<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8"> <meta name="Generator" content="Microsoft Word 14 (filtered medium)"> <style></style> </head> <body bgcolor="white" lang="EN-CA" link="blue" vlink="purple"> <div class="WordSection1"> No changes to /var/log/dirsrv/slapd-IPA-CANDEAL-CA/errors. I am tailing the log file and running those commands doesn’t generate any log, nothing.<o:p></o:p> <div> <o:p> </o:p> [root@cd-p-ipa1 log]# ipactl start<o:p></o:p> Starting Directory Service<o:p></o:p> Job for dirsrv@IPA-CANDEAL-CA.service failed because the control process exited with error code. See "systemctl status dirsrv@IPA-CANDEAL-CA.service" and "journalctl -xe" for details.<o:p></o:p> Failed to start Directory Service: Command ''/bin/systemctl' 'start' 'dirsrv@IPA-CANDEAL-CA.service'' returned non-zero exit status 1<o:p></o:p> <o:p> </o:p> Logs from /var/log/messages<o:p></o:p> <o:p> </o:p> Apr 27 10:26:05 cd-p-ipa1 systemd: Starting 389 Directory Server IPA-CANDEAL-CA....<o:p></o:p> Apr 27 10:26:05 cd-p-ipa1 ns-slapd: [27/Apr/2016:10:26:05 -0400] dse - The configuration file /etc/dirsrv/slapd-IPA-CANDEAL-CA/dse.ldif was not restored from backup /etc/dirsrv/slapd-IPA-CANDEAL-CA/dse.ldif.tmp, error -1<o:p></o:p> Apr 27 10:26:05 cd-p-ipa1 ns-slapd: [27/Apr/2016:10:26:05 -0400] dse - The configuration file /etc/dirsrv/slapd-IPA-CANDEAL-CA/dse.ldif was not restored from backup /etc/dirsrv/slapd-IPA-CANDEAL-CA/dse.ldif.bak, error -1<o:p></o:p> Apr 27 10:26:05 cd-p-ipa1 ns-slapd: [27/Apr/2016:10:26:05 -0400] config - The given config file /etc/dirsrv/slapd-IPA-CANDEAL-CA/dse.ldif could not be accessed, Netscape Portable Runtime error -5950 (File not found.)<o:p></o:p> <o:p> </o:p> [root@cd-p-ipa1 log]# systemctl start dirsrv@IPA-CANDEAL-CA.service<o:p></o:p> Job for dirsrv@IPA-CANDEAL-CA.service failed because the control process exited with error code. See "systemctl status dirsrv@IPA-CANDEAL-CA.service" and "journalctl -xe" for details.<o:p></o:p> <o:p> </o:p> [root@cd-p-ipa1 log]# systemctl status dirsrv@IPA-CANDEAL-CA.service -l<o:p></o:p> ● dirsrv@IPA-CANDEAL-CA.service - 389 Directory Server IPA-CANDEAL-CA.<o:p></o:p> Loaded: loaded (/usr/lib/systemd/system/dirsrv@.service; enabled; vendor preset: disabled)<o:p></o:p> Active: failed (Result: exit-code) since Wed 2016-04-27 10:26:17 EDT; 3s ago<o:p></o:p> Process: 9830 ExecStart=/usr/sbin/ns-slapd -D /etc/dirsrv/slapd-%i -i /var/run/dirsrv/slapd-%i.pid -w /var/run/dirsrv/slapd-%i.startpid (code=exited, status=1/FAILURE)<o:p></o:p> <o:p> </o:p> Apr 27 10:26:17 cd-p-ipa1.ipa.candeal.ca ns-slapd[9830]: [27/Apr/2016:10:26:17 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes<o:p></o:p> Apr 27 10:26:17 cd-p-ipa1.ipa.candeal.ca ns-slapd[9830]: [27/Apr/2016:10:26:17 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes<o:p></o:p> Apr 27 10:26:17 cd-p-ipa1.ipa.candeal.ca ns-slapd[9830]: [27/Apr/2016:10:26:17 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes<o:p></o:p> Apr 27 10:26:17 cd-p-ipa1.ipa.candeal.ca ns-slapd[9830]: [27/Apr/2016:10:26:17 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes<o:p></o:p> Apr 27 10:26:17 cd-p-ipa1.ipa.candeal.ca ns-slapd[9830]: [27/Apr/2016:10:26:17 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes<o:p></o:p> Apr 27 10:26:17 cd-p-ipa1.ipa.candeal.ca