<html>
  <head>
    <meta content="text/html; charset=windows-1252"
      http-equiv="Content-Type">
  </head>
  <body bgcolor="#FFFFFF" text="#000000">
    <div class="moz-cite-prefix">On 10/27/2014 10:12 AM, Craig White
      wrote:<br>
    </div>
    <blockquote
cite="mid:5b424b09f0a74ee0822b49ce2e886694@BLUPR08MB488.namprd08.prod.outlook.com"
      type="cite">
      <meta http-equiv="Content-Type" content="text/html;
        charset=windows-1252">
      <meta name="Generator" content="Microsoft Word 14 (filtered
        medium)">
      <style><!--
/* Font Definitions */
@font-face
        {font-family:Calibri;
        panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
        {font-family:Tahoma;
        panose-1:2 11 6 4 3 5 4 4 2 4;}
@font-face
        {font-family:Consolas;
        panose-1:2 11 6 9 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
        {margin:0in;
        margin-bottom:.0001pt;
        font-size:11.0pt;
        font-family:"Calibri","sans-serif";
        color:black;}
a:link, span.MsoHyperlink
        {mso-style-priority:99;
        color:blue;
        text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
        {mso-style-priority:99;
        color:purple;
        text-decoration:underline;}
pre
        {mso-style-priority:99;
        mso-style-link:"HTML Preformatted Char";
        margin:0in;
        margin-bottom:.0001pt;
        font-size:10.0pt;
        font-family:"Courier New";
        color:black;}
p.MsoAcetate, li.MsoAcetate, div.MsoAcetate
        {mso-style-priority:99;
        mso-style-link:"Balloon Text Char";
        margin:0in;
        margin-bottom:.0001pt;
        font-size:8.0pt;
        font-family:"Tahoma","sans-serif";
        color:black;}
p.MsoListParagraph, li.MsoListParagraph, div.MsoListParagraph
        {mso-style-priority:34;
        margin-top:0in;
        margin-right:0in;
        margin-bottom:0in;
        margin-left:.5in;
        margin-bottom:.0001pt;
        font-size:11.0pt;
        font-family:"Calibri","sans-serif";
        color:black;}
span.BalloonTextChar
        {mso-style-name:"Balloon Text Char";
        mso-style-priority:99;
        mso-style-link:"Balloon Text";
        font-family:"Tahoma","sans-serif";}
span.EmailStyle19
        {mso-style-type:personal;
        font-family:"Calibri","sans-serif";
        color:windowtext;}
span.EmailStyle20
        {mso-style-type:personal;
        font-family:"Calibri","sans-serif";
        color:#1F497D;}
span.HTMLPreformattedChar
        {mso-style-name:"HTML Preformatted Char";
        mso-style-priority:99;
        mso-style-link:"HTML Preformatted";
        font-family:"Consolas","serif";
        color:black;}
span.EmailStyle23
        {mso-style-type:personal-reply;
        font-family:"Calibri","sans-serif";
        color:#1F497D;}
.MsoChpDefault
        {mso-style-type:export-only;
        font-size:10.0pt;}
@page WordSection1
        {size:8.5in 11.0in;
        margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
        {page:WordSection1;}
/* List Definitions */
@list l0
        {mso-list-id:186678137;
        mso-list-type:hybrid;
        mso-list-template-ids:1724948766 67698705 67698713 67698715 67698703 67698713 67698715 67698703 67698713 67698715;}
@list l0:level1
        {mso-level-text:"%1\)";
        mso-level-tab-stop:none;
        mso-level-number-position:left;
        text-indent:-.25in;}
@list l0:level2
        {mso-level-number-format:alpha-lower;
        mso-level-tab-stop:none;
        mso-level-number-position:left;
        text-indent:-.25in;}
@list l0:level3
        {mso-level-number-format:roman-lower;
        mso-level-tab-stop:none;
        mso-level-number-position:right;
        text-indent:-9.0pt;}
@list l0:level4
        {mso-level-tab-stop:none;
        mso-level-number-position:left;
        text-indent:-.25in;}
@list l0:level5
        {mso-level-number-format:alpha-lower;
        mso-level-tab-stop:none;
        mso-level-number-position:left;
        text-indent:-.25in;}
@list l0:level6
        {mso-level-number-format:roman-lower;
        mso-level-tab-stop:none;
        mso-level-number-position:right;
        text-indent:-9.0pt;}
@list l0:level7
        {mso-level-tab-stop:none;
        mso-level-number-position:left;
        text-indent:-.25in;}
@list l0:level8
        {mso-level-number-format:alpha-lower;
        mso-level-tab-stop:none;
        mso-level-number-position:left;
        text-indent:-.25in;}
@list l0:level9
        {mso-level-number-format:roman-lower;
        mso-level-tab-stop:none;
        mso-level-number-position:right;
        text-indent:-9.0pt;}
ol
        {margin-bottom:0in;}
ul
        {margin-bottom:0in;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
      <div class="WordSection1">
        <p class="MsoNormal"><b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext">From:</span></b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif";color:windowtext">
