<div dir="ltr">Managed to fix it: had to stop dirsrv@IPA-RDMEDIA-COM and put the server's hostname on the line with nsslapd-localhost<div><br></div><div>Then run ipa-replica-manage re-initialize --from <a href="http://other-master.ipa.rdmedia.com">other-master.ipa.rdmedia.com</a></div></div><div class="gmail_extra"><br><div class="gmail_quote">On 19 August 2016 at 12:14, Tiemen Ruiten <span dir="ltr"><<a href="mailto:t.ruiten@rdmedia.com" target="_blank">t.ruiten@rdmedia.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I see lots of messages /var/log/dirsrv/slapd-IPA-<wbr>RDMEDIA-COM/errors, looks definitely like an issue with dirsrv.</div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On 19 August 2016 at 11:43, Tiemen Ruiten <span dir="ltr"><<a href="mailto:t.ruiten@rdmedia.com" target="_blank">t.ruiten@rdmedia.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">I see I didn't use the right terminology: all four of my FreeIPA servers are masters.</div><div><div><div class="gmail_extra"><br><div class="gmail_quote">On 19 August 2016 at 11:36, Tiemen Ruiten <span dir="ltr"><<a href="mailto:t.ruiten@rdmedia.com" target="_blank">t.ruiten@rdmedia.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hello,<div><br></div><div>I need some help getting one of my replica's to work. Assistance would be much appreciated.</div><div><br></div><div>After the iSCSI volumes of two replicas of were briefly unavailable, on one of them DNS and LDAP stopped working and replication seems to have stopped. The ipa service failed with a message that an upgrade was required, so I ran ipa-server-upgrade, but it failed due to an empty dse.ldif. </div><div><br></div><div>Then I probably made a mistake by copying a dse.ldif from another replica and trying to run the upgrade. It worked more or less, but DNS still didn't work.</div><div><br></div><div>Next I replaced it with an older backup file (from Aug 4) ran the upgrade command again and after some fiddling all services started normally, except ipa-dnskeysyncd:</div><div><br></div><div>journalctl -u ipa-dnskeysyncd</div><div><br></div><div><div><div>Aug 19 11:28:52 <a href="http://promethium.ipa.rdmedia.com" target="_blank">promethium.ipa.rdmedia.com</a> systemd[1]: ipa-dnskeysyncd.service holdoff time over, scheduling restart.</div><div>Aug 19 11:28:52 <a href="http://promethium.ipa.rdmedia.com" target="_blank">promethium.ipa.rdmedia.com</a> systemd[1]: Started IPA key daemon.</div><div>Aug 19 11:28:52 <a href="http://promethium.ipa.rdmedia.com" target="_blank">promethium.ipa.rdmedia.com</a> systemd[1]: Starting IPA key daemon...</div><div>Aug 19 11:28:52 <a href="http://promethium.ipa.rdmedia.com" target="_blank">promethium.ipa.rdmedia.com</a> ipa-dnskeysyncd[3756]: ipa: WARNING: session memcached servers not running</div><div>Aug 19 11:28:53 <a href="http://promethium.ipa.rdmedia.com" target="_blank">promethium.ipa.rdmedia.com</a> ipa-dnskeysyncd[3756]: ipa : INFO LDAP bind...</div><div>Aug 19 11:28:53 <a href="http://promethium.ipa.rdmedia.com" target="_blank">promethium.ipa.rdmedia.com</a> python2[3756]: GSSAPI client step 1</div><div>Aug 19 11:28:54 <a href="http://promethium.ipa.rdmedia.com" target="_blank">promethium.ipa.rdmedia.com</a> python2[3756]: GSSAPI client step 1</div><div>Aug 19 11:28:55 <a href="http://promethium.ipa.rdmedia.com" target="_blank">promethium.ipa.rdmedia.com</a> ipa-dnskeysyncd[3756]: ipa : ERROR Login to LDAP server failed: {'info': 'SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No key table entry found matching ldap/praseodymium.ipa.rdmedia.