ns-slapd[9830]: [27/Apr/2016:10:26:17 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes<o:p></o:p> Apr 27 10:26:17 cd-p-ipa1.ipa.candeal.ca ns-slapd[9830]: [27/Apr/2016:10:26:17 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes<o:p></o:p> Apr 27 10:26:17 cd-p-ipa1.ipa.candeal.ca ns-slapd[9830]: [27/Apr/2016:10:26:17 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes<o:p></o:p> Apr 27 10:26:17 cd-p-ipa1.ipa.candeal.ca ns-slapd[9830]: [27/Apr/2016:10:26:17 -0400] dse_read_one_file - The entry cn=schema in file /etc/dirsrv/slapd-IPA-CANDEAL-CA/schema/00core.ldif (lineno: 1) is invalid, error code 21 (Invalid syntax) - attribute type aci: Unknown attribute syntax OID "1.3.6.1.4.1.1466.115.121.1.15"<o:p></o:p> Apr 27 10:26:17 cd-p-ipa1.ipa.candeal.ca ns-slapd[9830]: [27/Apr/2016:10:26:17 -0400] dse - Please edit the file to correct the reported problems and then restart the server.<o:p></o:p> [root@cd-p-ipa1 log]# <o:p></o:p> <o:p> </o:p> Gady<o:p></o:p> </div> <o:p> </o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"> From: Ludwig Krispenz [mailto:lkrispen@redhat.com] Sent: April 27, 2016 10:06 AM To: Gady Notrica Cc: Rob Crittenden; freeipa-users@redhat.com Subject: Re: [Freeipa-users] krb5kdc service not starting<o:p></o:p> </div> </div> <o:p> </o:p> <o:p> </o:p> <div> On 04/27/2016 03:48 PM, Gady Notrica wrote:<o:p></o:p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> Hello Ludwig,<o:p></o:p> <o:p></o:p> I do have only 1 error logs for the 26th in /var/log/dirsrv/slapd-IPA-CANDEAL-CA/errors. Below is the only line I have<o:p></o:p> <o:p></o:p> [25/Apr/2016:22:34:51 -0400] NSMMReplicationPlugin - windows sync - failed to send dirsync search request: 2<o:p></o:p> [26/Apr/2016:00:13:01 -0400] - Entry "uid=MMOOREDT$,cn=users,cn=accounts,dc=ipa,dc=candeal,dc=ca" missing attribute "sn" required by object class "person"<o:p></o:p> <o:p></o:p> <img width="901" height="31" id="Picture_x0020_3" src="cid:image001.jpg@01D1A06F.6FD59F60"><o:p></o:p> <o:p></o:p> I don’t know if that helps.<o:p></o:p> </blockquote> no. And it is weird that there should be no logs, there were definitely messages logged around 8:50, you provided them via systemctl status dirsrv... And at least the startup messages should b there Can you try to start dirsrv again. and check what config settings for errorlog are in your dse.ldif <o:p></o:p> <o:p></o:p> <div> Gady<o:p></o:p> </div> <o:p></o:p> <div> <div style="border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0cm 0cm 0cm"> From: Ludwig Krispenz [<a href="mailto:lkrispen@redhat.com">mailto:lkrispen@redhat.com</a>] Sent: April 27, 2016 3:18 AM To: Gady Notrica Cc: Rob Crittenden; <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> Subject: Re: [Freeipa-users] krb5kdc service not starting<o:p></o:p> </div> </div> <o:p></o:p> <o:p></o:p> <div> On 04/26/2016 09:09 PM, Gady Notrica wrote:<o:p></o:p> </div> <blockquote style="margin-top:5.0pt;margin-bottom:5.0pt"> HERE..