<div dir="ltr">And just in case this is informative:<div><br></div><div style><font face="courier new, monospace">[root@oldmaster]# pkicontrol start ca PKI-IPA</font></div><div style><font face="courier new, monospace">PKI-IPA is an invalid 'pki-ca' instance</font></div>
<div style><font face="courier new, monospace">[root@oldmaster]#</font></div></div><div class="gmail_extra"><br clear="all"><div><div dir="ltr"><div><br></div><div><u><br></u></div><div><b>Bret Wortman</b></div><div><a href="http://damascusgrp.com/" target="_blank"><img src="http://damascusgrp.com/uploads/3/2/2/6/3226794/6425940.png" width="200" height="52"></a><br>
</div><div><a href="http://bretwortman.com/" target="_blank">http://damascusgrp.com/</a><br></div><div><a href="http://twitter.com/BretWortman" target="_blank">http://twitter.com/BretWortman</a></div></div></div>
<br><br><div class="gmail_quote">On Wed, Feb 20, 2013 at 8:08 AM, Bret Wortman <span dir="ltr"><<a href="mailto:bret.wortman@damascusgrp.com" target="_blank">bret.wortman@damascusgrp.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Digging further into my logs this morning, I've discovered that there's no new entries in /var/log/dirsrv/slapd-PKI-IPA since Feb 5 either. How can I tell why this isn't running? /var/log/dirsrv/slapd-MY-COM is getting updated and logged to, it's just the PKI piece that seems to be dead.<div>
<br></div><div>Nothing in /etc/pki-ca has changed since last year, and the last updates to /var/lib/dirsrv/slapd-PKI-IPA/db or changelogs occurred on Feb 5. I just can't tell what that change was....</div><div><br></div>
<div>Would a key change or certificate change have affected this?</div><div><br></div><div>Worst case, if I do something like this:</div><div><br></div><div># ipa-server-install -U --uninstall<br>
# ipa-server-install</div><div><br></div><div>will I lose the hosts, policies & users I already have configured? Does this stand a chance of getting me back up to where I can clone this box and get healthy again?</div>
</div><div class="gmail_extra"><div class="im"><br clear="all"><div><div dir="ltr"><div><br></div><div><u><br></u></div><div><b>Bret Wortman</b></div><div><a href="http://damascusgrp.com/" target="_blank"><img src="http://damascusgrp.com/uploads/3/2/2/6/3226794/6425940.png" width="200" height="52"></a><br>
</div><div><a href="http://bretwortman.com/" target="_blank">http://damascusgrp.com/</a><br></div><div><a href="http://twitter.com/BretWortman" target="_blank">http://twitter.com/BretWortman</a></div></div></div>
<br><br></div><div><div class="h5"><div class="gmail_quote">On Tue, Feb 19, 2013 at 2:01 PM, Bret Wortman <span dir="ltr"><<a href="mailto:bret.wortman@damascusgrp.com" target="_blank">bret.wortman@damascusgrp.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div><div style="font-family:arial,sans-serif;font-size:13px">No, can't telnet to 7389 or 9444 either one:</div><div style="font-family:arial,sans-serif;font-size:13px"><br></div><font face="courier new, monospace"><span style="font-size:13px">[root@ipamaster]# telnet </span><a href="http://oldmaster.my.com/" style="font-size:13px" target="_blank">oldmaster.my.com</a><span style="font-size:13px"> 7389</span></font><div style="font-size:13px">
<font face="courier new, monospace">Trying 10.0.0.42...</font></div><div style="font-size:13px"><font face="courier new, monospace">telnet: connect to address <a href="http://10.0.0.42/" target="_blank">10.0.0.42</a>: COnnection refused</font></div>
<div style="font-size:13px"><font face="courier new, monospace">[root@ipamaster]#</font></div><div style="font-family:arial,sans-serif;font-size:13px"><br></div></div><div style="font-family:arial,sans-serif;font-size:13px">
I do note that I only have packages called dogtag-*-theme installed:</div>
<div style="font-size:13px"><br><font face="courier new, monospace">[root@oldmaster]# yum list "*dogtag*"</font></div><div style="font-size:13px"><font face="courier new, monospace">Loaded plugins: lnagpacks, presto, refresh-packagekit</font></div>
