<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span><div>Hi Dimitri,</div><div><br></div><div> thanks a lot for your offer. It will be more than appreciated if Rob, or some other talented genius could wiki the steps. The more details, the sooner, and the better. It will help IPA projects and its users dramatically, especially for newbies like me. :)</div><div><br></div><div>Thanks again for you, Rob and others for the coming documentation work.</div><div><br></div><div><br></div><div>--Gelen. </div></span></div><div><br></div> <div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "> <div style="font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; "> <div dir="ltr"> <font size="2" face="Arial"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> Dmitri Pal <dpal@redhat.com><br>
<b><span style="font-weight: bold;">To:</span></b> Robinson Tiemuqinke <hahaha_30k@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "Freeipa-users@redhat.com" <Freeipa-users@redhat.com>; Rich Megginson <rmeggins@redhat.com> <br> <b><span style="font-weight: bold;">Sent:</span></b> Monday, May 14, 2012 1:20 PM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: Please help: How to restore IPA Master/Replicas from daily IPA Replica setup???<br> </font> </div> <br>
<div id="yiv1678020227">
<div>
On 05/14/2012 03:48 PM, Robinson Tiemuqinke wrote:
<blockquote type="cite">
<div style="color: rgb(0, 0, 0); background-color: rgb(255, 255, 255); font-size: 12pt; font-family: 'times new roman', 'new york', times, serif; ">
<div>Hi Dmitri, Rich and all,</div>
<div><br>
</div>
<div> I am a newbie to Redhat IPA, It looks like pretty cool
compared with other solutions I've tried before. Thanks a lot
for this great product! :)</div>
<div><br>
</div>
<div> But there are still some things I needs your help. My main
question is: How to restore the IPA setup with a daily
machine-level IPA Replica backup?</div>
<div><br>
</div>
<div> Please let me explain my IPA setup background and
backup/restore goals trying to reach:</div>
<div><br>
</div>
<div> I'm running IPA 2.1.3 on Redhat Enterprise 6.2. The IPA
master is setup with Dogtag CA system. It is installed first.
Then two IPA replicas are installed -- with '--setup-ca'
options -- for load balancing and failover purposes.</div>
<div><br>
</div>
<div> To describe my problems/objectives, I'll name the IPA
Master as machine A, IPA replicas as B and C. and now I've one
more extra IPA replica 'D' (virtual machine) setup ONLY for
backup purposes.</div>
<div> </div>
<div> The setup looks like the following, A is the
configuration Hub. B,C,D are siblings.</div>
<div><br>
</div>
<div> A</div>
<div> / | \ </div>
<div> B C D</div>
<div><br>
</div>
<div> The following are the steps I backup IPA setups and LDAP
backends daily -- it is a whole machine-level backup (through
virtual machine D).</div>
<div><br>
</div>
<div>1, First, IPA replica D is backed up daily. The backup
happens like this: </div>
<div><br>
</div>
<div> 1.1 on IP replica D, run 'service IPA stop'. Then run
'shutdown -h <D>'. On the Hypervisor which holds
virtual machine D, do a daily backup of the whole virtual disk
that D is on. </div>
<div> 1.2 turn on the IP replica D again.</div>
<div> 1.3 after virtual machine D is up, on D optionally run a
'ipa-replica-manage --force-sync --from <A>' to sync the
IPA databases forcibly.</div>
<div><br>
</div>
<div>Now comes to restore part, which is pretty confusing to me.
I've tried several times, and every times it comes this or
that kinds of issues and so I am wondering that correct
steps/ineraction of IPA Master/replicas are the king :(</div>
<div><br>
</div>
<div> 2, case #1, A is broken, like disc failure, and then
re-imaged after several days.</div>
<div><br>
</div>
<div> 2.1 How to rebuild the IPA Master/Hub A after A is
re-imaged, with the daily backup from IPA replica D?<br>
</div>
<div> 2.2 do I have to check some files on A into subversion
immediately after A was initially installed?</div>
<div> 2.3 Please describe the steps. I'll follow exactly and
report the results.</div>
<div><br>
</div>
<div>3, case #2, A is working, but either B, or C is broken.</div>
<div><br>
</div>
<div> 3.1 It looks that I don't need the daily backup of D to
kick in, is that right?</div>
<div> 3.2 What are the correct steps on A; and B after it is
re-imaged?</div>
<div> 3.3 Please describe the steps. I'll follow exactly and
report the results.</div>
<div><br>
</div>
<div>4, case #3, If some un-expected IPA changes happens on A
-- like all users are deleted by human mistakes --, and even
worse, all the changes are propagated to B and C in minutes.</div>
<div><br>
</div>
<div> 4.1 How can I recover the IPA setup from daily backup
from D?</div>
<div> 4.2 which IPA master/replicas I should recover first? IPA
master A, or IPA replicas B/C? and then how to recover others
left one by one?</div>
<div> 4.3 Do I have to disconnect replication agreement of
B,C,D from A first? </div>
<div> 4.4 Please describe the steps. I'll follow exactly and
report the results.</div>
<div><br>
</div>
<div> I've heard something about tombstone records too, Not sure
whether the problem still exists in 2.1.3, or 2.2.0(on
6.3Beta)? If so, How can I avoid it with correct recovery
steps/interactions.</div>
<div><br>
</div>
<div>Thanks a lot. </div>
<div><br>
</div>
<div>--Gelen.</div>
</div>
</blockquote>
<br>
I can explain it conceptually. Rob is probably best to define the
exact sequence and commands.<br>
<br>
If you A is broken you reinstall it, make it connect to D and init
(force sync) A from D. Now you have a new A.<br>
<br>
If B or C dies you just re-install B or C and init from A.<br>
<br>
If you lost a lot of data I suggest you start a saved D instance and
force-sync A from it and then force sync B and C from A.<br>
<pre class="yiv1678020227moz-signature">--
Thank you,
Dmitri Pal
Sr. Engineering Manager IPA project,
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
<a rel="nofollow" class="yiv1678020227moz-txt-link-abbreviated" target="_blank" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</div>
</div><br><br> </div> </div> </div></body></html>