<o:p></o:p> <o:p></o:p> [23/Apr/2016:11:39:51 -0400] set_krb5_creds - Could not get initial credentials for principal [<a href="mailto:ldap/cd-p-ipa1.ipa.domain.local@IPA.DOMAIN.LOCAL">ldap/cd-p-ipa1.ipa.domain.local@IPA.DOMAIN.LOCAL</a>] in keytab [<a href="FILE:///\\%5C%5Cetc%5Cdirsrv%5Cds.keytab">FILE:/etc/dirsrv/ds.keytab</a>]: -1765328228 (Cannot contact any KDC for requested realm)<o:p></o:p> [23/Apr/2016:11:39:51 -0400] slapd_ldap_sasl_interactive_bind - Error: could not perform interactive bind for id [] mech [GSSAPI]: LDAP error -2 (Local error) (SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No Kerberos credentials available)) errno 0 (Success)<o:p></o:p> [23/Apr/2016:11:39:51 -0400] slapi_ldap_bind - Error: could not perform interactive bind for id [] authentication mechanism [GSSAPI]: error -2 (Local error)<o:p></o:p> [23/Apr/2016:11:39:51 -0400] NSMMReplicationPlugin - agmt="cn=meTocd-s-ipa1.ipa.domain.local" (cd-s-ipa1:389): Replication bind with GSSAPI auth failed: LDAP error -2 (Local error) (SASL(-1): generic failure: GSSAPI Error: Unspecified GSS failure. Minor code may provide more information (No Kerberos credentials available))<o:p></o:p> [23/Apr/2016:11:39:51 -0400] - slapd started. Listening on All Interfaces port 389 for LDAP requests<o:p></o:p> [23/Apr/2016:11:39:51 -0400] - Listening on All Interfaces port 636 for LDAPS requests<o:p></o:p> [23/Apr/2016:11:39:51 -0400] - Listening on /var/run/slapd-IPA-DOMAIN-LOCAL.socket for LDAPI requests<o:p></o:p> [23/Apr/2016:11:39:55 -0400] NSMMReplicationPlugin - agmt="cn=meTocd-s-ipa1.ipa.domain.local" (cd-s-ipa1:389): Replication bind with GSSAPI auth resumed<o:p></o:p> [23/Apr/2016:14:37:27 -0400] NSMMReplicationPlugin - agmt="cn=meTocd-s-ipa1.ipa.domain.local" (cd-s-ipa1:389): Unable to receive the response for a startReplication extended operation to consumer (Can't contact LDAP server). Will retry later.<o:p></o:p> [23/Apr/2016:14:38:02 -0400] slapd_ldap_sasl_interactive_bind - Error: could not perform interactive bind for id [] mech [GSSAPI]: LDAP error -1 (Can't contact LDAP server) ((null)) errno 107 (Transport endpoint is not connected)<o:p></o:p> [23/Apr/2016:14:38:02 -0400] slapi_ldap_bind - Error: could not perform interactive bind for id [] authentication mechanism [GSSAPI]: error -1 (Can't contact LDAP server)<o:p></o:p> [23/Apr/2016:14:38:02 -0400] slapd_ldap_sasl_interactive_bind - Error: could not perform interactive bind for id [] mech [GSSAPI]: LDAP error -1 (Can't contact LDAP server) ((null)) errno 107 (Transport endpoint is not connected)<o:p></o:p> [23/Apr/2016:14:38:02 -0400] slapi_ldap_bind - Error: could not perform interactive bind for id [] authentication mechanism [GSSAPI]: error -1 (Can't contact LDAP server)<o:p></o:p> [23/Apr/2016:14:38:02 -0400] slapd_ldap_sasl_interactive_bind - Error: could not perform interactive bind for id [] mech [GSSAPI]: LDAP error -1 (Can't contact LDAP server) ((null)) errno 107 (Transport endpoint is not connected)<o:p></o:p> [23/Apr/2016:14:38:02 -0400] slapi_ldap_bind - Error: could not perform interactive bind for id [] authentication mechanism [GSSAPI]: error -1 (Can't contact LDAP server)<o:p></o:p> [23/Apr/2016:14:38:13 -0400] NSMMReplicationPlugin - agmt="cn=meTocd-s-ipa1.ipa.domain.local" (cd-s-ipa1:389): Replication bind with GSSAPI auth resumed<o:p></o:p> [25/Apr/2016:22:34:51 -0400] NSMMReplicationPlugin - windows sync - failed to send dirsync search request: 2<o:p></o:p> </blockquote> these are old logs, the problem you were reporting was on Apr, 26: <o:p></o:p> <pre>Apr 26 08:50:21 cd-p-ipa1.ipa.candeal.ca ns-slapd[6333]: [26/Apr/2016:08:50:21 -0400] dse_read_one_file - The entry cn=schema in file /etc/dirsrv/slapd-IPA-CANDEAL-CA/schema/00core.ldif (lineno: 1) is invalid, error code 21 (Invalid syntax) - attribute type aci: Unknown attribute syntax OID "1.3.6.1.4.1.1466.115.121.1.15"<o:p></o:p></pre> <pre>Apr 26 08:50:21 cd-p-ipa1.ipa.candeal.ca ns-slapd[6333]: [26/Apr/2016:08:50:21 -0400] dse - Please edit the file to correct the reported problems and then restart the server.