<div style="font-size:13px"><font face="courier new, monospace">Installed Packages</font></div><div style="font-size:13px"><font face="courier new, monospace">dogtag-pki-ca-theme.noarch 9.0.11-1.fc17 @fedora</font></div>
<div style="font-size:13px"><font face="courier new, monospace">dogtag-pki-common-theme.noarch 9.0.11-1.fc17 @fedora</font></div><div style="font-size:13px"><font face="courier new, monospace">Available Packages</font></div>
<div style="font-size:13px"><font face="courier new, monospace">dogtag-pki.noarch 9.0.0-13.fc17 @fedora</font></div><div style="font-size:13px"><font face="courier new, monospace">:</font></div>
<div style="font-size:13px"><font face="courier new, monospace"><br></font></div><div style="font-size:13px"><font face="arial, helvetica, sans-serif">I also noticed that, according to /var/log/pki-ca/catalina.out and /var/log/pki-ca/debug, this hasn't successfully run since 05-Feb. And no, I'm not sure what happened on that day to change things, but I'm trying to find out. (At least, I assume this logdir relates to dogtag....)</font></div>
<div style="font-size:13px"><font face="courier new, monospace"><br></font></div><div style="margin:2px 0px 0px;font-family:arial,sans-serif;font-size:13px"></div></div><div class="gmail_extra"><div><br clear="all">
<div>
<div dir="ltr"><div><br></div><div><u><br></u></div><div><b>Bret Wortman</b></div><div><a href="http://damascusgrp.com/" target="_blank"><img src="http://damascusgrp.com/uploads/3/2/2/6/3226794/6425940.png" width="200" height="52"></a><br>
</div><div><a href="http://bretwortman.com/" target="_blank">http://damascusgrp.com/</a><br></div><div><a href="http://twitter.com/BretWortman" target="_blank">http://twitter.com/BretWortman</a></div></div></div>
<br><br></div><div><div><div class="gmail_quote">On Tue, Feb 19, 2013 at 1:26 PM, Rob Crittenden <span dir="ltr"><<a href="mailto:rcritten@redhat.com" target="_blank">rcritten@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Natxo Asenjo wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div>
On Tue, Feb 19, 2013 at 5:58 PM, Bret Wortman<br></div><div>
<<a href="mailto:bret.wortman@damascusgrp.com" target="_blank">bret.wortman@damascusgrp.com</a> <mailto:<a href="mailto:bret.wortman@damascusgrp.com" target="_blank">bret.wortman@<u></u>damascusgrp.com</a>>> wrote:<br>
<br>
Digging a bit deeper, I found this in /var/log/pki-ca/catalina.out:<br>
<br>
:<br>
Could not connect to LDAP server host <a href="http://oldmaster.my.com" target="_blank">oldmaster.my.com</a><br></div>
<<a href="http://oldmaster.my.com" target="_blank">http://oldmaster.my.com</a>> port 7389 Error<div><br>
netscape.ldap.LDAPException: failed to connect to server<br></div>
ldap://<a href="http://oldmaster.my.com:7389" target="_blank">oldmaster.my.com:7389</a> <<a href="http://oldmaster.my.com:7389" target="_blank">http://oldmaster.my.com:7389</a>> (91)<div><br>
<br>
This certainly appears to be a problem, but everyone's<br>
authenticating against oldmaster just fine. Thoughts, anyone?<br>
<br>
<br>
can you connect to that port (7389) on <a href="http://oldmaster.my.com" target="_blank">oldmaster.my.com</a><br></div>
<<a href="http://oldmaster.my.com" target="_blank">http://oldmaster.my.com</a>> from the other replica? (try telnetting to the<br>
port: telnet <a href="http://oldmaster.my.com" target="_blank">oldmaster.my.com</a> <<a href="http://oldmaster.my.com" target="_blank">http://oldmaster.my.com</a>> 7389)<br>
</blockquote>
<br>
7389 is port in the 389-ds instance used by dogtag. Is the instance running on oldmaster?<br>
<br>
It isn't used for authentication which is why you aren't seeing problems with clients.<br>
<br>
rob<br>
<br>
______________________________<u></u>_________________<br>
Freeipa-users mailing list<br>
<a href="mailto:Freeipa-users@redhat.com" target="_blank">Freeipa-users@redhat.com</a><br>
<a href="https://www.redhat.com/mailman/listinfo/freeipa-users" target="_blank">https://www.redhat.com/<u></u>mailman/listinfo/freeipa-users</a><br>
</blockquote></div><br></div></div></div>
</blockquote></div><br></div></div></div>
</blockquote></div><br></div>