<tt>freeipa-users-bounces@redhat.com schrieb am 28.05.2015 13:23:26: > Von: Alexander Frolushkin <Alexander.Frolushkin@megafon.ru></tt> <tt>> An: "'thierry bordaz'" <tbordaz@redhat.com></tt> <tt>> Kopie: "freeipa-users@redhat.com" <freeipa-users@redhat.com></tt> <tt>> Datum: 28.05.2015 13:24</tt> <tt>> Betreff: Re: [Freeipa-users] Haunted servers?</tt> <tt>> Gesendet von: freeipa-users-bounces@redhat.com</tt> <tt>> > Unfortunately, after a couple of minutes, on two of three servers > error comes back in little changed form: > # ipa-replica-manage list-ruv > unable to decode: {replica 16} > .... > > Before cleanruv it looked like: > # ipa-replica-manage list-ruv > unable to decode: {replica 16} 548a8126000000100000 548a8126000000100000 > .... > > And one server seems to be fixed completely. > > WBR, > Alexander Frolushkin > > </tt> <tt>we had the same problem (and some more) and yesterday we have successfully cleaned the gohst rid's</tt> <tt>our fix:</tt> <tt>1. stop all cleanallruv Tasks, if it works with ipa-replica-manage abort-clean-ruv. It hasnt worked here. We have done it manually on ALL replicas with:</tt> <tt> a) replica stop</tt> <tt> b) delete all nsds5ReplicaClean from /etc/dirsrv/slapd-HSO/dse.ldif</tt> <tt> c) replica start</tt> <tt>2. prepare on EACH ipa a cleanruv ldif file with ALL ghost rids inside (really ALL from all ipa replicas, we has had some rids only on some replicas...)</tt> <tt>Example:</tt> <tt>dn: cn=replica,cn=dc\3Dexample,cn=mapping tree,cn=config</tt> <tt>changetype: modify</tt> <tt>replace: nsds5task</tt> <tt>nsds5task:CLEANRUV11</tt> <tt>dn: cn=replica,cn=dc\3Dexample,cn=mapping tree,cn=config</tt> <tt>changetype: modify</tt> <tt>replace: nsds5task</tt> <tt>nsds5task:CLEANRUV22</tt> <tt>dn: cn=replica,cn=dc\3Dexample,cn=mapping tree,cn=config</tt> <tt>changetype: modify</tt> <tt>replace: nsds5task</tt> <tt>nsds5task:CLEANRUV37</tt> <tt>...</tt> <tt>3. do a "ldapmodify -h 127.0.0.1 -D "cn=Directory Manager" -W -x -f $your-cleanruv-file.ldif" on all replicas AT THE SAME TIME :) we used terminator for it (</tt><a href=https://launchpad.net/terminator><tt>https://launchpad.net/terminator</tt></a><tt>). You can open multiple shell windows inside one window and send to all at the same time the same commands...</tt> <tt>4. we have done a re-initialize of each IPA from our first master</tt> <tt>5. restart of all replicas</tt> <tt>we are not sure about the point 3 and 4. Maybe they are not necessary, but we have done it.</tt> <tt>If something fails look at defect LDAP entries in whole ldap, we have had some entries with 'nsunique-$HASH' after the 'normal' name. We have deleted them.</tt> <tt> </tt>MfG Christoph Kaminski