<o:p></o:p></pre> <pre> <o:p></o:p></pre> <pre> <o:p></o:p></pre> <pre>we need the logs from that time<o:p></o:p></pre> <o:p></o:p> <o:p></o:p> Gady<o:p></o:p> <o:p></o:p> -----Original Message----- From: Rob Crittenden [<a href="mailto:rcritten@redhat.com">mailto:rcritten@redhat.com</a>] Sent: April 26, 2016 2:44 PM To: Gady Notrica; Ludwig Krispenz; <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a> Subject: Re: [Freeipa-users] krb5kdc service not starting<o:p></o:p> <o:p></o:p> Gady Notrica wrote:<o:p></o:p> > Hey world,<o:p></o:p> > <o:p></o:p> > Any ideas?<o:p></o:p> <o:p></o:p> What about the first part of Ludwig's question: Is there anything in the 389-ds error log?<o:p></o:p> <o:p></o:p> rob<o:p></o:p> <o:p></o:p> > <o:p></o:p> > Gady<o:p></o:p> > <o:p></o:p> > -----Original Message-----<o:p></o:p> > From: <a href="mailto:freeipa-users-bounces@redhat.com"> freeipa-users-bounces@redhat.com</a> <o:p></o:p> > [<a href="mailto:freeipa-users-bounces@redhat.com">mailto:freeipa-users-bounces@redhat.com</a>] On Behalf Of Gady Notrica<o:p></o:p> > Sent: April 26, 2016 10:10 AM<o:p></o:p> > To: Ludwig Krispenz; <a href="mailto:freeipa-users@redhat.com"> freeipa-users@redhat.com</a><o:p></o:p> > Subject: Re: [Freeipa-users] krb5kdc service not starting<o:p></o:p> > <o:p></o:p> > No, no changes. Lost connectivity with my VMs during the night <o:p></o:p> > (networking issues in datacenter)<o:p></o:p> > <o:p></o:p> > Reboot the server and oups, no IPA is coming up... The replica (secondary server) is fine though.<o:p></o:p> > <o:p></o:p> > Gady Notrica<o:p></o:p> > <o:p></o:p> > -----Original Message-----<o:p></o:p> > From: <a href="mailto:freeipa-users-bounces@redhat.com"> freeipa-users-bounces@redhat.com</a> <o:p></o:p> > [<a href="mailto:freeipa-users-bounces@redhat.com">mailto:freeipa-users-bounces@redhat.com</a>] On Behalf Of Ludwig Krispenz<o:p></o:p> > Sent: April 26, 2016 10:02 AM<o:p></o:p> > To: <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><o:p></o:p> > Subject: Re: [Freeipa-users] krb5kdc service not starting<o:p></o:p> > <o:p></o:p> > <o:p></o:p> > On 04/26/2016 03:26 PM, Gady Notrica wrote:<o:p></o:p> >> Here...<o:p></o:p> >> <o:p></o:p> >> [root@cd-p-ipa1 log]# ipactl status<o:p></o:p> >> Directory Service: STOPPED<o:p></o:p> >> Directory Service must be running in order to obtain status of other <o:p></o:p> >> services<o:p></o:p> >> ipa: INFO: The ipactl command was successful<o:p></o:p> >> <o:p></o:p> >> [root@cd-p-ipa1 log]# systemctl status <a href="mailto:dirsrv@IPA-CANDEAL-CA.service"> dirsrv@IPA-DOMAIN-LOCAL.service</a> <o:p></o:p> >> -l ● <a href="mailto:dirsrv@IPA-DOMAIN-LOCAL.service"> dirsrv@IPA-DOMAIN-LOCAL.service</a> - 389 Directory Server IPA-DOMAIN-LOCAL.