<html> <head> <meta content="text/html; charset=UTF-8" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> <div class="moz-cite-prefix">On 04/27/2016 04:36 PM, Gady Notrica wrote: </div> <blockquote cite="mid:0984AB34E553F54B8705D776686863E70AC033CA@cd-exchange01.CD-PRD.candeal.ca" type="cite"> <meta http-equiv="Content-Type" content="text/html; charset=UTF-8"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)">  <style></style> <div class="WordSection1"> No changes to /var/log/dirsrv/slapd-IPA-CANDEAL-CA/errors. I am tailing the log file and running those commands doesn’t generate any log, nothing.<o:p></o:p> <div> <o:p> </o:p> [root@cd-p-ipa1 log]# ipactl start<o:p></o:p> Starting Directory Service<o:p></o:p> Job for <a class="moz-txt-link-abbreviated" href="mailto:dirsrv@IPA-CANDEAL-CA.service">dirsrv@IPA-CANDEAL-CA.service</a> failed because the control process exited with error code. See "systemctl status <a class="moz-txt-link-abbreviated" href="mailto:dirsrv@IPA-CANDEAL-CA.service">dirsrv@IPA-CANDEAL-CA.service</a>" and "journalctl -xe" for details.<o:p></o:p> Failed to start Directory Service: Command ''/bin/systemctl' 'start' '<a class="moz-txt-link-abbreviated" href="mailto:dirsrv@IPA-CANDEAL-CA.service">dirsrv@IPA-CANDEAL-CA.service</a>'' returned non-zero exit status 1<o:p></o:p> <o:p> </o:p> Logs from /var/log/messages<o:p></o:p> <o:p> </o:p> Apr 27 10:26:05 cd-p-ipa1 systemd: Starting 389 Directory Server IPA-CANDEAL-CA....<o:p></o:p> Apr 27 10:26:05 cd-p-ipa1 ns-slapd: [27/Apr/2016:10:26:05 -0400] dse - The configuration file /etc/dirsrv/slapd-IPA-CANDEAL-CA/dse.ldif was not restored from backup /etc/dirsrv/slapd-IPA-CANDEAL-CA/dse.ldif.tmp, error -1<o:p></o:p> Apr 27 10:26:05 cd-p-ipa1 ns-slapd: [27/Apr/2016:10:26:05 -0400] dse - The configuration file /etc/dirsrv/slapd-IPA-CANDEAL-CA/dse.ldif was not restored from backup /etc/dirsrv/slapd-IPA-CANDEAL-CA/dse.ldif.bak, error -1<o:p></o:p> Apr 27 10:26:05 cd-p-ipa1 ns-slapd: [27/Apr/2016:10:26:05 -0400] config - The given config file /etc/dirsrv/slapd-IPA-CANDEAL-CA/dse.ldif could not be accessed, Netscape Portable Runtime error -5950 (File not found.) </div> </div> </blockquote> this is BAD, looks like you completely lost your configuration file for DS, so it doesn't even know where to log anything. When you lost your VM and rebooted there must hav ebeen some data loss. It could be only dse.ldif, but also other files. <blockquote cite="mid:0984AB34E553F54B8705D776686863E70AC033CA@cd-exchange01.CD-PRD.candeal.ca" type="cite"> <div class="WordSection1"> <div> <o:p></o:p> <o:p> </o:p> [root@cd-p-ipa1 log]# systemctl start <a class="moz-txt-link-abbreviated" href="mailto:dirsrv@IPA-CANDEAL-CA.service">dirsrv@IPA-CANDEAL-CA.service</a><o:p></o:p> Job for <a class="moz-txt-link-abbreviated" href="mailto:dirsrv@IPA-CANDEAL-CA.service">dirsrv@IPA-CANDEAL-CA.service</a> failed because the control process exited with error code. See "systemctl status <a class="moz-txt-link-abbreviated" href="mailto:dirsrv@IPA-CANDEAL-CA.service">dirsrv@IPA-CANDEAL-CA.service</a>" and "journalctl -xe" for details.<o:p></o:p> <o:p> </o:p> [root@cd-p-ipa1 log]# systemctl status <a class="moz-txt-link-abbreviated" href="mailto:dirsrv@IPA-CANDEAL-CA.service">dirsrv@IPA-CANDEAL-CA.service</a> -l<o:p></o:p> ● <a class="moz-txt-link-abbreviated" href="mailto:dirsrv@IPA-CANDEAL-CA.service">dirsrv@IPA-CANDEAL-CA.service</a> - 389 Directory Server IPA-CANDEAL-CA.