[Freeipa-users] IPA Servers out of sync - DNS records

[German Parente]

Hi,

I think we can explain it.

Is it possible that you were running
389-ds-base-1.3.4.0-33.el7_2.x86_64.rpm release ?

>From the string: 389-Directory/1.3.4.0 B2016.215.1556

it seems to me that corresponds to

rpm -qi -p 389-ds-base-1.3.4.0-33.el7_2.x86_64.rpm | grep -i ^signature

Signature   : RSA/SHA256, Tue 26 Jul 2016 04:49:26 AM CEST, Key ID
199e2f91fd431d51

This release includes a very harmful replication bug that manifests with
this error message, that we can see in your logs:

[20/Dec/2016:22:50:14 -0500] agmt="cn=meToipa2.optimcloud.com"
(ipa2:389) - Can't locate CSN 58528dac000200040000 in the changelog
(DB rc=-30988). If replication stops, the consumer may need to be
reinitialized.

And the replicas are out of sync + replication stopped.

It's explained in this article:

https://access.redhat.com/solutions/2690611
IdM/IPA LDAP and Red Hat Directory Server/RHDS replication halt, error
Can't locate CSN number in the changelog (DB rc=-30988)

You update to 7.3 has the fix for that bug included.

regards,

German.



On Tue, Dec 27, 2016 at 1:21 PM, Outback Dingo <outbackdingo at gmail.com>
wrote:

> > According to log, it looks that replication has been restored a week ago
> >
> > can you use https://github.com/peterpakos/ipa_check_consistency to check
> > what else is missing?
> >
> > If it finds missing entries, probably re-initialization will be needed
> >
> > Martin
>
>
> really odd... i just did a yum update -y during our conversation on
> both servers, now ipa2 is synced again...
>
> --
> Manage your subscription for the Freeipa-users mailing list:
> https://www.redhat.com/mailman/listinfo/freeipa-users
> Go to http://freeipa.org for more info on the project
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/freeipa-users/attachments/20161228/9b0edd9b/attachment.htm>