<o:p></o:p> >> Loaded: loaded (<a href="mailto:/usr/lib/systemd/system/dirsrv@.service">/usr/lib/systemd/system/dirsrv@.service</a>; enabled; vendor preset: disabled)<o:p></o:p> >> Active: failed (Result: exit-code) since Tue 2016-04-26 08:50:21 EDT; 30min ago<o:p></o:p> >> Process: 6333 ExecStart=/usr/sbin/ns-slapd -D <o:p> </o:p> >> /etc/dirsrv/slapd-%i -i /var/run/dirsrv/slapd-%i.pid -w <o:p></o:p> >> /var/run/dirsrv/slapd-%i.startpid (code=exited, status=1/FAILURE)<o:p></o:p> >> <o:p></o:p> >> Apr 26 08:50:21 cd-p-ipa1.ipa.domain.local ns-slapd[6333]:<o:p></o:p> >> [26/Apr/2016:08:50:21 -0400] - valueset_value_syntax_cmp:<o:p></o:p> >> slapi_attr_values2keys_sv failed for type attributetypes Apr 26<o:p></o:p> >> 08:50:21 cd-p-ipa1.ipa.domain.local ns-slapd[6333]:<o:p></o:p> >> [26/Apr/2016:08:50:21 -0400] - valueset_value_syntax_cmp:<o:p></o:p> >> slapi_attr_values2keys_sv failed for type attributetypes Apr 26<o:p></o:p> >> 08:50:21 cd-p-ipa1.ipa.domain.local ns-slapd[6333]:<o:p></o:p> >> [26/Apr/2016:08:50:21 -0400] - valueset_value_syntax_cmp:<o:p></o:p> >> slapi_attr_values2keys_sv failed for type attributetypes Apr 26 08:50:21 cd-p-ipa1.ipa.domain.local ns-slapd[6333]: [26/Apr/2016:08:50:21 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes Apr 26 08:50:21 cd-p-ipa1.ipa.domain.local ns-slapd[6333]: [26/Apr/2016:08:50:21 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes Apr 26 08:50:21 cd-p-ipa1.ipa.domain.local ns-slapd[6333]: [26/Apr/2016:08:50:21 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes Apr 26 08:50:21 cd-p-ipa1.ipa.domain.local ns-slapd[6333]: [26/Apr/2016:08:50:21 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes Apr 26 08:50:21 cd-p-ipa1.ipa.domain.local ns-slapd[6333]: [26/Apr/2016:08:50:21 -0400] - valueset_value_syntax_cmp: slapi_attr_values2keys_sv failed for type attributetypes Apr 26 08:50:21 cd-p-ipa1.ipa.domain.local ns-slapd[6333]: [26/Apr/2016!<o:p></o:p> :08:50:21<o:p></o:p> -0400] dse_read_one_file - The entry cn=schema in file /etc/dirsrv/slapd-IPA-DOMAIN-LOCAL/schema/00core.ldif (lineno: 1) is invalid, error code 21 (Invalid syntax) - attribute type aci: Unknown attribute syntax OID "1.3.6.1.4.1.1466.115.121.1.15"<o:p></o:p> >> Apr 26 08:50:21 cd-p-ipa1.ipa.domain.local ns-slapd[6333]: [26/Apr/2016:08:50:21 -0400] dse - Please edit the file to correct the reported problems and then restart the server.<o:p></o:p> > this says the server doesn't know a syntax oid, but it is a known one.<o:p></o:p> > It could be that the syntax plugings couldn't be loaded. Thera are more errors before, could you check where the errors start in /var/log/dirsrv/slapd-<INSTANCE>/errors ?<o:p></o:p> > <o:p></o:p> > And, did you do any changes to the system before this problem started ?<o:p></o:p> >> [root@cd-p-ipa1 log]#<o:p></o:p> >> <o:p></o:p> >> Gady<o:p></o:p> >> <o:p></o:p> >> -----Original Message-----<o:p></o:p> >> From: <a href="mailto:freeipa-users-bounces@redhat.com"> freeipa-users-bounces@redhat.com</a> <o:p></o:p> >> [<a href="mailto:freeipa-users-bounces@redhat.com">mailto:freeipa-users-bounces@redhat.com</a>] On Behalf Of Martin <o:p></o:p> >> Babinsky<o:p></o:p> >> Sent: April 26, 2016 9:17 AM<o:p></o:p> >> To: <a href="mailto:freeipa-users@redhat.com">freeipa-users@redhat.com</a><o:p></o:p> >> Subject: Re: [Freeipa-users] krb5kdc service not starting<o:p></o:p> >> <o:p></o:p> >> On 04/26/2016 03:13 PM, Gady Notrica wrote:<o:p></o:p> >>> Hello world,<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> I am having issues this morning with my primary IPA. See below the <o:p></o:p> >>> details in the logs and command result. Basically, krb5kdc service <o:p></o:p> >>> not starting - krb5kdc: Server error - while fetching master key.