<o:p></o:p> Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled; vendor preset: disabled)<o:p></o:p> Active: failed (Result: exit-code) since Wed 2016-04-27 10:26:17 EDT; 3s ago<o:p></o:p> Process: 9830 ExecStart=/usr/sbin/ns-slapd -D /etc/dirsrv/slapd-%i -i /var/run/dirsrv/slapd-%i.pid -w /var/run/dirsrv/slapd-%i.startpid (code=exited, status=1/FAILURE)<o:p></o:p> <o:p> </o:p> Apr 27 10:26:17 cd-p-ipa1.ipa.candeal.ca ns-slapd[9830]: [27/Apr/2016:10:26:17 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes<o:p></o:p> Apr 27 10:26:17 cd-p-ipa1.ipa.candeal.ca ns-slapd[9830]: [27/Apr/2016:10:26:17 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes<o:p></o:p> Apr 27 10:26:17 cd-p-ipa1.ipa.candeal.ca ns-slapd[9830]: [27/Apr/2016:10:26:17 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes<o:p></o:p> Apr 27 10:26:17 cd-p-ipa1.ipa.candeal.ca ns-slapd[9830]: [27/Apr/2016:10:26:17 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes<o:p></o:p> Apr 27 10:26:17 cd-p-ipa1.ipa.candeal.ca ns-slapd[9830]: [27/Apr/2016:10:26:17 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes<o:p></o:p> Apr 27 10:26:17 cd-p-ipa1.ipa.candeal.ca ns-slapd[9830]: [27/Apr/2016:10:26:17 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes<o:p></o:p> Apr 27 10:26:17 cd-p-ipa1.ipa.candeal.ca ns-slapd[9830]: [27/Apr/2016:10:26:17 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes<o:p></o:p> Apr 27 10:26:17 cd-p-ipa1.ipa.candeal.ca ns-slapd[9830]: [27/Apr/2016:10:26:17 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes<o:p></o:p> Apr 27 10:26:17 cd-p-ipa1.ipa.candeal.ca ns-slapd[9830]: [27/Apr/2016:10:26:17 -0400] dse_read_one_file - The entry cn=schema in file /etc/dirsrv/slapd-IPA-CANDEAL-CA/schema/00core.ldif (lineno: 1) is invalid, error code 21 (Invalid syntax) - attribute type aci: Unknown attribute syntax OID "1.3.6.1.4.1.1466.115.121.1.15"<o:p></o:p> Apr 27 10:26:17 cd-p-ipa1.ipa.candeal.ca ns-slapd[9830]: [27/Apr/2016:10:26:17 -0400] dse - Please edit the file to correct the reported problems and then restart the server.<o:p></o:p> [root@cd-p-ipa1 log]#<o:p></o:p> <o:p> </o:p> Gady<o:p></o:p> </div> <o:p> </o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"> From: Ludwig Krispenz [<a class="moz-txt-link-freetext" href="mailto:lkrispen@redhat.com">mailto:lkrispen@redhat.com</a>] Sent: April 27, 2016 10:06 AM To: Gady Notrica Cc: Rob Crittenden; <a class="moz-txt-link-abbreviated" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> Subject: Re: [Freeipa-users] krb5kdc service not starting<o:p></o:p> </div> </div> <o:p> </o:p> <o:p> </o:p> <div> On 04/27/2016 03:48 PM, Gady Notrica wrote:<o:p></o:p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> Hello Ludwig,<o:p></o:p> <o:p></o:p> I do have only 1 error logs for the 26th in /var/log/dirsrv/slapd-IPA-CANDEAL-CA/errors. Below is the only line I have<o:p></o:p> <o:p></o:p> [25/Apr/2016:22:34:51 -0400] NSMMReplicationPlugin - windows sync - failed to send dirsync search request: 2<o:p></o:p> [26/Apr/2016:00:13:01 -0400] - Entry "uid=MMOOREDT$,cn=users,cn=accounts,dc=ipa,dc=candeal,dc=ca" missing attribute "sn" required by object class "person"<o:p></o:p> <o:p></o:p> <img id="Picture_x0020_3" src="cid:part1.05050201.06020800@redhat.com" height="31" width="901"><o:p></o:p> <o:p></o:p> I don’t know if that helps.