<div dir="ltr">Terry, did you ever get to the bottom of this? I appear to be having a similar issue with the same version of IPA.</div><div class="gmail_extra"><br><br><div class="gmail_quote">On Wed, Sep 4, 2013 at 1:18 PM, Terry Soucy <span dir="ltr"><<a href="mailto:tsoucy@salesforce.com" target="_blank">tsoucy@salesforce.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I am experiencing some long execution times, and I'm wondering if anyone can give me some insight.<div>
<br></div><div>We are running FreeIPA 3.0.0-26 on Redhat 6.1. We have multimaster replication running among 4 hosts. We have approv 100 users, 25 usergroups and hostgroups, and approx 2000 hosts in a single domain. We noticed that some DNS queries were timing out periodically. When I investigated further, I found several of the DNS requests in the access log</div>
<div><br></div><div><div>[04/Sep/2013:13:42:24 -0300] conn=122491 op=3888679 SRCH base="idnsName=compute-</div><div><a href="http://1.amazonaws.com" target="_blank">1.amazonaws.com</a>,idnsname=<a href="http://prod.ca2.example.com" target="_blank">prod.ca2.example.com</a>,cn=dns,dc=example,dc=com" scope=0 filter="</div>
<div>(objectClass=idnsRecord)" attrs=ALL</div><div>[04/Sep/2013:13:42:44 -0300] conn=122491 op=3888679 RESULT err=32 tag=101 nentri</div><div>es=0 etime=20</div><div><br></div><div>There are a lot of those, as expected, since we first noticed this issue with DNS.</div>
<div><br></div><div>Then I found this ...</div><div><br></div><div><div>[04/Sep/2013:13:42:23 -0300] conn=368561 op=9 EXT oid="2.16.840.1.113730.3.5.5" name="Netscape Replication End Session"</div><div>
[04/Sep/2013:13:42:44 -0300] conn=368561 op=9 RESULT err=0 tag=120 nentries=0 etime=22</div></div><div><br></div><div>and lots of this ...</div><div><br></div><div><div>[04/Sep/2013:13:42:26 -0300] conn=368604 op=0 BIND dn="" method=sasl version=3 mech=GSSAPI</div>
<div>[04/Sep/2013:13:42:44 -0300] conn=368604 op=0 RESULT err=14 tag=97 nentries=0 etime=18, SASL bind in progress</div></div><div><br></div><div><br></div><div>So, is my SASL bind causing the replication to go long, or is the replication taking a long time and causing the hang? Is there a way I can see the details of the replication? There is not a lot of changes going on that require replication with regards to dns, users, hosts, etc, so I'm not sure why it would take so long. Also, can I remove the SASL bind and just add a replication user to the dse.ldif to remove the requirement for kerberos for replication?</div>
<span class="HOEnZb"><font color="#888888">
<div><br></div><div>Terry</div>-- <br><div dir="ltr">Terry Soucy - Systems Engineer<br>Salesforce MarketingCloud - <a href="http://www.salesforce.com" target="_blank">http://www.salesforce.com</a><br>(o) <a href="tel:506.631.7445" value="+15066317445" target="_blank">506.631.7445</a> (c) <a href="tel:506.609.3247" value="+15066093247" target="_blank">506.609.3247</a> | (e) <a href="mailto:tsoucy@salesforce.com" target="_blank">tsoucy@salesforce.com</a></div>
</font></span></div></div>
<br>_______________________________________________<br>
Freeipa-users mailing list<br>
<a href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br></blockquote></div><br><br clear="all"><div><br></div>-- <br>The government is going to read our mail anyway, might as well make it tough for them. GPG Public key ID: B6A1A7C6
</div>