<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> DNS is functioning. See below dig result. I have a trust with Windows AD.<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> Please help…!<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> [root@cd-ipa1 log]# systemctl status krb5kdc.service -l<o:p></o:p> >>> <o:p></o:p> >>> ● krb5kdc.service - Kerberos 5 KDC<o:p></o:p> >>> <o:p></o:p> >>> Loaded: loaded (/usr/lib/systemd/system/krb5kdc.service;<o:p></o:p> >>> disabled; vendor preset: disabled)<o:p></o:p> >>> <o:p></o:p> >>> Active: failed (Result: exit-code) since Tue 2016-04-26 <o:p></o:p> >>> 08:27:52 EDT; 41min ago<o:p></o:p> >>> <o:p></o:p> >>> Process: 3694 ExecStart=/usr/sbin/krb5kdc -P <o:p> </o:p> >>> /var/run/krb5kdc.pid $KRB5KDC_ARGS (code=exited, status=1/FAILURE)<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:52 cd-ipa1.ipa.domain.localsystemd[1]: Starting <o:p></o:p> >>> Kerberos<o:p></o:p> >>> 5 KDC...<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:52 cd-ipa1.ipa.domain.localkrb5kdc[3694]: krb5kdc:<o:p></o:p> >>> cannot initialize realm IPA.DOMAIN.LOCAL- see log file for details<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:52 cd-ipa1.ipa.domain.localsystemd[1]: krb5kdc.service:<o:p></o:p> >>> control process exited, code=exited status=1<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:52 cd-ipa1.ipa.domain.localsystemd[1]: Failed to start <o:p></o:p> >>> Kerberos 5 KDC.<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:52 cd-ipa1.ipa.domain.localsystemd[1]: Unit <o:p></o:p> >>> krb5kdc.service entered failed state.<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:52 cd-ipa1.ipa.domain.localsystemd[1]: krb5kdc.service failed.<o:p></o:p> >>> <o:p></o:p> >>> [root@cd-ipa1 log]#<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> Errors in /var/log/krb5kdc.log<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> krb5kdc: Server error - while fetching master key K/M for realm <o:p></o:p> >>> DOMAIN.LOCAL<o:p></o:p> >>> <o:p></o:p> >>> krb5kdc: Server error - while fetching master key K/M for realm <o:p></o:p> >>> DOMAIN.LOCAL<o:p></o:p> >>> <o:p></o:p> >>> krb5kdc: Server error - while fetching master key K/M for realm <o:p></o:p> >>> DOMAIN.LOCAL<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> [root@cd-ipa1 log]# systemctl status httpd -l<o:p></o:p> >>> <o:p></o:p> >>> ● httpd.service - The Apache HTTP Server<o:p></o:p> >>> <o:p></o:p> >>> Loaded: loaded (/etc/systemd/system/httpd.service; disabled; <o:p></o:p> >>> vendor<o:p></o:p> >>> preset: disabled)<o:p></o:p> >>> <o:p></o:p> >>> Active: failed (Result: exit-code) since Tue 2016-04-26 <o:p></o:p> >>> 08:27:21 EDT; 39min ago<o:p></o:p> >>> <o:p></o:p> >>> Docs: <a href="man:httpd%288%29">man:httpd(8)</a><o:p></o:p> >>> <o:p></o:p> >>> <a href="man:apachectl%288%29">man:apachectl(8)</a><o:p></o:p> >>> <o:p></o:p> >>> Process: 3594 