<o:p></o:p> </blockquote> no. And it is weird that there should be no logs, there were definitely messages logged around 8:50, you provided them via systemctl status dirsrv... And at least the startup messages should b there Can you try to start dirsrv again. and check what config settings for errorlog are in your dse.ldif <o:p></o:p> <o:p></o:p> <div> Gady<o:p></o:p> </div> <o:p></o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"> From: Ludwig Krispenz [<a moz-do-not-send="true" href="mailto:lkrispen@redhat.com">mailto:lkrispen@redhat.com</a>] Sent: April 27, 2016 3:18 AM To: Gady Notrica Cc: Rob Crittenden; <a moz-do-not-send="true" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> Subject: Re: [Freeipa-users] krb5kdc service not starting<o:p></o:p> </div> </div> <o:p></o:p> <o:p></o:p> <div> On 04/26/2016 09:09 PM, Gady Notrica wrote:<o:p></o:p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> HERE..<o:p></o:p> <o:p></o:p> [23/Apr/2016:11:39:51 -0400] set_krb5_creds - Could not get initial credentials for principal [<a moz-do-not-send="true" href="mailto:ldap/cd-p-ipa1.ipa.domain.local@IPA.DOMAIN.LOCAL">ldap/cd-p-ipa1.ipa.domain.local@IPA.DOMAIN.LOCAL</a>] in keytab [<a moz-do-not-send="true" href="FILE:///%5C%5C%5C%5Cetc%5Cdirsrv%5Cds.keytab">FILE:/etc/dirsrv/ds.keytab</a>]: -1765328228 (Cannot contact any KDC for requested realm)<o:p></o:p> [23/Apr/2016:11:39:51 -0400] slapd_ldap_sasl_interactive_bind - Error: could not perform interactive bind for id [] mech [GSSAPI]: LDAP error -2 (Local error) (SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No Kerberos credentials available)) errno 0 (Success)<o:p></o:p> [23/Apr/2016:11:39:51 -0400] slapi_ldap_bind - Error: could not perform interactive bind for id [] authentication mechanism [GSSAPI]: error -2 (Local error)<o:p></o:p> [23/Apr/2016:11:39:51 -0400] NSMMReplicationPlugin - agmt="cn=meTocd-s-ipa1.ipa.domain.local" (cd-s-ipa1:389): Replication bind with GSSAPI auth failed: LDAP error -2 (Local error) (SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No Kerberos credentials available))<o:p></o:p> [23/Apr/2016:11:39:51 -0400] - slapd started. Listening on All Interfaces port 389 for LDAP requests<o:p></o:p> [23/Apr/2016:11:39:51 -0400] - Listening on All Interfaces port 636 for LDAPS requests<o:p></o:p> [23/Apr/2016:11:39:51 -0400] - Listening on /var/run/slapd-IPA-DOMAIN-LOCAL.socket for LDAPI requests<o:p></o:p> [23/Apr/2016:11:39:55 -0400] NSMMReplicationPlugin - agmt="cn=meTocd-s-ipa1.ipa.domain.local" (cd-s-ipa1:389): Replication bind with GSSAPI auth resumed<o:p></o:p> [23/Apr/2016:14:37:27 -0400] NSMMReplicationPlugin - agmt="cn=meTocd-s-ipa1.ipa.domain.local" (cd-s-ipa1:389): Unable to receive the response for a startReplication extended operation to consumer (Can't contact LDAP server). Will retry later.<o:p></o:p> [23/Apr/2016:14:38:02 -0400] slapd_ldap_sasl_interactive_bind - Error: could not perform interactive bind for id [] mech [GSSAPI]: LDAP error -1 (Can't contact LDAP server) ((null)) errno 107 (Transport endpoint is not connected)<o:p></o:p> [23/Apr/2016:14:38:02 -0400] slapi_ldap_bind - Error: could not perform interactive bind for id [] authentication mechanism [GSSAPI]: error -1 (Can't contact LDAP server)<o:p></o:p> [23/Apr/2016:14:38:02 -0400] slapd_ldap_sasl_interactive_bind - Error: could not perform interactive bind for id [] mech [GSSAPI]: LDAP error -1 (Can't contact LDAP server) ((null)) errno 107 (Transport endpoint is not connected)<o:p></o:p> [23/Apr/2016:14:38:02 -0400] slapi_ldap_bind - Error: could not perform interactive bind for id [] authentication mechanism [GSSAPI]: error -1 (Can't contact LDAP server)<o:p></o:p> [23/Apr/2016:14:38:02 -0400] slapd_ldap_sasl_interactive_bind - Error: could not perform interactive bind for id [] mech [GSSAPI]: LDAP error -1 (Can't contact LDAP server) ((null)) errno 107 (Transport endpoint is not connected)<o:p></o:p> [23/Apr/2016:14:38:02 -0400] slapi_ldap_bind - Error: could not perform interactive bind for id [] authentication mechanism [GSSAPI]: error -1 (Can't contact LDAP server)<o:p></o:p> [23/Apr/2016:14:38:13 -0400] NSMMReplicationPlugin - agmt="cn=meTocd-s-ipa1.ipa.domain.local" (cd-s-ipa1:389): Replication bind with GSSAPI auth resumed<o:p></o:p> [25/Apr/2016:22:34:51 -0400] NSMMReplicationPlugin - windows sync - failed to send dirsync search request: 2<o:p></o:p> </blockquote> these are old logs, the problem you were reporting was on Apr, 26: <o:p></o:p> <pre>Apr 26 08:50:21 cd-p-ipa1.ipa.candeal.ca ns-slapd[6333]: [26/Apr/2016:08:50:21 -0400] dse_read_one_file - The entry cn=schema in file /etc/dirsrv/slapd-IPA-CANDEAL-CA/schema/00core.ldif (lineno: 1) is invalid, error code 21 (Invalid syntax) - attribute type aci: Unknown attribute syntax OID "1.3.6.1.4.1.1466.115.121.1.15"<o:p></o:p></pre> <pre>Apr 26 08:50:21 cd-p-ipa1.ipa.candeal.ca ns-slapd[6333]: [26/Apr/2016:08:50:21 -0400] dse - Please edit the file to correct the reported problems and then restart the server.<o:p></o:p></pre> <pre> <o:p></o:p></pre> <pre> <o:p></o:p></pre> <pre>we need the logs from that time<o:p></o:p></pre> <o:p></o:p> <o:p></o:p> Gady<o:p></o:p> <o:p></o:p> -----Original Message----- From: Rob Crittenden [<a moz-do-not-send="true" href="mailto:rcritten@redhat.com">mailto:rcritten@redhat.com</a>] Sent: April 26, 2016 2:44 PM To: Gady Notrica; Ludwig Krispenz; <a moz-do-not-send="true" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> Subject: Re: [Freeipa-users] krb5kdc service not starting<o:p></o:p> <o:p></o:p> Gady Notrica wrote:<o:p></o:p> > Hey world,<o:p></o:p> > <o:p></o:p> > Any ideas?<o:p></o:p> <o:p></o:p> What about the first part of Ludwig's question: Is there anything in the 389-ds error log?<o:p></o:p> <o:p></o:p> rob<o:p></o:p> <o:p></o:p> > <o:p></o:p> > Gady<o:p></o:p> > <o:p></o:p> > -----Original Message-----<o:p></o:p> > From: <a moz-do-not-send="true" href="mailto:freeipa-users-bounces@redhat.com"> freeipa-users-bounces@redhat.com</a> <o:p></o:p> > [<a moz-do-not-send="true" href="mailto:freeipa-users-bounces@redhat.com">mailto:freeipa-users-bounces@redhat.com</a>] On Behalf Of Gady Notrica<o:p></o:p> > Sent: April 26, 2016 10:10 AM<o:p></o:p> > To: Ludwig Krispenz; <a moz-do-not-send="true" href="mailto:freeipa-users@redhat.com"> freeipa-users@redhat.com</a><o:p></o:p> > Subject: Re: [Freeipa-users] krb5kdc service not starting<o:p></o:p> > <o:p></o:p> > No, no changes. Lost connectivity with my VMs during the night <o:p></o:p> > (networking issues in datacenter)<o:p></o:p> > <o:p></o:p> > Reboot the server and oups, no IPA is coming up... The replica (secondary server) is fine though.<o:p></o:p> > <o:p></o:p> > Gady Notrica<o:p></o:p> > <o:p></o:p> > -----Original Message-----<o:p></o:p> > From: <a moz-do-not-send="true" href="mailto:freeipa-users-bounces@redhat.com"> freeipa-users-bounces@redhat.com</a> <o:p></o:p> > [<a moz-do-not-send="true" href="mailto:freeipa-users-bounces@redhat.com">mailto:freeipa-users-bounces@redhat.com</a>] On Behalf Of Ludwig Krispenz<o:p></o:p> > Sent: April 26, 2016 10:02 AM<o:p></o:p> > To: <a moz-do-not-send="true" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><o:p></o:p> > Subject: Re: [Freeipa-users] krb5kdc service not starting<o:p></o:p> > <o:p></o:p> > <o:p></o:p> > On 04/26/2016 03:26 PM, Gady Notrica wrote:<o:p></o:p> >> Here...