<wbr>com@)', 'desc': 'Invalid credentials'}</div><div>Aug 19 11:28:55 <a href="http://promethium.ipa.rdmedia.com" target="_blank">promethium.ipa.rdmedia.com</a> ipa-dnskeysyncd[3756]: Traceback (most recent call last):</div><div>Aug 19 11:28:55 <a href="http://promethium.ipa.rdmedia.com" target="_blank">promethium.ipa.rdmedia.com</a> ipa-dnskeysyncd[3756]: File "/usr/libexec/ipa/ipa-dnskeysy<wbr>ncd", line 92, in <module></div><div>Aug 19 11:28:55 <a href="http://promethium.ipa.rdmedia.com" target="_blank">promethium.ipa.rdmedia.com</a> ipa-dnskeysyncd[3756]: ldap_connection.sasl_interacti<wbr>ve_bind_s("", ipaldap.SASL_GSSAPI)</div><div>Aug 19 11:28:55 <a href="http://promethium.ipa.rdmedia.com" target="_blank">promethium.ipa.rdmedia.com</a> ipa-dnskeysyncd[3756]: File "/usr/lib64/python2.7/site-pac<wbr>kages/ldap/ldapobject.py", line 850, in sasl_interactive_bind_s</div><div>Aug 19 11:28:55 <a href="http://promethium.ipa.rdmedia.com" target="_blank">promethium.ipa.rdmedia.com</a> ipa-dnskeysyncd[3756]: res = self._apply_method_s(SimpleLDA<wbr>PObject.sasl_interactive_bind_<wbr>s,*args,**kwargs)</div><div>Aug 19 11:28:55 <a href="http://promethium.ipa.rdmedia.com" target="_blank">promethium.ipa.rdmedia.com</a> ipa-dnskeysyncd[3756]: File "/usr/lib64/python2.7/site-pac<wbr>kages/ldap/ldapobject.py", line 818, in _apply_method_s</div><div>Aug 19 11:28:55 <a href="http://promethium.ipa.rdmedia.com" target="_blank">promethium.ipa.rdmedia.com</a> ipa-dnskeysyncd[3756]: return func(self,*args,**kwargs)</div><div>Aug 19 11:28:55 <a href="http://promethium.ipa.rdmedia.com" target="_blank">promethium.ipa.rdmedia.com</a> ipa-dnskeysyncd[3756]: File "/usr/lib64/python2.7/site-pac<wbr>kages/ldap/ldapobject.py", line 229, in sasl_interactive_bind_s</div><div>Aug 19 11:28:55 <a href="http://promethium.ipa.rdmedia.com" target="_blank">promethium.ipa.rdmedia.com</a> ipa-dnskeysyncd[3756]: return self._ldap_call(self._l.sasl_i<wbr>nteractive_bind_s,who,auth,Req<wbr>uestControlTuples(serverctrls)<wbr>,RequestControlTuples(clientct<wbr>rls),sasl_flags)</div><div>Aug 19 11:28:55 <a href="http://promethium.ipa.rdmedia.com" target="_blank">promethium.ipa.rdmedia.com</a> ipa-dnskeysyncd[3756]: File "/usr/lib64/python2.7/site-pac<wbr>kages/ldap/ldapobject.py", line 99, in _ldap_call</div><div>Aug 19 11:28:55 <a href="http://promethium.ipa.rdmedia.com" target="_blank">promethium.ipa.rdmedia.com</a> ipa-dnskeysyncd[3756]: result = func(*args,**kwargs)</div><div>Aug 19 11:28:55 <a href="http://promethium.ipa.rdmedia.com" target="_blank">promethium.ipa.rdmedia.com</a> ipa-dnskeysyncd[3756]: INVALID_CREDENTIALS: {'info': 'SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No key table entry found matching ldap/praseodymium.ipa.rdmedia.<wbr>com@)', 'desc': 'Invalid credentials'}</div></div></div><div><br></div><div><a href="http://praseodymium.ipa.rdmedia.com" target="_blank">praseodymium.ipa.rdmedia.com</a> is the replica I copied the dse.ldif from. DNS and logins to the webinterface on this host are still not working.</div><div><br></div><div>What can I do to get this replica in working order again?</div><span><font color="#888888"><div><br></div><div>-- <br><div data-smartmail="gmail_signature"><div dir="ltr">Tiemen Ruiten<br>Systems Engineer<br>R&D Media<br></div></div> </div></font></span></div> </blockquote></div><br><br clear="all"><div><br></div>-- <br><div data-smartmail="gmail_signature"><div dir="ltr">Tiemen Ruiten<br>Systems Engineer<br>R&D Media<br></div></div> </div> </div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div data-smartmail="gmail_signature"><div dir="ltr">Tiemen Ruiten<br>Systems Engineer<br>R&D Media<br></div></div> </div> </div></div></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div dir="ltr">Tiemen Ruiten<br>Systems Engineer<br>R&D Media<br></div></div> </div>