<div dir="ltr">Anything else I should look for?</div><div class="gmail_extra"><br><div class="gmail_quote">2017-01-11 22:33 GMT-06:00 Daniel Schimpfoessl <span dir="ltr"><<a href="mailto:daniel@schimpfoessl.com" target="_blank">daniel@schimpfoessl.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr"><div>Flo,</div><div><br></div><div>these are all the errors found:</div><div><div>grep 'RESULT err=' access | perl -pe 's/.*(RESULT\s+err=\d+).*/$1/<wbr>g' | sort -n | uniq -c | sort -n</div></div><div> 2 RESULT err=6<br></div><div> 95 RESULT err=32</div><div> 200 RESULT err=14</div><div> 2105 RESULT err=0</div><div><br></div></div><div class="HOEnZb"><div class="h5"><div class="gmail_extra"><br><div class="gmail_quote">2017-01-05 8:10 GMT-06:00 Florence Blanc-Renaud <span dir="ltr"><<a href="mailto:flo@redhat.com" target="_blank">flo@redhat.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On 01/04/2017 07:24 PM, Daniel Schimpfoessl wrote:<br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"> >From the logs:<br> /var/log/dirsrv/slapd-DOMAIN-C<wbr>OM/errors<br> ... a few warnings about cache size, NSACLPLugin and schema-compat-plugin<br> [04/Jan/2017:12:14:21.39264202<wbr>1 -0600] slapd started. Listening on All<br> Interfaces port 389 for LDAP requests<br> <br> /var/log/dirsrv/slapd-DOMAIN-C<wbr>OM/access<br> ... lots of entries, not sure what to look for some lines contain RESULT<br> with err!=0<br> [04/Jan/2017:12:18:01.75340030<wbr>7 -0600] conn=5 op=243 RESULT err=32<br> tag=101 nentries=0 etime=0<br> [04/Jan/2017:12:18:01.78692808<wbr>5 -0600] conn=44 op=1 RESULT err=14 tag=97<br> nentries=0 etime=0, SASL bind in progress<br> <br> </blockquote></span> Hi Daniel,<br> <br> are there any RESULT err=48 that could correspond to the error seen on pki logs?<br> <br> Flo<br> <br> <blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span> /var/log/dirsrv/slapd-DOMAIN-C<wbr>OM/errors<br> [04/Jan/2017:12:19:25.56602209<wbr>8 -0600] slapd shutting down - signaling<br> operation threads - op stack size 5 max work q size 2 max work q stack<br> size 2<br> [04/Jan/2017:12:19:25.57256662<wbr>2 -0600] slapd shutting down - closing<br> down internal subsystems and plugins<br> <br> <br> 2017-01-04 8:38 GMT-06:00 Daniel Schimpfoessl <<a href="mailto:daniel@schimpfoessl.com" target="_blank">daniel@schimpfoessl.com</a><br></span> <mailto:<a href="mailto:daniel@schimpfoessl.com" target="_blank">daniel@schimpfoessl.co<wbr>m</a>>>:<span><br> <br> Do you have a list of all log files involved in IPA?<br> Would be good to consolidate them into ELK for analysis.<br> <br> 2017-01-04 2:48 GMT-06:00 Florence Blanc-Renaud <<a href="mailto:flo@redhat.com" target="_blank">flo@redhat.com</a><br></span> <mailto:<a href="mailto:flo@redhat.com" target="_blank">flo@redhat.com</a>>>:<div><div class="m_-1421581493750129291h5"><br> <br> On 01/02/2017 07:24 PM, Daniel Schimpfoessl wrote:<br> <br> Thanks for your reply.<br> <br> This was the initial error I asked for help a while ago and<br> did not get<br> resolved. Further digging showed the recent errors.<br> The service was running (using ipactl start --force) and<br> only after a<br> restart I am getting a stack trace for two primary messages:<br> <br> Could not connect to LDAP server host <a href="http://wwgwho01.webwim.com" rel="noreferrer" target="_blank">wwgwho01.webwim.com</a><br> <<a href="http://wwgwho01.webwim.com" rel="noreferrer" target="_blank">http://wwgwho01.webwim.com</a>><br> <<a href="http://wwgwho01.webwim.com" rel="noreferrer" target="_blank">http://wwgwho01.webwim.com</a>> port 636 Error<br> netscape.ldap.LDAPException:<br> Authentication failed (48)<br> ...<br> <br> Internal Database Error encountered: Could not connect to<br> LDAP server<br> host <a href="http://wwgwho01.webwim.com" rel="noreferrer" target="_blank">wwgwho01.webwim.com</a> <<a href="http://wwgwho01.webwim.com" rel="noreferrer" target="_blank">http://wwgwho01.webwim.com</a>><br> <<a href="http://wwgwho01.webwim.com" rel="noreferrer" target="_blank">http://wwgwho01.webwim.com</a>> port 636 Error<br> netscape.ldap.LDAPException: Authentication failed (48)<br> ...<br> <br> and finally:<br> [02/Jan/2017:12:20:34][localho<wbr>st-startStop-1]:<br> CMSEngine.shutdown()<br> <br> <br> 2017-01-02 3:45 GMT-06:00 Florence Blanc-Renaud<br> <<a href="mailto:flo@redhat.com" target="_blank">flo@redhat.com</a> <mailto:<a href="mailto:flo@redhat.com" target="_blank">flo@redhat.com</a>><br></div></div> <mailto:<a href="mailto:flo@redhat.com" target="_blank">flo@redhat.com</a> <mailto:<a href="mailto:flo@redhat.com" target="_blank">flo@redhat.com</a>>>>:<span><br> <br> systemctl start pki-tomcatd@pki-tomcat.service<br> <br> <br> <br> Hi Daniel,<br> <br> the next step would be to understand the root cause of this<br> "Authentication failed (48)" error. Note the exact time of this<br> log and look for a corresponding log in the LDAP server logs<br> (/var/log/dirsrv/slapd-DOMAIN-<wbr>COM/access), probably a failing<br> BIND with err=48. This may help diagnose the issue (if we can<br> see which certificate is used for the bind or if there is a<br> specific error message).<br> <br> For the record, a successful bind over SSL would produce this<br> type of log where we can see the certificate subject and the<br> user mapped to this certificate:<br> [...] conn=47 fd=84 slot=84 SSL connection from 10.34.58.150 to<br> 10.34.58.150<br> [...] conn=47 TLS1.2 128-bit AES; client CN=CA<br></span> Subsystem,O=<a href="http://DOMAIN.COM" rel="noreferrer" target="_blank">DOMAIN.COM</a> <<a href="http://DOMAIN.COM" rel="noreferrer" target="_blank">http://DOMAIN.COM</a>>; issuer<br> CN=Certificate Authority,O=<a href="http://DOMAIN.COM" rel="noreferrer" target="_blank">DOMAIN.COM</a> <<a href="http://DOMAIN.COM" rel="noreferrer" target="_blank">http://DOMAIN.COM</a>><span><br> [...] conn=47 TLS1.2 client bound as uid=pkidbuser,ou=people,o=ipac<wbr>a<br> [...] conn=47 op=0 BIND dn="" method=sasl version=3 mech=EXTERNAL<br> [...] conn=47 op=0 RESULT err=0 tag=97 nentries=0 etime=0<br> dn="uid=pkidbuser,ou=people,o=<wbr>ipaca"<br> <br> Flo<br> <br> <br> <br> </span></blockquote> <br> </blockquote></div><br></div> </div></div></blockquote></div><br></div>