaa1w-b0221U28CYQNlAT4-b0231</a><u></u>>__><div class="im"><br> profile<br> <br> validity range is 720<br> INFO: [Certificate renewal should stop the CA]<br> ERROR: Unable to find certmonger request ID for auditSigning Cert<br> INFO: The ipa-upgradeconfig command was successful<br> #<br> <br> <br> Run getcert list and sift through the output and see if you have a<br> request tracking for nickname auditSigningCert cert-pki-ca (or similar).<br> <br> But I still can't connect to <a href="http://ipamaster/ipa/ui/" target="_blank">http://ipamaster/ipa/ui/</a>; I get a<br> 903 error<br> every time, and /var/log/httpd/error_log shows, in part:<br> <br> [Tue Aug 13 13:07:20.786566 2013] [:error] [pid 5890] KeyError:<br> 'ipadnszone'<br> [Tue Aug 13 13:07:20.786717 2013] [:error] [pid 5890] ipa: INFO:<br></div> <a href="mailto:bretw@FOO.NET" target="_blank">bretw@FOO.NET</a> <mailto:<a href="mailto:bretw@FOO.NET" target="_blank">bretw@FOO.NET</a>> <mailto:<a href="mailto:bretw@FOO.NET" target="_blank">bretw@FOO.NET</a><div class="im"> <br> <mailto:<a href="mailto:bretw@FOO.NET" target="_blank">bretw@FOO.NET</a>>>: json_metadata(None, None,<br> <br> object=u'all'): KeyError<br> [Tue Aug 13 13:07:21.001525 2013] [:error] [pid 5890] ipa: INFO:<br></div> <a href="mailto:bretw@FOO.NET" target="_blank">bretw@FOO.NET</a> <mailto:<a href="mailto:bretw@FOO.NET" target="_blank">bretw@FOO.NET</a>> <mailto:<a href="mailto:bretw@FOO.NET" target="_blank">bretw@FOO.NET</a><div class="im"> <br> <mailto:<a href="mailto:bretw@FOO.NET" target="_blank">bretw@FOO.NET</a>>>: json_metadata(None, None,<br> command=u'all'): SUCCESS<br> <br> DNS resolution, authentication and authorization all /appear/ to be<br> working fine.<br> <br> <br> The DNS schema was not updated properly. I'd run:<br> <br> # ipa-ldap-updater --upgrade<br> <br> rob<br> <br> <br> </div></blockquote> <br> </blockquote></div><br></div>