<div dir="ltr">hmmmm....<div><br></div><div>after some more digging (monitoring the upgrade more closely.)</div><div>I saw that the upgrade kept waiting for the ca to start, which it did not do.</div><div>and after 5 minutes the upgrade gave up with the following errors in the ipaupgrade log :</div><div><br></div><div>at 85% it says : </div><div><div><div>2014-10-26T15:04:35Z DEBUG retrieving schema for SchemaCache url=ldapi://%2fvar%2frun%2fslapd-XXXX-XXXX.socket conn=<ldap.ldapobject.SimpleLDAPObject instance at 0x2b18cb0></div><div>2014-10-26T15:04:35Z DEBUG Starting external process</div><div>2014-10-26T15:04:35Z DEBUG args='/usr/bin/certutil' '-d' '/etc/httpd/alias' '-L'</div><div>2014-10-26T15:04:35Z DEBUG Process finished, return code=0</div><div>2014-10-26T15:04:35Z DEBUG stdout=</div><div>Certificate Nickname Trust Attributes</div><div> SSL,S/MIME,JAR/XPI</div><div><br></div><div>Signing-Cert u,u,u</div><div>XXXX.XXXX IPA CA CT,C,C</div><div>ipaCert u,u,u</div><div>Server-Cert u,u,u</div><div><br></div><div>2014-10-26T15:04:35Z DEBUG stderr=</div><div>2014-10-26T15:04:35Z DEBUG Starting external process</div><div>2014-10-26T15:04:35Z DEBUG args='/usr/bin/certutil' '-d' '/etc/httpd/alias' '-L' '-n' 'TJAKO.THUIS IPA CA' '-a'</div><div>2014-10-26T15:04:35Z DEBUG Process finished, return code=0</div><div>2014-10-26T15:04:35Z DEBUG stdout=-----BEGIN CERTIFICATE-----</div></div><div>< certificate-removed ></div><div><div>-----END CERTIFICATE-----</div><div>2014-10-26T15:04:35Z DEBUG stderr=<br></div></div><div>2014-10-26T15:04:36Z ERROR Upgrade failed with cannot connect to 'ldapi://%2fvar%2frun%2fslapd-XXXX-XXXX.socket':</div><div>2014-10-26T15:04:36Z DEBUG Traceback (most recent call last):</div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/upgradeinstance.py", line 152, in __upgrade</div><div> self.modified = (ld.update(self.files, ordered=True) or</div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 874, in update</div><div> updates = api.Backend.updateclient.update(POST_UPDATE, self.dm_password, self.ldapi, self.live_run)</div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/plugins/updateclient.py", line 131, in update</div><div> ld.update_from_dict(updates)</div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 889, in update_from_dict</div><div> self._run_updates(updates)</div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 799, in _run_updates</div><div> self._update_record(update)</div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 661, in _update_record</div><div> e = self._get_entry(new_entry.dn)</div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 544, in _get_entry</div><div> return self.conn.get_entries(dn, scope, searchfilter, sattrs)</div><div> File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1421, in get_entries</div><div> base_dn=base_dn, scope=scope, filter=filter, attrs_list=attrs_list)</div><div> File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1527, in find_entries</div><div> break</div><div> File "/usr/lib64/python2.7/contextlib.py", line 35, in __exit__</div><div> self.gen.throw(type, value, traceback)</div><div> File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1206, in error_handler</div><div> error=info)</div><div>NetworkError: cannot connect to 'ldapi://%2fvar%2frun%2fslapd-XXXX-XXXX.socket':</div></div><div><br></div><div>and in the end it says :</div><div><br></div><div><div>2014-10-26T14:46:13Z DEBUG The CA status is: check interrupted</div><div>2014-10-26T14:46:13Z DEBUG Waiting for CA to start...</div><div>2014-10-26T14:46:14Z DEBUG File "/usr/lib/python2.7/site-packages/ipaserver/install/installutils.py", line 646, in run_script</div><div> return_value = main_function()</div><div><br></div><div> File "/usr/sbin/ipa-upgradeconfig", line 1457, in main</div><div> ca.restart(dogtag.configured_constants().PKI_INSTANCE_NAME)</div><div><br></div><div> File "/usr/lib/python2.7/site-packages/ipaserver/install/service.py", line 282, in restart</div><div> self.service.restart(instance_name, capture_output=capture_output, wait=wait)</div><div><br></div><div> File "/usr/lib/python2.7/site-packages/ipaplatform/redhat/services.py", line 209, in restart</div><div> self.wait_until_running()</div><div><br></div><div> File "/usr/lib/python2.7/site-packages/ipaplatform/redhat/services.py", line 197, in wait_until_running</div><div> raise RuntimeError('CA did not start in %ss' % timeout)</div><div><br></div><div>2014-10-26T14:46:14Z DEBUG The ipa-upgradeconfig command failed, exception: RuntimeError: CA did not start in 300.0s</div></div><div><br></div><div><br></div><div>I guess its something with the update for the ca certificate server that failed.</div><div><br></div><div>Any clues on how to proceed ?</div><div><br></div><div>Rob</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">2014-10-26 11:39 GMT+01:00 John Obaterspok <span dir="ltr"><<a href="mailto:john.obaterspok@gmail.com" target="_blank">john.obaterspok@gmail.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hello Rob,<div><br></div><div>Did systemd report any failed services? (systemctl --failed)</div><div><br></div><div><br></div><div>-- john</div></div><div class="gmail_extra"><br><div class="gmail_quote"><div><div class="h5">2014-10-25 16:40 GMT+02:00 Rob Verduijn <span dir="ltr"><<a href="mailto:rob.verduijn@gmail.com" target="_blank">rob.verduijn@gmail.com</a>></span>:<br></div></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div><div class="h5"><div dir="ltr">Hello all,<div><br></div><div>I'm running freeipa 3.3.0 on fedora 20 x86_65 and it is set up as my main dns server.</div><div><br></div><div>I've tried the upgrade to 4.1 using the copr repositorie.</div><div><br></div><div>I performed the following steps:</div><div><br></div><div>1 apply latest fedora updates</div><div>2 shutdown system</div><div>3 create a snapshot from the freeipa vm as a backup (which is why I'm back at 3.3)</div><div>4 added the copr repo to my repositories</div><div>5 issue 'yum update' and grab a coffee</div><div>6 see the update complete and start to check if everything still works.</div><div>all authentication seems to work fine, however all my local dns enties no longer work.</div><div>all internet dns queries work fine, just not my own entries.</div><div>they are all still there.</div><div><br></div><div>so I shutdown my freeipa vm and reverted the snapshot, everything is back up and running again with 3.3.0</div><div><br></div><div>I've digged through my logs but see no errors whatsoever.</div><div><br></div><div>Did I miss something that needs to be done when doing an upgrade ?</div><span><font color="#888888"><div><br></div><div>Rob</div></font></span></div>
<br></div></div><span class="HOEnZb"><font color="#888888">--<br>
Manage your subscription for the Freeipa-users mailing list:<br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/mailman/listinfo/freeipa-users</a><br>
Go To <a href="http://freeipa.org" target="_blank">http://freeipa.org</a> for more info on the project<br></font></span></blockquote></div><br></div>
</blockquote></div><br></div>