<html><body><div style="color:#000; background-color:#fff; font-family:times new roman, new york, times, serif;font-size:12pt"><div><span>First of all, i don't see any java process after ipactl stop.</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><span><br></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><span>Then I turned on debug and this is what I get on terminal:</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><span># ipa host-del hnl09.psych.yale.edu<br></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><span>......<br></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><span>ipa: DEBUG: approved_usage = SSLServer intended_usage = SSLServer<br>ipa: DEBUG: cert valid True for "CN=cushing.psych.yale.edu,O=PSYCH.YALE.EDU"<br>ipa: DEBUG: handshake complete, peer = 130.132.167.68:443<br>ipa: DEBUG: Caught fault 4301 from server http://cushing.psych.yale.edu/ipa/xml: Certificate operation cannot be completed: Unable to communicate with CMS (Service Temporarily Unavailable)<br>ipa: DEBUG: Destroyed connection context.xmlclient<br>ipa: ERROR: Certificate operation cannot be completed: Unable to communicate with CMS (Service Temporarily Unavailable)<br></span></div><div><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">So there's a <span>"fault 4301" being caught.</span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">And this is at the end of /var/log/httpd/error_log:<br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">[Tue Sep 04 10:17:05 2012] [error] ipa: DEBUG: approved_usage = SSLServer intended_usage = SSLServer<br>[Tue Sep 04 10:17:05 2012] [error] ipa: DEBUG: cert valid True for "CN=cushing.psych.yale.edu,O=PSYCH.YALE.EDU"<br>[Tue Sep 04 10:17:05 2012] [error] ipa: DEBUG: handshake complete, peer = 130.132.167.68:443<br>[Tue Sep 04 10:17:05 2012] [error] (111)Connection refused: proxy: AJP: attempt to connect to 127.0.0.1:9447 (localhost) failed<br>[Tue Sep 04 10:17:05 2012] [error] ap_proxy_connect_backend disabling worker for (localhost)<br>[Tue Sep 04 10:17:05 2012] [error] proxy: AJP: failed to make connection to backend: localhost<br>[Tue Sep 04 10:17:05 2012] [error] ipa: INFO: admin@PSYCH.YALE.EDU: host_del((u'hnl09.psych.yale.edu',), updatedns=False): CertificateOperationError<br>[Tue Sep 04 10:17:05 2012] [error] ipa: DEBUG: response: CertificateOperationError: Certificate operation cannot be completed: Unable to communicate with CMS (Service Temporarily Unavailable)<br>[Tue Sep 04 10:17:05 2012] [error] ipa: DEBUG: Destroyed connection context.ldap2<br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><br></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">Thanks,</div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;">George<br><span></span></div><div style="color: rgb(0, 0, 0); font-size: 16px; font-family: times new roman,new york,times,serif; background-color: transparent; font-style: normal;"><span><br></span><blockquote style="border-left: 2px solid rgb(16, 16, 255); margin-left: 5px; margin-top: 5px; padding-left: 5px;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div style="font-family: times new roman, new york, times, serif; font-size: 12pt;"> <div dir="ltr"> <font face="Arial" size="2"> <hr size="1"> <b><span style="font-weight:bold;">From:</span></b> John Dennis <jdennis@redhat.com><br> <b><span style="font-weight: bold;">To:</span></b> george he <george_he7@yahoo.com> <br><b><span style="font-weight: bold;">Cc:</span></b> "freeipa-users@redhat.com" <freeipa-users@redhat.com> <br> <b><span style="font-weight: bold;">Sent:</span></b> Tuesday, September 4, 2012 8:53 AM<br> <b><span style="font-weight: bold;">Subject:</span></b> Re: [Freeipa-users] ipa host-del<br> </font> </div> <br> On 09/04/2012 08:28 AM, george he wrote:<br>> <br>> There's only one conf file in /etc/ipa/, which is default.conf. ca_host<br>> is not defined there. But I think my CA is the IPA server.<br>> <br>> Everything is reported running:<br>> # ipactl status<br>> Directory Service: RUNNING<br>> KDC Service: RUNNING<br>> KPASSWD Service: RUNNING<br>> MEMCACHE Service: RUNNING<br>> HTTP Service: RUNNING<br>> CA Service: RUNNING<br>> <br>> but when I try # ipactl restart, it reports:<br>> Starting httpd: [Tue Sep 04 08:19:10 2012] [warn] worker<br>> ajp://localhost:9447/ already used by another worker<br>> [Tue Sep 04 08:19:10 2012] [warn] worker ajp://localhost:9447/ already<br>> used by another worker<br><br>ajp worker threads are used by tomcat instances of which the CA is one example. It sounds like your CA has gotten into a funny state. I would do a ipactl stop to shut down all your services and then do a ps to look for any Java processes that are still running (I'm assuming the only Java you're running on this box would be for the CA). If you can identify a running Java process that you believe belongs to the CA then kill it and try starting IPA again (or you could use a big hammer and reboot).<br><br>BTW, the ajp threads are the listeners on the CA communication ports, if those treads are not in the right state you could see the CA communication problems you reported.<br><br>If that still does not work then my next suggestion would be to add this line to /etc/ipa/default.conf<br><br>debug=True<br><br>and restart IPA, that will cause verbose logging to be written to /var/log/httpd/error_log which may have more detailed messages indicating where things might be going wrong.<br><br><br>-- John Dennis <<a ymailto="mailto:jdennis@redhat.com" href="mailto:jdennis@redhat.com">jdennis@redhat.com</a>><br><br>Looking to carve out IT costs?<br><a target="_blank" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a><br><br><br> </div> </div> </blockquote></div> </div></body></html>