<o:p></o:p> >> <o:p></o:p> >> [root@cd-p-ipa1 log]# ipactl status<o:p></o:p> >> Directory Service: STOPPED<o:p></o:p> >> Directory Service must be running in order to obtain status of other <o:p></o:p> >> services<o:p></o:p> >> ipa: INFO: The ipactl command was successful<o:p></o:p> >> <o:p></o:p> >> [root@cd-p-ipa1 log]# systemctl status <a moz-do-not-send="true" href="mailto:dirsrv@IPA-CANDEAL-CA.service"> dirsrv@IPA-DOMAIN-LOCAL.service</a> <o:p></o:p> >> -l ● <a moz-do-not-send="true" href="mailto:dirsrv@IPA-DOMAIN-LOCAL.service"> dirsrv@IPA-DOMAIN-LOCAL.service</a> - 389 Directory Server IPA-DOMAIN-LOCAL.<o:p></o:p> >> Loaded: loaded (<a moz-do-not-send="true" href="mailto:/usr/lib/systemd/system/dirsrv@.service">/usr/lib/systemd/system/dirsrv@.service</a>; enabled; vendor preset: disabled)<o:p></o:p> >> Active: failed (Result: exit-code) since Tue 2016-04-26 08:50:21 EDT; 30min ago<o:p></o:p> >> Process: 6333 ExecStart=/usr/sbin/ns-slapd -D <o:p> </o:p> >> /etc/dirsrv/slapd-%i -i /var/run/dirsrv/slapd-%i.pid -w <o:p></o:p> >> /var/run/dirsrv/slapd-%i.startpid (code=exited, status=1/FAILURE)<o:p></o:p> >> <o:p></o:p> >> Apr 26 08:50:21 cd-p-ipa1.ipa.domain.local ns-slapd[6333]:<o:p></o:p> >> [26/Apr/2016:08:50:21 -0400] - valueset_value_syntax_cmp:<o:p></o:p> >> slapi_attr_values2keys_sv failed for type attributetypes Apr 26<o:p></o:p> >> 08:50:21 cd-p-ipa1.ipa.domain.local ns-slapd[6333]:<o:p></o:p> >> [26/Apr/2016:08:50:21 -0400] - valueset_value_syntax_cmp:<o:p></o:p> >> slapi_attr_values2keys_sv failed for type attributetypes Apr 26<o:p></o:p> >> 08:50:21 cd-p-ipa1.ipa.domain.local ns-slapd[6333]:<o:p></o:p> >> [26/Apr/2016:08:50:21 -0400] - valueset_value_syntax_cmp:<o:p></o:p> >> slapi_attr_values2keys_sv failed for type attributetypes Apr 26 08:50:21 cd-p-ipa1.ipa.domain.local ns-slapd[6333]: [26/Apr/2016:08:50:21 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes Apr 26 08:50:21 cd-p-ipa1.ipa.domain.local ns-slapd[6333]: [26/Apr/2016:08:50:21 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes Apr 26 08:50:21 cd-p-ipa1.ipa.domain.local ns-slapd[6333]: [26/Apr/2016:08:50:21 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes Apr 26 08:50:21 cd-p-ipa1.ipa.domain.local ns-slapd[6333]: [26/Apr/2016:08:50:21 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes Apr 26 08:50:21 cd-p-ipa1.ipa.domain.local ns-slapd[6333]: [26/Apr/2016:08:50:21 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes Apr 26 08:50:21 cd-p-ipa1.ipa.domain.local ns-slapd[6333]: [26/Apr/2016!<o:p></o:p> :08:50:21<o:p></o:p> -0400] dse_read_one_file - The entry cn=schema in file /etc/dirsrv/slapd-IPA-DOMAIN-LOCAL/schema/00core.ldif (lineno: 1) is invalid, error code 21 (Invalid syntax) - attribute type aci: Unknown attribute syntax OID "1.3.6.1.4.1.1466.115.121.1.15"<o:p></o:p> >> Apr 26 08:50:21 cd-p-ipa1.ipa.domain.local ns-slapd[6333]: [26/Apr/2016:08:50:21 -0400] dse - Please edit the file to correct the reported problems and then restart the server.<o:p></o:p> > this says the server doesn't know a syntax oid, but it is a known one.<o:p></o:p> > It could be that the syntax plugings couldn't be loaded. Thera are more errors before, could you check where the errors start in /var/log/dirsrv/slapd-<INSTANCE>/errors ?<o:p></o:p> > <o:p></o:p> > And, did you do any changes to the system before this problem started ?