[Freeipa-users] SSSD (sssd_be) crashing on RHEL 6.2

[Sigbjorn Lie]

On 03/02/2012 05:19 PM, Stephen Gallagher wrote:
> On Fri, 2012-03-02 at 15:20 +0100, Sigbjorn Lie wrote:
>> On Fri, March 2, 2012 15:16, Stephen Gallagher wrote:
>>> On Fri, 2012-03-02 at 15:08 +0100, Sigbjorn Lie wrote:
>>>
>>>> On Fri, March 2, 2012 15:04, Stephen Gallagher wrote:
>>>>
>>>>> On Fri, 2012-03-02 at 14:52 +0100, Sigbjorn Lie wrote:
>>>>>
>>>>>
>>>>>> Hi,
>>>>>>
>>>>>>
>>>>>>
>>>>>> I'm experiencing that SSSD is now crashing at random times on _ALL_ RHEL 6.2 machines where
>>>>>> we have installed SSSD connected to an IPA domain. SSSD can reach up to a month of uptime
>>>>>> before sssd_be crashes. This happens on both physical and virtual machines. It happens at
>>>>>> different machines at different times, sometimes during working hours, other times during
>>>>>> the middle of the night. It's never happened on several machines at the same time.
>>>>>>
>>>>>> These machines does not have a GUI and the issue is similar but not directly related to the
>>>>>> KDE
>>>>>> screensaver lock as per my earlier posts. Also, the KDE screensaver issue was at RHEL 5.
>>>>>>
>>>>>> What happens is a line in the syslog about sssd_be crashing.
>>>>>>
>>>>>>
>>>>>>
>>>>>> sssd_be[1418] general protection ip:41d527 sp:7fff9e82ead0 error:0 in sssd_be[400000+4a000]
>>>>>>
>>>>>>
>>>>>> sssd_be is then being restarted by the parent process, but is no longer usable. Any login
>>>>>> via ssh to these machines will just hang.
>>>>>>
>>>>>> Has anyone else seen this issue?
>>>>>>
>>>>>>
>>>>>
>>>>> Can you try to get us a backtrace, please? "general protection" isn't
>>>>> enough information. Though it's interesting that it's "general protection" and not
>>>>> "segfault"...
>>>>> That's certainly new.
>>>>>
>>>>>
>>>>>
>>>>> Do you have abrtd running on these systems? If so, it should be able to
>>>>> capture a core dump when this happens again, which you can use to generate a backtrace for us.
>>>>>   _______________________________________________
>>>>>
>>>> I certainly do have abrt, some of the dumps are quite large. I will send you these in a private
>>>>   email.
>>>>
>>>
>>> Thanks, can you also let me know the exact version of SSSD that you're
>>> running?
>>>
>> Sure.
>>
>> sssd-1.5.1-66.el6.x86_64
>> sssd-client-1.5.1-66.el6.x86_64
> I've opened https://fedorahosted.org/sssd/ticket/1226 to track the crash
> you're seeing. All three of the backtraces you sent me had the same
> information (included in the ticket; it contains no private data).
>
> This is only happening during "graceful" shutdown when sssd_be receives
> a SIGTERM and is cancelling all pending requests. It's possible that the
> actual behavior you're seeing is unrelated to this crash, though.
> Because a crash at shutdown (or restart) should still be properly
> recovering.
>
> This is a serious issue though, so let's get this out of the picture and
> see what else happens after that.

Thanks.

I see from the bugzilla ticket that you have not been able to re-produce 
the issue.

I would like to mention that one thing these machines share in common 
that's using sssd, is that we utilize Nagios for monitoring where a 
monitoring user is logging in using ssh to check various services. There 
are approx 20 services being checked every 5 minutes, approx 240 logins 
per hour.

We also use HBAC rules for access control. And we have "options rotate", 
and "options timeout:4" set in resolv.conf on our clients. We also have 
a modified krb5.conf file having multiple kerberos realms, enabling dns 
kdc lookups, and disabling dns realm lookups.

Not that I see how anything of that could be related, but that is what I 
can think of that's been modified after a stock ipa-client-install.


Regards,
Siggi