            <a class="moz-txt-link-abbreviated" href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a>
            [<a class="moz-txt-link-freetext" href="mailto:freeipa-users-bounces@redhat.com">mailto:freeipa-users-bounces@redhat.com</a>]
            <b>On Behalf Of </b>Rich Megginson<br>
            <b>Sent:</b> Monday, October 27, 2014 6:42 AM<br>
            <b>To:</b> <a class="moz-txt-link-abbreviated" href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><br>
            <b>Subject:</b> Re: [Freeipa-users] multi-master replication<o:p></o:p></span></p>
        <p class="MsoNormal"><o:p> </o:p></p>
        <div>
          <p class="MsoNormal">On 10/25/2014 06:17 PM, Dmitri Pal wrote:<o:p></o:p></p>
        </div>
        <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
          <div>
            <p class="MsoNormal">On 10/24/2014 07:15 PM, Craig White
              wrote:<o:p></o:p></p>
          </div>
          <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt">
            <p class="MsoNormal"><b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">From:</span></b><span
style="font-size:10.0pt;font-family:"Tahoma","sans-serif"">
                <a moz-do-not-send="true"
                  href="mailto:freeipa-users-bounces@redhat.com">freeipa-users-bounces@redhat.com</a>
                [<a moz-do-not-send="true"
                  href="mailto:freeipa-users-bounces@redhat.com">mailto:freeipa-users-bounces@redhat.com</a>]
                <b>On Behalf Of </b>Craig White<br>
                <b>Sent:</b> Friday, October 24, 2014 4:02 PM<br>
                <b>To:</b> <a moz-do-not-send="true"
                  href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><br>
                <b>Subject:</b> [Freeipa-users] multi-master replication</span><o:p></o:p></p>
            <p class="MsoNormal"> <o:p></o:p></p>
            <p class="MsoNormal">I would have thought that changes go
              from replica to master and not just master to replica.<o:p></o:p></p>
            <p class="MsoNormal"> <o:p></o:p></p>
            <p class="MsoNormal">Is there something I have to do to make
              the changes bi-directional?<o:p></o:p></p>
            <div style="border:none;border-bottom:solid windowtext
              1.0pt;padding:0in 0in 1.0pt 0in">
              <p class="MsoNormal"> <o:p></o:p></p>
            </div>
            <p class="MsoNormal"><span style="font-size:9.0pt">Replying
                to my own post…</span><o:p></o:p></p>
            <p class="MsoNormal"><span style="color:#1F497D">Logs are my
                friend  ;-)</span><o:p></o:p></p>
            <p class="MsoNormal"><span style="color:#1F497D"> </span><o:p></o:p></p>
            <p class="MsoNormal"><span style="color:#1F497D">[24/Oct/2014:23:08:17
                +0000] NSMMReplicationPlugin -
                agmt="cn=meToipa001.domain.local " (ipa001:389):
                Replication bind with GSSAPI auth resumed</span><o:p></o:p></p>
            <p class="MsoNormal"><span style="color:#1F497D">[24/Oct/2014:23:08:17
                +0000] NSMMReplicationPlugin -
                agmt="cn=meToipa001.domain.local " (ipa001:389):
                Warning: unable to replicate schema: rc=2</span><o:p></o:p></p>
            <p class="MsoNormal"><span style="color:#1F497D">[24/Oct/2014:23:08:17
                +0000] NSMMReplicationPlugin -
                agmt="cn=meToipa001.domain.local " (ipa001:389): Failed
                to send update operation to consumer (uniqueid
                e018060f-5bb011e4-81078979-dc802980, CSN
                544aa346000000030000): Can't contact LDAP server. Will
                retry later.</span><o:p></o:p></p>
            <p class="MsoNormal"><span style="color:#1F497D">[24/Oct/2014:23:08:17
                +0000] NSMMReplicationPlugin -
                agmt="cn=meToipa001.domain.local " (ipa001:389):
                Consumer failed to replay change (uniqueid (null), CSN
                (null)): Can't contact LDAP server(-1). Will retry
                later.</span><o:p></o:p></p>
          </blockquote>
          <p class="MsoNormal"><span
              style="font-size:12.0pt;font-family:"Times New
              Roman","serif""><br>
              These NULLs look suspicious.<br>
              I hope DS gurus will have more for you on Monday.<o:p></o:p></span></p>
        </blockquote>
        <p class="MsoNormal"><span
            style="font-size:12.0pt;font-family:"Times New
            Roman","serif""><br>
            1) Yes, replication is fully bi-directional.<br>
            2) What are the exact versions of dirsrv?  rpm -q
            389-ds-base on supplier and consumer.<br>
            3) Can you reproduce the problem using the replication log
            level on both the supplier and consumer? 
