<html dir="ltr"> <head> <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1"> <style id="owaParaStyle" type="text/css">P {margin-top:0;margin-bottom:0;}</style> </head> <body ocsi="0" fpstyle="1"> <div style="direction: ltr;font-family: Tahoma;color: #000000;font-size: 10pt;">If there is a resolution to this, we would love to know. We have been experiencing the same issues. <br> <br> <div style="font-family: Times New Roman; color: #000000; font-size: 16px"> <hr tabindex="-1"> <div style="direction: ltr;" id="divRpF336880"><font size="2" color="#000000" face="Tahoma"><b>From:</b> freeipa-users-bounces@redhat.com [freeipa-users-bounces@redhat.com] on behalf of Thomas Raehalme [thomas.raehalme@codecenter.fi]<br> <b>Sent:</b> Sunday, June 22, 2014 8:29 AM<br> <b>To:</b> freeipa-users@redhat.com<br> <b>Subject:</b> Re: [Freeipa-users] named's LDAP connection hangs<br> </font><br> </div> <div></div> <div> <div dir="ltr"> <div> <div>Hi!<br> <br> </div> Today it finally happened again - named is not resolving names under the IPA domain, pvnet.cc. Killing the named process and restarting it solves the problem (until it happens again).<br> <br> </div> <div>Petr, I'll send you the logs directly so I don't have to leave anything out. I hope that's okay.<br> </div> <div><br> </div> <div>Thank you for the help!<br> </div> <div><br> </div> Best regards,<br> Thomas<br> </div> <div class="gmail_extra"><br> <br> <div class="gmail_quote">On Mon, Jun 16, 2014 at 1:54 PM, Petr Spacek <span dir="ltr"> <<a href="mailto:pspacek@redhat.com" target="_blank">pspacek@redhat.com</a>></span> wrote:<br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex"> <div class="HOEnZb"> <div class="h5">On 16.6.2014 09:41, Thomas Raehalme wrote:<br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex; border-left:1px #ccc solid; padding-left:1ex"> Hi,<br> <br> We have a problem with IPA going out of service every now and then. There<br> seems to be two kinds of situations:<br> <br> 1) The connection between named and dirsrv fails. Named can resolve<br> external names but the domain managed by IPA does not resolve any names.<br> named cannot be stopped. After killing the process and restarting the issue<br> is resolved.<br> <br> 2) Sometimes the situation is more severe and also dirsrv is unresponsive.<br> The solution then seems to be restarting both named and dirsrv<br> (individually or through the 'ipa' service).<br> <br> Regarding #1 the file /var/log/messages contains the following:<br> <br> Jun 16 03:22:23 ipa named[7295]: received control channel command 'reload'<br> Jun 16 03:22:23 ipa named[7295]: loading configuration from<br> '/etc/named.conf'<br> Jun 16 03:22:23 ipa named[7295]: using default UDP/IPv4 port range: [1024,<br> 65535]<br> Jun 16 03:22:23 ipa named[7295]: using default UDP/IPv6 port range: [1024,<br> 65535]<br> Jun 16 03:22:23 ipa named[7295]: sizing zone task pool based on 6 zones<br> Jun 16 03:22:23 ipa named[7295]: GSSAPI Error: Unspecified GSS failure.<br> Minor code may provide more information (Ticket expired)<br> Jun 16 03:22:23 ipa named[7295]: bind to LDAP server failed: Local error<br> <br> The reload is triggered by logrotate. For some reason authentication fails,<br> and the IPA domain is no longer resolvable.<br> <br> I haven't discovered a pattern how often these problems occur. Maybe once a<br> week or two.<br> <br> FreeIPA master running on CentOS 6.5 has been configured with the default<br> settings. In addition a single replica has been added.<br> <br> Any ideas where I should look for the source of the problem?<br> </blockquote> <br> </div> </div> I have heard about this problem but nobody managed to reproduce the problem.<br> <br> Please:<br> - configure KRB5_TRACE variable as described on<br> <a href="https://fedorahosted.org/bind-dyndb-ldap/wiki/BIND9/NamedCannotStart#a1.Gathersymptoms" target="_blank">https://fedorahosted.org/bind-<u></u>dyndb-ldap/wiki/BIND9/<u></u>NamedCannotStart#a1.<u></u>Gathersymptoms</a><br> - restart named<br> - send me logs when it happens again.<br> <br> Thank you!<span class="HOEnZb"><font color="#888888"><br> <br> -- <br> Petr^2 Spacek<br> <br> ______________________________<u></u>_________________<br> Freeipa-users mailing list<br> <a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a><br> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/<u></u>mailman/listinfo/freeipa-users</a><br> </font></span></blockquote> </div> <br> <br clear="all"> <br> -- <br> <div dir="ltr"> <div><b>Thomas Raehalme</b></div> <div><i>CTO, teknologiajohtaja</i></div> <div>Mobile +358 40 545 0605</div> <div><br> </div> <div><b>Codecenter Oy</b></div> <div>Väinönkatu 26 A, 4th Floor</div> <div>40100 JYVÄSKYLÄ, Finland</div> <div>Tel. +358 10 322 0040</div> <div><a href="http://www.codecenter.fi" target="_blank">www.codecenter.fi</a></div> <div> <pre style="white-space:pre-wrap; color:rgb(0,0,0); font-family:arial,helvetica,sans-serif" cols="72"><div style="white-space:normal; font-family:arial,sans-serif"><font color="#cc0000"><b>Codecenter - Tietojärjestelmiä ymmärrettävästi</b></font></div></pre> </div> </div> </div> </div> </div> </div> </body> </html>