<div dir="ltr">Hi All,<div><br></div><div>I am stuck with this gateway error on my replicas. I recreated the replicas but that did not help either. I realised that if i just keep my primary ipa up then i do not get the error on the secondary/replica server. The error logs on replica shows hits are getting successfully executed but i am certain that its trying to bind to primary ipa server when i am trying to open the hosts/users entries. It seems its failing to make ldap bind to primary server and then eventually timing out.</div><div><br></div><div>Any idea why in my case replica is trying to connect to ipa master? </div><div><br></div><div>Thanks,</div><div>Deepak</div><div><br></div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Thu, Feb 2, 2017 at 10:12 AM, deepak dimri <span dir="ltr"><<a href="mailto:deepak.dimri2016@gmail.com" target="_blank">deepak.dimri2016@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hey Martin,<div><br></div><div><br></div><div>Is gateway error has anything to do with --no-wait-for-dns flag that i used when i created the replica image? i have another test IPA setup working fine in the same env and the only difference i see that in that env i did not use --no-wait-for-dns for replicas</div><div><br></div><div>Thanks,</div><div>Deepak</div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Feb 1, 2017 at 10:52 PM, deepak dimri <span dir="ltr"><<a href="mailto:deepak.dimri2016@gmail.com" target="_blank">deepak.dimri2016@gmail.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">sorry for not replying to all!<div><br></div><div>I have apache reverse proxy front ending the ipa servers. As i mentioned if i try hitting ipa replica WebUI directly then i do get the objects loaded on the browser after waiting for over a minute or so. replica server <span style="font-size:12.8px">(/var/log/dirsrv/slapd-<wbr>$YOUR_R</span><span style="font-size:12.8px">EALM/{access,errors}) shows hits coming through fine but for some reasons web browser ends up with the gateway error.</span><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">both the ipa masters are running VERSION: 4.4.0, API_VERSION: 2.213</span></div></div><div><span style="font-size:12.8px"><br></span></div><div><span style="font-size:12.8px">Kind Regards,</span></div><div><span style="font-size:12.8px">Deepak</span></div><div><span style="font-size:12.8px"><br></span></div></div><div class="m_-3642759390511524668HOEnZb"><div class="m_-3642759390511524668h5"><div class="gmail_extra"><br><div class="gmail_quote">On Wed, Feb 1, 2017 at 9:21 PM, Martin Babinsky <span dir="ltr"><<a href="mailto:mbabinsk@redhat.com" target="_blank">mbabinsk@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On 02/01/2017 04:26 PM, deepak dimri wrote:<br> </span><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span> Yes, Martin - i do see requests hitting<br> replica.. /var/log/httpd/error_log shows:<br> <br> [Wed Feb 01 15:16:47.<a href="tel:469766%202017" value="+14697662017" target="_blank">469766 2017</a>] [:error] [pid 2464] ipa: INFO:<br> </span><a href="mailto:admin@XXX.XYZ.COM" target="_blank">admin@XXX.XYZ.COM</a> <mailto:<a href="mailto:admin@XXX.XYZ.COM" target="_blank">admin@XXX.XYZ.COM</a>>: batch:<br> host_show(u'<a href="http://xxx.abx.xyz" rel="noreferrer" target="_blank">xxx.abx.xyz</a> <<a href="http://xxx.abx.xyz" rel="noreferrer" target="_blank">http://xxx.abx.xyz</a>>', rights=True, all=True):<span><br> SUCCESS<br> <br> I used ansible playbook to build the replica server. ran<br> ipa-replica-prepare on the primary:<br> ipa-replica-prepare {{ replica_dns }} --password={{ipa_password}}<br> --no-wait-for-dns<br> <br> copied the replica file over to replica server:<br> scp -oStrictHostKeyChecking=no -i ~/.ssh/{{ssh_keyname}}.pem<br> /var/lib/ipa/replica-info-{{ replica_dns }}.gpg root@{{<br> replica_dns }}:/var/lib/ipa/<br> <br> ran the replica install on the replica server:<br> ipa-replica-install /var/lib/ipa/replica-info-{{ replica_dns }}.gpg<br> --password={{ipa_password}} --admin-password={{ipa_passwor<wbr>d}}<br> <br> I have notices that if i directly use the replica (bypassing proxy) URL<br> then the objects shows after waiting for over a minute or so. When i use<br> proxy pass then it just times out after few seconds.