            <a moz-do-not-send="true"
              href="http://www.port389.org/docs/389ds/FAQ/faq.html#troubleshooting">http://www.port389.org/docs/389ds/FAQ/faq.html#troubleshooting</a><br>
          </span><span style="font-size:12.0pt;font-family:"Times
            New Roman","serif";color:#1F497D">----</span><span
            style="font-size:12.0pt;font-family:"Times New
            Roman","serif""><o:p></o:p></span></p>
        <p class="MsoListParagraph"
          style="text-indent:-.25in;mso-list:l0 level1 lfo1"><!--[if !supportLists]--><span
            style="color:#1F497D"><span style="mso-list:Ignore">1)<span
                style="font:7.0pt "Times New Roman"">     
              </span></span></span><!--[endif]--><span
            style="color:#1F497D">I sort of expected it to be – that’s
            what had me worried when it didn’t work as expected.<o:p></o:p></span></p>
        <p class="MsoListParagraph"
          style="text-indent:-.25in;mso-list:l0 level1 lfo1"><!--[if !supportLists]--><span
            style="color:#1F497D"><span style="mso-list:Ignore">2)<span
                style="font:7.0pt "Times New Roman"">     
              </span></span></span><!--[endif]--><span
            style="color:#1F497D">]# rpm -qa | grep 389<o:p></o:p></span></p>
        <p class="MsoListParagraph"><span style="color:#1F497D">389-ds-base-1.2.11.15-47.el6.x86_64<o:p></o:p></span></p>
        <p class="MsoListParagraph"><span style="color:#1F497D">389-ds-base-libs-1.2.11.15-47.el6.x86_64<o:p></o:p></span></p>
        <p class="MsoListParagraph"
          style="text-indent:-.25in;mso-list:l0 level1 lfo1"><!--[if !supportLists]--><span
            style="color:#1F497D"><span style="mso-list:Ignore">3)<span
                style="font:7.0pt "Times New Roman"">     
              </span></span></span><!--[endif]--><span
            style="color:#1F497D">Upped the log levels – hopefully this
            is a reasonable representative from ipa002 (the replica)<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - conn=4 op=229791
            repl="dc=stt,dc=local": Acquired replica<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - conn=4 op=229791
            repl="dc=stt,dc=local": StartNSDS90ReplicationRequest:
            response=0 rc=0<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - conn=4 op=229791
            Relinquishing consumer connection extension<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - ruv_add_csn_inprogress:
            successfully inserted csn 544e6b02000000040000 into pending
            list<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - Purged state information from
            entry
            krbprincipalname=ldap/ipa002.FQDN@FQDN,cn=services,cn=accounts,dc=stt,dc=local
            up to CSN 5445307e000000040000<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - changelog program -
            _cl5GetDBFileByReplicaName: found DB object f32b80 for
            database
/var/lib/dirsrv/slapd-STT-LOCAL/cldb/dababc08-5bb011e4-81078979-dc802980_544aa332000000040000.db4<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - changelog program -
            _cl5GetDBFileByReplicaName: found DB object f32b80 for
            database
/var/lib/dirsrv/slapd-STT-LOCAL/cldb/dababc08-5bb011e4-81078979-dc802980_544aa332000000040000.db4<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - ruv_update_ruv: successfully
            committed csn 544e6b02000000040000<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): Disconnected from the consumer<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): Warning: unable to replicate schema: rc=2<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] - csngen_adjust_time: gen state before
            544e6b040001:1414425347:0:1<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - changelog program -
            _cl5GetDBFile: found DB object f32b80 for database
/var/lib/dirsrv/slapd-STT-LOCAL/cldb/dababc08-5bb011e4-81078979-dc802980_544aa332000000040000.db4<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] - _cl5PositionCursorForReplay
            (agmt="cn=meToipa001.FQDN" (ipa001:389)): Consumer RUV:<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): {replicageneration} 544aa332000000040000<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): {replica 4 <a class="moz-txt-link-freetext" href="ldap://ipa001.FQDN:389">ldap://ipa001.FQDN:389</a>}
            544aa3a1000000040000 544e6b02000000040000 00000000<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): {replica 3 <a class="moz-txt-link-freetext" href="ldap://ipa002.FQDN:389">ldap://ipa002.FQDN:389</a>}
            544aa339000000030000 544aa33f000400030000 00000000<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] - _cl5PositionCursorForReplay
            (agmt="cn=meToipa001.FQDN" (ipa001:389)): Supplier RUV:<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): {replicageneration} 544aa332000000040000<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): {replica 3 <a class="moz-txt-link-freetext" href="ldap://ipa002.FQDN:389">ldap://ipa002.FQDN:389</a>}