<o:p></o:p> >> [root@cd-p-ipa1 log]#<o:p></o:p> >> <o:p></o:p> >> Gady<o:p></o:p> >> <o:p></o:p> >> -----Original Message-----<o:p></o:p> >> From: <a moz-do-not-send="true" href="mailto:freeipa-users-bounces@redhat.com"> freeipa-users-bounces@redhat.com</a> <o:p></o:p> >> [<a moz-do-not-send="true" href="mailto:freeipa-users-bounces@redhat.com">mailto:freeipa-users-bounces@redhat.com</a>] On Behalf Of Martin <o:p></o:p> >> Babinsky<o:p></o:p> >> Sent: April 26, 2016 9:17 AM<o:p></o:p> >> To: <a moz-do-not-send="true" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><o:p></o:p> >> Subject: Re: [Freeipa-users] krb5kdc service not starting<o:p></o:p> >> <o:p></o:p> >> On 04/26/2016 03:13 PM, Gady Notrica wrote:<o:p></o:p> >>> Hello world,<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> I am having issues this morning with my primary IPA. See below the <o:p></o:p> >>> details in the logs and command result. Basically, krb5kdc service <o:p></o:p> >>> not starting - krb5kdc: Server error - while fetching master key.<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> DNS is functioning. See below dig result. I have a trust with Windows AD.<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> Please help…!<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> [root@cd-ipa1 log]# systemctl status krb5kdc.service -l<o:p></o:p> >>> <o:p></o:p> >>> ● krb5kdc.service - Kerberos 5 KDC<o:p></o:p> >>> <o:p></o:p> >>> Loaded: loaded (/usr/lib/systemd/system/krb5kdc.service;<o:p></o:p> >>> disabled; vendor preset: disabled)<o:p></o:p> >>> <o:p></o:p> >>> Active: failed (Result: exit-code) since Tue 2016-04-26 <o:p></o:p> >>> 08:27:52 EDT; 41min ago<o:p></o:p> >>> <o:p></o:p> >>> Process: 3694 ExecStart=/usr/sbin/krb5kdc -P <o:p> </o:p> >>> /var/run/krb5kdc.pid $KRB5KDC_ARGS (code=exited, status=1/FAILURE)<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:52 cd-ipa1.ipa.domain.localsystemd[1]: Starting <o:p></o:p> >>> Kerberos<o:p></o:p> >>> 5 KDC...<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:52 cd-ipa1.ipa.domain.localkrb5kdc[3694]: krb5kdc:<o:p></o:p> >>> cannot initialize realm IPA.DOMAIN.LOCAL- see log file for details<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:52 cd-ipa1.ipa.domain.localsystemd[1]: krb5kdc.service:<o:p></o:p> >>> control process exited, code=exited status=1<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:52 cd-ipa1.ipa.domain.localsystemd[1]: Failed to start <o:p></o:p> >>> Kerberos 5 KDC.<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:52 cd-ipa1.ipa.domain.localsystemd[1]: Unit <o:p></o:p> >>> krb5kdc.service entered failed state.<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:52 cd-ipa1.ipa.domain.localsystemd[1]: krb5kdc.service failed.<o:p></o:p> >>> <o:p></o:p> >>> [root@cd-ipa1 log]#<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> Errors in /var/log/krb5kdc.log<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> krb5kdc: Server error - while fetching master key K/M for realm <o:p></o:p> >>> DOMAIN.LOCAL<o:p></o:p> >>> <o:p></o:p> >>> krb5kdc: Server error - while fetching master key K/M for realm <o:p></o:p> >>> DOMAIN.LOCAL<o:p></o:p> >>> <o:p></o:p> >>> krb5kdc: Server error - while fetching master key K/M for realm <o:p></o:p> >>> DOMAIN.LOCAL<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> [root@cd-ipa1 log]# systemctl status httpd -l<o:p></o:p> >>> <o:p></o:p> >>> ● httpd.service - The Apache HTTP Server<o:p></o:p> >>> <o:p></o:p> >>> Loaded: loaded (/etc/systemd/system/httpd.service; disabled; <o:p></o:p> >>> vendor<o:p></o:p> >>> preset: disabled)<o:p></o:p> >>> <o:p></o:p> >>> Active: failed (Result: exit-code) since Tue 2016-04-26 <o:p></o:p> >>> 08:27:21 EDT; 39min ago<o:p></o:p> >>> <o:p></o:p> >>> Docs: <a moz-do-not-send="true" href="man:httpd%288%29">man:httpd(8)</a><o:p></o:p> >>> <o:p></o:p> >>> <a moz-do-not-send="true" href="man:apachectl%288%29">man:apachectl(8)</a><o:p></o:p> >>> <o:p></o:p> >>> Process: 3594 