ExecStartPre=/usr/libexec/ipa/ipa-httpd-kdcproxy<o:p></o:p> >>> (code=exited, status=1/FAILURE)<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:21 cd-ipa1.ipa.domain.localipa-httpd-kdcproxy[3594]:<o:p></o:p> >>> File "/usr/lib/python2.7/siteackages/ipapython/ipaldap.py", line <o:p></o:p> >>> 1579, in __wait_for_connection<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:21 cd-ipa1.ipa.domain.local ipa-httpd-kdcproxy[3594]:<o:p></o:p> >>> wait_for_open_socket(lurl.hostport, timeout)<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:21 cd-ipa1.ipa.domain.local ipa-httpd-kdcproxy[3594]:<o:p></o:p> >>> File "/usr/lib/python2.7/siteackages/ipapython/ipautil.py", line <o:p></o:p> >>> 1200, in wait_for_open_socket<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:21 cd-ipa1.ipa.domain.local ipa-httpd-kdcproxy[3594]:<o:p></o:p> >>> raise e<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:21 cd-ipa1.ipa.domain.local ipa-httpd-kdcproxy[3594]:<o:p></o:p> >>> error: [Errno 2] No such file or directory<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:21 cd-ipa1.ipa.domain.local ipa-httpd-kdcproxy[3594]:<o:p></o:p> >>> ipa : ERROR Unknown error while retrieving setting from<o:p></o:p> >>> ldapi://%2fvar%2frun%2fslapd-IPA-DOMAIN-LOCAL.socket: [Errno 2] No <o:p></o:p> >>> such file or directory<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:21 cd-ipa1.ipa.domain.localsystemd[1]: httpd.service:<o:p></o:p> >>> control process exited, code=exited status=1<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:21 cd-ipa1.ipa.domain.localsystemd[1]: Failed to start <o:p></o:p> >>> The Apache HTTP Server.<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:21 cd-ipa1.ipa.domain.localsystemd[1]: Unit <o:p></o:p> >>> httpd.service entered failed state.<o:p></o:p> >>> <o:p></o:p> >>> Apr 26 08:27:21 cd-ipa1.ipa.domain.localsystemd[1]: httpd.service failed.<o:p></o:p> >>> <o:p></o:p> >>> [root@cd-ipa1 log]#<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> DNS Result for dig redhat.com<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> ; <<>> DiG 9.9.4-RedHat-9.9.4-29.el7_2.3 <<>> redhat.com<o:p></o:p> >>> <o:p></o:p> >>> ;; global options: +cmd<o:p></o:p> >>> <o:p></o:p> >>> ;; Got answer:<o:p></o:p> >>> <o:p></o:p> >>> ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 5414<o:p></o:p> >>> <o:p></o:p> >>> ;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 13, ADDITIONAL: <o:p></o:p> >>> 2<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> ;; OPT PSEUDOSECTION:<o:p></o:p> >>> <o:p></o:p> >>> ; EDNS: version: 0, flags:; udp: 4096<o:p></o:p> >>> <o:p></o:p> >>> ;; QUESTION SECTION:<o:p></o:p> >>> <o:p></o:p> >>> ;redhat.com. IN A<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> ;; ANSWER SECTION:<o:p></o:p> >>> <o:p></o:p> >>> redhat.com. 60 IN A 209.132.183.105<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> ;; AUTHORITY SECTION:<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS f.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS e.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS k.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS m.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS b.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS g.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS c.