            544aa339000000030000 544e6aa4000300030000 544e6aa3<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): {replica 4 <a class="moz-txt-link-freetext" href="ldap://ipa001.FQDN:389">ldap://ipa001.FQDN:389</a>}
            544aa3a1000000040000 544e6b02000000040000 544e6b03<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] agmt="cn=meToipa001.FQDN" (ipa001:389) -
            clcache_get_buffer: found thread private buffer cache
            7fe85000ea50<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] agmt="cn=meToipa001.FQDN" (ipa001:389) -
            clcache_get_buffer: _pool is f89af0 _pool->pl_busy_lists
            is 7fe8500197d0 _pool->pl_busy_lists->bl_buffers is
            7fe85000ea50<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] agmt="cn=meToipa001.FQDN" (ipa001:389) - session
            start: anchorcsn=544aa33f000400030000<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - changelog program -
            agmt="cn=meToipa001.FQDN" (ipa001:389): CSN
            544aa33f000400030000 found, position set for replay<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] agmt="cn=meToipa001.FQDN" (ipa001:389) - load=1 rec=1
            csn=544aa346000000030000<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): replay_update: Sending add operation
            (dn="cn=KDC,cn=ipa002.FQDN,cn=masters,cn=ipa,cn=etc,dc=stt,dc=local"
            csn=544aa346000000030000)<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): replay_update: Consumer could not replay
            operation with csn 544aa346000000030000<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): Failed to send update operation to consumer
            (uniqueid e018060f-5bb011e4-81078979-dc802980, CSN
            544aa346000000030000): Can't contact LDAP server. Will retry
            later.<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] - repl5_inc_result_threadmain starting<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): Connection disconnected by another thread<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] - repl5_inc_result_threadmain: read result for
            message_id 0<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] - repl5_inc_result_threadmain: result 3, -1, 2, 0,
            (null)<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): Consumer failed to replay change (uniqueid
            (null), CSN (null)): Can't contact LDAP server(-1). Will
            retry later.<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] - repl5_inc_result_threadmain: got op result 205
            should finish 1<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] - repl5_inc_result_threadmain exiting<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] agmt="cn=meToipa001.FQDN" (ipa001:389) - session end:
            state=0 load=1 sent=1 skipped=0 skipped_new_rid=0
            skipped_csn_gt_cons_maxcsn=0 skipped_up_to_date=0
            skipped_csn_gt_ruv=0 skipped_csn_covered=0<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): Warning: unable to send endReplication
            extended operation (Can't contact LDAP server)<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): State: sending_updates -> start_backoff<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:47
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): State: start_backoff -> start_backoff<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:49
            +0000] NSMMReplicationPlugin - conn=4 op=229793 Acquired
            consumer connection extension<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:49
            +0000] NSMMReplicationPlugin - conn=4 op=229793
            repl="dc=stt,dc=local": Released replica held by
            locking_purl=conn=4 id=229791<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:49
            +0000] NSMMReplicationPlugin - conn=4 op=229793
            Relinquishing consumer connection extension<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:51
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): State: start_backoff -> backoff<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:51
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): Trying non-secure slapi_ldap_init_ext<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:51
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): binddn = ,  passwd =<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:51
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): Replication bind with GSSAPI auth resumed<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:51
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): No linger to cancel on the connection<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:51
            +0000] - _csngen_adjust_local_time: gen state before
            544e6b040001:1414425347:0:1<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:51
            +0000] - _csngen_adjust_local_time: gen state after
            544e6b080000:1414425351:0:1<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:51