ExecStartPre=/usr/libexec/ipa/ipa-httpd-kdcproxy<o:p></o:p> >>> (code=exited, status=1/FAILURE)<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:21 cd-ipa1.ipa.domain.localipa-httpd-kdcproxy[3594]:<o:p></o:p> >>> File "/usr/lib/python2.7/siteackages/ipapython/ipaldap.py", line <o:p></o:p> >>> 1579, in __wait_for_connection<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:21 cd-ipa1.ipa.domain.local ipa-httpd-kdcproxy[3594]:<o:p></o:p> >>> wait_for_open_socket(lurl.hostport, timeout)<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:21 cd-ipa1.ipa.domain.local ipa-httpd-kdcproxy[3594]:<o:p></o:p> >>> File "/usr/lib/python2.7/siteackages/ipapython/ipautil.py", line <o:p></o:p> >>> 1200, in wait_for_open_socket<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:21 cd-ipa1.ipa.domain.local ipa-httpd-kdcproxy[3594]:<o:p></o:p> >>> raise e<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:21 cd-ipa1.ipa.domain.local ipa-httpd-kdcproxy[3594]:<o:p></o:p> >>> error: [Errno 2] No such file or directory<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:21 cd-ipa1.ipa.domain.local ipa-httpd-kdcproxy[3594]:<o:p></o:p> >>> ipa : ERROR Unknown error while retrieving setting from<o:p></o:p> >>> ldapi://%2fvar%2frun%2fslapd-IPA-DOMAIN-LOCAL.socket: [Errno 2] No <o:p></o:p> >>> such file or directory<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:21 cd-ipa1.ipa.domain.localsystemd[1]: httpd.service:<o:p></o:p> >>> control process exited, code=exited status=1<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:21 cd-ipa1.ipa.domain.localsystemd[1]: Failed to start <o:p></o:p> >>> The Apache HTTP Server.<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:21 cd-ipa1.ipa.domain.localsystemd[1]: Unit <o:p></o:p> >>> httpd.service entered failed state.<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:21 cd-ipa1.ipa.domain.localsystemd[1]: httpd.service failed.<o:p></o:p> >>> <o:p></o:p> >>> [root@cd-ipa1 log]#<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> DNS Result for dig redhat.com<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> ; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7_2.3 <<>> redhat.com<o:p></o:p> >>> <o:p></o:p> >>> ;; global options: +cmd<o:p></o:p> >>> <o:p></o:p> >>> ;; Got answer:<o:p></o:p> >>> <o:p></o:p> >>> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5414<o:p></o:p> >>> <o:p></o:p> >>> ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: <o:p></o:p> >>> 2<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> ;; OPT PSEUDOSECTION:<o:p></o:p> >>> <o:p></o:p> >>> ; EDNS: version: 0, flags:; udp: 4096<o:p></o:p> >>> <o:p></o:p> >>> ;; QUESTION SECTION:<o:p></o:p> >>> <o:p></o:p> >>> ;redhat.com. IN A<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> ;; ANSWER SECTION:<o:p></o:p> >>> <o:p></o:p> >>> redhat.com. 60 IN A 209.132.183.105<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> ;; AUTHORITY SECTION:<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS f.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS e.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS k.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS m.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS b.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS g.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS c.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS h.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS l.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS a.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS j.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS i.