<html> <head> <meta content="text/html; charset=ISO-8859-1" http-equiv="Content-Type"> </head> <body bgcolor="#FFFFFF" text="#000000"> Hi, I have one scenario where I can show the comeback of the "ghost" rids. but it requires a server where the rids have successfully cleaned and it is killed or crashes. In that case, if the "ghost" rids have not yet been trimmed from the changelog they can be recreated from information in the changelog. they can then also propagate to other servers Could something similar have happened in your environment ? Ludwig <div class="moz-cite-prefix">On 06/12/2015 07:38 AM, Christoph Kaminski wrote: </div> <blockquote cite="mid:OF6E96761C.C618729D-ONC1257E62.001EAAAF-C1257E62.001EF495@biotronik.com" type="cite"><tt>I've been too early pleased :/ After ipactl restart of our first master (where we re-initialize from) are the 'ghost' rids again there...</tt> <tt>I think there is something like a fs backup for dirsrv (changelog?) but where? </tt> <tt>> > we had the same problem (and some more) and yesterday we have > successfully cleaned the gohst rid's</tt> <tt>> > our fix:</tt> <tt>> > 1. stop all cleanallruv Tasks, if it works with ipa-replica-manage > abort-clean-ruv. It hasnt worked here. We have done it manually on > ALL replicas with:</tt> <tt>> a) replica stop</tt> <tt>> b) delete all nsds5ReplicaClean from /etc/dirsrv/slapd-HSO/dse.ldif</tt> <tt>> c) replica start</tt> <tt>> > 2. prepare on EACH ipa a cleanruv ldif file with ALL ghost rids > inside (really ALL from all ipa replicas, we has had some rids only > on some replicas...)</tt> <tt>> Example:</tt> <tt>> > dn: cn=replica,cn=dc\3Dexample,cn=mapping tree,cn=config</tt> <tt>> changetype: modify</tt> <tt>> replace: nsds5task</tt> <tt>> nsds5task:CLEANRUV11</tt> <tt>> > dn: cn=replica,cn=dc\3Dexample,cn=mapping tree,cn=config</tt> <tt>> changetype: modify</tt> <tt>> replace: nsds5task</tt> <tt>> nsds5task:CLEANRUV22</tt> <tt>> > dn: cn=replica,cn=dc\3Dexample,cn=mapping tree,cn=config</tt> <tt>> changetype: modify</tt> <tt>> replace: nsds5task</tt> <tt>> nsds5task:CLEANRUV37</tt> <tt>> ...</tt> <tt>> > 3. do a "ldapmodify -h 127.0.0.1 -D "cn=Directory Manager" -W -x -f > $your-cleanruv-file.ldif" on all replicas AT THE SAME TIME :) we > used terminator for it (</tt><a moz-do-not-send="true" href="https://launchpad.net/terminator"><tt>https://launchpad.net/terminator</tt></a><tt>). You can > open multiple shell windows inside one window and send to all at the > same time the same commands...</tt> <tt>> > 4. we have done a re-initialize of each IPA from our first master</tt> <tt>> > 5. restart of all replicas</tt> <tt>> > we are not sure about the point 3 and 4. Maybe they are not > necessary, but we have done it.</tt> <tt>> > If something fails look at defect LDAP entries in whole ldap, we > have had some entries with 'nsunique-$HASH' after the 'normal' name. > We have deleted them.</tt> <tt>> > MfG > Christoph Kaminski > > </tt> <fieldset class="mimeAttachmentHeader"></fieldset> </blockquote> </body> </html>