<br> <br> No clue why its behaving like this<br> <br> Many Thanks,<br> Deepak<br> <br> On Wed, Feb 1, 2017 at 6:45 PM, Martin Babinsky <<a href="mailto:mbabinsk@redhat.com" target="_blank">mbabinsk@redhat.com</a><br></span><span> <mailto:<a href="mailto:mbabinsk@redhat.com" target="_blank">mbabinsk@redhat.com</a>>> wrote:<br> <br> On 02/01/2017 11:17 AM, deepak dimri wrote:<br> <br> Hello Martin, Thank you so much for your reply.<br> <br> I checked /etc/ipa/default.conf 'xmlrpc_uri' on my secondary<br> server and<br> its pointing to its own hostname and not to primary server<br> hostname :(<br> <br> any other clue, Martin?<br> <br> I have tried without proxy and again to luck either its throwing<br> same<br> gateway_error<br> <br> Regards,<br> Deepak<br> <br> On Wed, Feb 1, 2017 at 3:03 PM, Martin Babinsky<br> <<a href="mailto:mbabinsk@redhat.com" target="_blank">mbabinsk@redhat.com</a> <mailto:<a href="mailto:mbabinsk@redhat.com" target="_blank">mbabinsk@redhat.com</a>><br></span><div><div class="m_-3642759390511524668m_-5929057605839023846h5"> <mailto:<a href="mailto:mbabinsk@redhat.com" target="_blank">mbabinsk@redhat.com</a> <mailto:<a href="mailto:mbabinsk@redhat.com" target="_blank">mbabinsk@redhat.com</a>>>> wrote:<br> <br> On 02/01/2017 10:22 AM, deepak dimri wrote:<br> <br> Hi All,<br> <br> I have two IPA servers - primary and secondary running. the<br> secondary<br> ipa server is installed using ipa replica image of primary.<br> While doing<br> the testing i realised that when i manually shut down my<br> primary ipa<br> server making my secondary server to serve the UI. And<br> now when<br> i try to<br> access user or hosts details using my secondary server<br> then i am<br> getting<br> below error in the UI. I am able to login fine though; it is<br> just that<br> when i double click on host objects then i get the error.<br> <br> <br> An error has occurred (GATEWAY_TIMEOUT)<br> <br> <br> I am still trying to troubleshoot as why i am getting<br> timeout<br> error but<br> thought of asking the group here to see if some one can<br> share<br> some pointers<br> <br> Many Thanks,<br> Deepak<br> <br> <br> Hi Deepak,<br> <br> please check /etc/ipa/default.conf on the secondary server<br> and check<br> the value of 'xmlrpc_uri'. Maybe it points to the URL of primary<br> server and that's why you get timeouts when it is down.<br> <br> Re-setting it to the secondary server itself should fix it.<br> <br> --<br> Martin^3 Babinsky<br> <br> --<br> Manage your subscription for the Freeipa-users mailing list:<br> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailman<wbr>/listinfo/freeipa-users</a><br> <<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailma<wbr>n/listinfo/freeipa-users</a>><br> <<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailma<wbr>n/listinfo/freeipa-users</a><br> <<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" rel="noreferrer" target="_blank">https://www.redhat.com/mailma<wbr>n/listinfo/freeipa-users</a>>><br> Go to <a href="http://freeipa.org" rel="noreferrer" target="_blank">http://freeipa.org</a> for more info on the project<br> <br> <br> <br> Adding freeipa-users back to loop.<br> <br> That is strange, how did you stand up the replica?<br> <br> You can also inspect /var/log/http/error_log on the replica to see<br> whether the commands from the WebUI reach the local HTTP server at all.<br> <br> --<br> Martin^3 Babinsky<br> <br> <br> </div></div></blockquote> <br> Deepak,<br> <br> please keep replying to freeipa-users mailing list, otherwise other members do not get updates on your problem.<br> <br> As for the issues with replica, I did not notice before that you are connecting to WebUI through a proxy, what kind of proxy is that and how is it configured?<br> <br> Nevertheless waiting for over a minute to display entries does not sound right. I would investigate the root cause of this performance regression by checking DS access and error logs on the replica (/var/log/dirsrv/slapd-$YOUR_R<wbr>EALM/{access,errors}).<br> <br> Does the master also take so long time to respond? What are the IPA versions of master/replica?<span class="m_-3642759390511524668m_-5929057605839023846HOEnZb"><font color="#888888"><br> <br> -- <br> Martin^3 Babinsky<br> </font></span></blockquote></div><br></div> </div></div></blockquote></div><br></div> </div></div></blockquote></div><br></div>