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): Replica was successfully acquired.<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:51
            +0000] NSMMReplicationPlugin - agmt="cn=meToipa001.FQDN"
            (ipa001:389): State: backoff -> sending_updates<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:51
            +0000] NSMMReplicationPlugin - conn=4 op=229794 Acquired
            consumer connection extension<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:51
            +0000] NSMMReplicationPlugin - conn=4 op=229794
            repl="dc=stt,dc=local": Begin incremental protocol<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:51
            +0000] - csngen_adjust_time: gen state before
            544e6b080001:1414425351:0:1<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">[27/Oct/2014:15:55:51
            +0000] - csngen_adjust_time: gen state after
            544e6b080001:1414425351:0:1<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
        <p class="MsoNormal"><span
            style="font-size:12.0pt;font-family:"Times New
            Roman","serif";color:#1F497D">This is the log
            from ipa002 (which was the replica) and I am confused by the
            error logged, ‘Can’t contact LDAP server’ because it surely
            can…<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">]# telnet
            172.29.31.100 389<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">Trying
            172.29.31.100...<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">Connected to
            172.29.31.100.<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">Escape
            character is '^]'.<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">^]<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">telnet> quit<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">Connection
            closed.</span></p>
      </div>
    </blockquote>
    <br>
    Replication uses Kerberos/GSSAPI and also possibly startTLS (I can't
    remember if ipa uses startTLS for an additional layer of encryption,
    or just uses Kerberos/GSSAPI for encryption).  These might also
    cause the directory server to report connection failures even if the
    tcp layer connections are working.<br>
    <br>
    Can you provided excerpts from the 172.29.31.100 directory server
    access logs from around the time of the connection failures reported
    above?<br>
    <br>
    <blockquote
cite="mid:5b424b09f0a74ee0822b49ce2e886694@BLUPR08MB488.namprd08.prod.outlook.com"
      type="cite">
      <div class="WordSection1">
        <p class="MsoNormal"><span style="color:#1F497D"><o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">This is a new
            setup (setup master on Thursday, imported users from
            OpenLDAP and then setup replica on Friday). Had a few issues
            that I didn’t understand which may or may not be relevant.
            First, after I made some changes to SSSD to allow for sudo
            and hopefully HBAC, it seemed like the directory server
            crashed and I had to restart it.</span></p>
      </div>
    </blockquote>
    <br>
    Crashed?  If you can reproduce this problem, see
    <a class="moz-txt-link-freetext" href="http://www.port389.org/docs/389ds/FAQ/faq.html#debugging-crashes">http://www.port389.org/docs/389ds/FAQ/faq.html#debugging-crashes</a><br>
    If there is a crash, we need to see the stack trace.<br>
    <br>
    <blockquote
cite="mid:5b424b09f0a74ee0822b49ce2e886694@BLUPR08MB488.namprd08.prod.outlook.com"
      type="cite">
      <div class="WordSection1">
        <p class="MsoNormal"><span style="color:#1F497D">Seemed like the
            same thing happened at the same time when I likewise
            configured the replica.</span></p>
      </div>
    </blockquote>
    <br>
    Again, see above.<br>
    <br>
    <blockquote
cite="mid:5b424b09f0a74ee0822b49ce2e886694@BLUPR08MB488.namprd08.prod.outlook.com"
      type="cite">
      <div class="WordSection1">
        <p class="MsoNormal"><span style="color:#1F497D">Also, when I
            was trying to setup the replica, I had to resort to
            –skip-conncheck as it (presume Kerberos) not only asked for
            the password for admin@$DOMAIN but also the password for
            <a moz-do-not-send="true" href="mailto:admin@ipa001.$DOMAIN">admin@ipa001.$DOMAIN</a>
            for which I had never specifically setup any password and no
            password already used in Kerberos worked.</span></p>
      </div>
    </blockquote>
    <br>
    Hmm - maybe one of the ipa guys knows what the problem is here.<br>
    <br>
    <blockquote
cite="mid:5b424b09f0a74ee0822b49ce2e886694@BLUPR08MB488.namprd08.prod.outlook.com"
      type="cite">
      <div class="WordSection1">
        <p class="MsoNormal"><span style="color:#1F497D"><o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">Thanks<o:p></o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D"><o:p> </o:p></span></p>
        <p class="MsoNormal"><span style="color:#1F497D">Craig<o:p></o:p></span></p>
      </div>
    </blockquote>
    <br>
  </body>
</html>