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS d.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> ;; ADDITIONAL SECTION:<o:p></o:p> >>> <o:p></o:p> >>> j.root-servers.net. 3246 IN A 192.58.128.30<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> ;; Query time: 79 msec<o:p></o:p> >>> <o:p></o:p> >>> ;; SERVER: 10.20.10.41#53(10.20.10.41)<o:p></o:p> >>> <o:p></o:p> >>> ;; WHEN: Tue Apr 26 09:02:43 EDT 2016<o:p></o:p> >>> <o:p></o:p> >>> ;; MSG SIZE rcvd: 282<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> Gady<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >> It seems like Directory server is not running. Can you post result of 'ipactl status' and 'systemctl status <a moz-do-not-send="true" href="mailto:dirsrv@IPA-CANDEAL-CA.service">dirsrv@IPA-DOMAIN-LOCAL.service</a>'?<o:p></o:p> >> <o:p></o:p> >> --<o:p></o:p> >> Martin^3 Babinsky<o:p></o:p> >> <o:p></o:p> >> --<o:p></o:p> >> Manage your subscription for the Freeipa-users mailing list:<o:p></o:p> >> <a moz-do-not-send="true" href="https://www.redhat.com/mailman/listinfo/freeipa-users"> https://www.redhat.com/mailman/listinfo/freeipa-users</a><o:p></o:p> >> Go to <a moz-do-not-send="true" href="http://freeipa.org">http://freeipa.org</a> for more info on the project<o:p></o:p> >> <o:p></o:p> > <o:p></o:p> > --<o:p></o:p> > Red Hat GmbH, <a moz-do-not-send="true" href="http://www.de.redhat.com/">http://www.de.redhat.com/</a>, Registered seat: Grasbrunn, <o:p></o:p> > Commercial register: Amtsgericht Muenchen, HRB 153243, Managing <o:p></o:p> > Directors: Paul Argiry, Charles Cachera, Michael Cunningham, Michael <o:p></o:p> > O'Neill<o:p></o:p> > <o:p></o:p> > --<o:p></o:p> > Manage your subscription for the Freeipa-users mailing list:<o:p></o:p> > <a moz-do-not-send="true" href="https://www.redhat.com/mailman/listinfo/freeipa-users"> https://www.redhat.com/mailman/listinfo/freeipa-users</a><o:p></o:p> > Go to <a moz-do-not-send="true" href="http://freeipa.org">http://freeipa.org</a> for more info on the project<o:p></o:p> > <o:p></o:p> > --<o:p></o:p> > Manage your subscription for the Freeipa-users mailing list:<o:p></o:p> > <a moz-do-not-send="true" href="https://www.redhat.com/mailman/listinfo/freeipa-users"> https://www.redhat.com/mailman/listinfo/freeipa-users</a><o:p></o:p> > Go to <a moz-do-not-send="true" href="http://freeipa.org">http://freeipa.org</a> for more info on the project<o:p></o:p> > <o:p></o:p> <o:p></o:p> <o:p></o:p> <pre>-- <o:p></o:p></pre> <pre>Red Hat GmbH, <a moz-do-not-send="true" href="http://www.de.redhat.com/">http://www.de.redhat.com/</a>, Registered seat: Grasbrunn, <o:p></o:p></pre> <pre>Commercial register: Amtsgericht Muenchen, HRB 153243,<o:p></o:p></pre> <pre>Managing Directors: Paul Argiry, Charles Cachera, Michael Cunningham, Michael O'Neill<o:p></o:p></pre> <o:p></o:p> <pre>-- <o:p></o:p></pre> <pre>Red Hat GmbH, <a moz-do-not-send="true" href="http://www.de.redhat.com/">http://www.de.redhat.com/</a>, Registered seat: Grasbrunn, <o:p></o:p></pre> <pre>Commercial register: Amtsgericht Muenchen, HRB 153243,<o:p></o:p></pre> <pre>Managing Directors: Paul Argiry, Charles Cachera, Michael Cunningham, Michael O'Neill<o:p></o:p></pre> </div> </blockquote> <pre class="moz-signature" cols="72">-- Red Hat GmbH, <a class="moz-txt-link-freetext" href="http://www.de.redhat.com/">http://www.de.redhat.com/</a>, Registered seat: Grasbrunn, Commercial register: Amtsgericht Muenchen, HRB 153243, Managing Directors: Paul Argiry, Charles Cachera, Michael Cunningham, Michael O'Neill</pre> </body> </html>