<div dir="ltr">Thanks Petr,<div> </div><div>Tried this and get the following output with the verbose flag:</div><div> </div><div> p11-kit: ipa.p11-kit: x-public-key-info: invalid or unsupported attribute Cleaning a master is irreversible. This should not normally be require, so use cautiously. Continue to clean master? [no]: yes I still however see this machine as a nameserver for this domain. Also, SRV records pointing to it are still being served. [root@freeipa-prod-a-033 centos]# dig NS <a href="http://cloud.dcmn.com">cloud.dcmn.com</a> +short<a href="http://freeipa-prod-a-031.cloud.foo.com">freeipa-prod-a-031.cloud.foo.com</a>.<a href="http://freeipa-prod-b-032.cloud.foo.com">freeipa-prod-b-032.cloud.foo.com</a>. <a href="http://freeipa-prod-a-033.cloud.foo.com">freeipa-prod-a-033.cloud.foo.com</a>. Cheers,Andrew </div></div><div class="gmail_extra"> <div class="gmail_quote">On 6 November 2015 at 15:28, Petr Vobornik <<a href="mailto:pvoborni@redhat.com" target="_blank">pvoborni@redhat.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">On 11/05/2015 05:32 PM, Andrew Holway wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> Actually I'm starting to feel like this is a bug. Managed to get the old IPA server back up and ran . "ipa-server-install --uninstall" Which completed successfully and gave the advice: Replication agreements with the following IPA masters found: freeipa- <a href="http://prod-b-032.cloud.foo.com" rel="noreferrer" target="_blank">prod-b-032.cloud.foo.com</a>. Removing any replication agreements before uninstalling the server is strongly recommended. You can remove replication agreements by running the following command on any other IPA master: $ ipa-replica-manage del <a href="http://freeipa-prod-a-031.cloud.foo.com" rel="noreferrer" target="_blank">freeipa-prod-a-031.cloud.foo.com</a> Running this command on the other IPA servers gives the following: [root@freeipa-prod-a-033 centos]# ipa-replica-manage del <a href="http://freeipa-prod-a-031.cloud.foo.com" rel="noreferrer" target="_blank">freeipa-prod-a-031.cloud.foo.com</a> p11-kit: ipa.p11-kit: x-public-key-info: invalid or unsupported attribute '<a href="http://freeipa-prod-a-033.cloud.dcmn.com" rel="noreferrer" target="_blank">freeipa-prod-a-033.cloud.dcmn.com</a>' has no replication agreement for' <a href="http://freeipa-prod-a-031.cloud.foo.com" rel="noreferrer" target="_blank">freeipa-prod-a-031.cloud.foo.com</a>' I dont see anything in the logs. Thanks, Andrew On 5 November 2015 at 16:58, Andrew Holway <<a href="mailto:andrew.holway@gmail.com" target="_blank">andrew.holway@gmail.com</a>> wrote: <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> One of our FreeIPA replicas had its filesystem hosed so we want to remove it. Can someone show me the sequence of commands to remove a down replica? Thanks, Andrew [root@freeipa-prod-a-033 centos]# ipa-replica-manage list p11-kit: ipa.p11-kit: x-public-key-info: invalid or unsupported attribute <a href="http://freeipa-prod-a-031.cloud.foo.com" rel="noreferrer" target="_blank">freeipa-prod-a-031.cloud.foo.com</a>: master <a href="http://freeipa-prod-a-033.cloud.foo.com" rel="noreferrer" target="_blank">freeipa-prod-a-033.cloud.foo.com</a>: master <a href="http://freeipa-prod-b-032.cloud.foo.com" rel="noreferrer" target="_blank">freeipa-prod-b-032.cloud.foo.com</a>: master [root@freeipa-prod-a-033 centos]# ipa-replica-manage del --force <a href="http://freeipa-prod-a-031.foo.dcmn.com" rel="noreferrer" target="_blank">freeipa-prod-a-031.foo.dcmn.com</a> p11-kit: ipa.p11-kit: x-public-key-info: invalid or unsupported attribute '<a href="http://freeipa-prod-a-033.cloud.foo.com" rel="noreferrer" target="_blank">freeipa-prod-a-033.cloud.foo.com</a>' has no replication agreement for' <a href="http://freeipa-prod-a-031.cloud.dcmn.com" rel="noreferrer" target="_blank">freeipa-prod-a-031.cloud.dcmn.com</a>' </blockquote></blockquote> </div></div> If freeipa-prod-a-031 is already uninstall, use also --cleanup option: ipa-replica-manage del --force --cleanup <a href="http://freeipa-prod-a-031.foo.dcmn.com" rel="noreferrer" target="_blank">freeipa-prod-a-031.foo.dcmn.com</a> -f, --force Ignore some types of errors, don't prompt when deleting a master -c, --cleanup When deleting a master with the --force flag, remove leftover references to an already deleted master. -- Petr Vobornik </blockquote></div> </div>