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS h.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS l.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS a.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS j.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS i.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> . 849 IN NS d.root-servers.net.<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> ;; ADDITIONAL SECTION:<o:p></o:p> >>> <o:p></o:p> >>> j.root-servers.net. 3246 IN A 192.58.128.30<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> ;; Query time: 79 msec<o:p></o:p> >>> <o:p></o:p> >>> ;; SERVER: 10.20.10.41#53(10.20.10.41)<o:p></o:p> >>> <o:p></o:p> >>> ;; WHEN: Tue Apr 26 09:02:43 EDT 2016<o:p></o:p> >>> <o:p></o:p> >>> ;; MSG SIZE rcvd: 282<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> Gady<o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >>> <o:p></o:p> >> It seems like Directory server is not running. Can you post result of 'ipactl status' and 'systemctl status <a href="mailto:dirsrv@IPA-CANDEAL-CA.service">dirsrv@IPA-DOMAIN-LOCAL.service</a>'?<o:p></o:p> >> <o:p></o:p> >> --<o:p></o:p> >> Martin^3 Babinsky<o:p></o:p> >> <o:p></o:p> >> --<o:p></o:p> >> Manage your subscription for the Freeipa-users mailing list:<o:p></o:p> >> <a href="https://www.redhat.com/mailman/listinfo/freeipa-users"> https://www.redhat.com/mailman/listinfo/freeipa-users</a><o:p></o:p> >> Go to <a href="http://freeipa.org">http://freeipa.org</a> for more info on the project<o:p></o:p> >> <o:p></o:p> > <o:p></o:p> > --<o:p></o:p> > Red Hat GmbH, <a href="http://www.de.redhat.com/">http://www.de.redhat.com/</a>, Registered seat: Grasbrunn, <o:p></o:p> > Commercial register: Amtsgericht Muenchen, HRB 153243, Managing <o:p></o:p> > Directors: Paul Argiry, Charles Cachera, Michael Cunningham, Michael <o:p></o:p> > O'Neill<o:p></o:p> > <o:p></o:p> > --<o:p></o:p> > Manage your subscription for the Freeipa-users mailing list:<o:p></o:p> > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users"> https://www.redhat.com/mailman/listinfo/freeipa-users</a><o:p></o:p> > Go to <a href="http://freeipa.org">http://freeipa.org</a> for more info on the project<o:p></o:p> > <o:p></o:p> > --<o:p></o:p> > Manage your subscription for the Freeipa-users mailing list:<o:p></o:p> > <a href="https://www.redhat.com/mailman/listinfo/freeipa-users"> https://www.redhat.com/mailman/listinfo/freeipa-users</a><o:p></o:p> > Go to <a href="http://freeipa.org">http://freeipa.org</a> for more info on the project<o:p></o:p> > <o:p></o:p> <o:p></o:p> <o:p></o:p> <pre>-- <o:p></o:p></pre> <pre>Red Hat GmbH, <a href="http://www.de.redhat.com/">http://www.de.redhat.com/</a>, Registered seat: Grasbrunn, <o:p></o:p></pre> <pre>Commercial register: Amtsgericht Muenchen, HRB 153243,<o:p></o:p></pre> <pre>Managing Directors: Paul Argiry, Charles Cachera, Michael Cunningham, Michael O'Neill<o:p></o:p></pre> <o:p></o:p> <pre>-- <o:p></o:p></pre> <pre>Red Hat GmbH, <a href="http://www.de.redhat.com/">http://www.de.redhat.com/</a>, Registered seat: Grasbrunn, <o:p></o:p></pre> <pre>Commercial register: Amtsgericht Muenchen, HRB 153243,<o:p></o:p></pre> <pre>Managing Directors: Paul Argiry, Charles Cachera, Michael Cunningham, Michael O'Neill<o:p></o:p></pre> </div> </body> </html>