Can't locate CSN - replica issue
by Marco Favero
Hello,
I'm dealing with the update from 389-ds 1.3.9.1 to 1.4.3.22 in three multimaster servers:
- srv1
- srv2
- srv3
srv1 replicates to srv2 and srv3.
srv2 replicates to srv1 and srv3.
srv3 replicates to srv1 and srv2.
Let suppose I reinstall srv3 with 389ds 1.4.3.22, and I initialize it from srv1. This happens with success as expected. The replica is fine.
Then, I reinstall srv2, and I initialize it from srv3. This happens with success as expected, but just at the initialization end, the agreement from srv3 to srv1 stops to works.
In the console appears "Error (18) Can't acquire replica (Incremental update transient warning. Backing off, will retry update later.)" in the status of the agreements from srv3 to srv1. In the logs I see errors like
repl_plugin_name_cl - agmt="srv3 to srv1" (srv1:389): CSN 596c6868000075320000 not found, we aren't as up to date, or we purged
clcache_load_buffer - Can't locate CSN 596c6868000075320000 in the changelog (DB rc=-30988). If replication stops, the consumer may need to be reinitialized.
The changelogdb Maximun Age is "7d", equals to the default nsDS5ReplicaPurgeDelay for the suffix.
This happens always, for every suffix.
To resolve the issue I have to re-initialize from srv3 to srv1 again and after the end of initialization from srv3 to srv2.
Resuming:
1) install srv2 OK
2) initialize srv1 to srv3 OK
3) initialize srv2 to srv3: the agreement srv1 to srv3 stops to work
4) initialize srv1 to srv3 again
I would like to know how to configure the Directory Server in order to avoid the above scenario.
The problem is very similar to
https://access.redhat.com/solutions/2690611
but that document says that the problem was already fixed in 389-ds-base-1.3.5.10-15.el7_3 or later.
Could you help me?
Thank you very much
Marco
1 year, 11 months
Re: [Freeipa-users] Re: Consumer failed to replay change Operations error (1)
by Thierry Bordaz
Hello Alfred,
If it is IPA deployment I doubt that you hit [1] because it only applies
on read-only replica (hub/consumer). Also this bug is fixed in the
version you are running.
The consumer (redactedauth0003.redacted.com
<http://redactedauth0001.redacted.com-to-redactedauth0003.redacted.com>)
fails to apply a replicated MOD targeting the admin group. It is not
clear if the failure occurs at changelog update or RUV update. It is
looking it is a permanent failure so you may enable replication debug
log in case it gives more details why it is failing.
regards
thierry
[1] https://bugzilla.redhat.com/show_bug.cgi?id=1574602
<https://bugzilla.redhat.com/show_bug.cgi?id=1574602>
On 6/17/21 11:12 AM, Florence Renaud via FreeIPA-users wrote:
> Forwarding to 389-users(a)lists.fedoraproject.org
> <https://lists.fedoraproject.org/admin/lists/389-users.lists.fedoraproject...>
> as they may have more inputs.
>
> On Wed, Jun 16, 2021 at 11:31 PM Alfred Victor via FreeIPA-users
> <freeipa-users(a)lists.fedorahosted.org
> <mailto:freeipa-users@lists.fedorahosted.org>> wrote:
>
> Hi FreeIPA,
>
> We have some replication messages in our slapd errors log which
> look very like the ones discussed here:
>
> https://bugzilla.redhat.com/show_bug.cgi?id=1574602
> <https://bugzilla.redhat.com/show_bug.cgi?id=1574602>
>
> I took a look and we do have the MemberOf plugin, but our version
> of 389-ds newer:
>
> *389-ds-base-1.3.10.2-10.el7_9.x86_64*
>
> *
> *
>
> *
> *
>
> Hoping someone might have a suggestion for what we might do to get
> rid of these log messages, or what the root cause may be/impact?
> They've been going since at least a couple of weeks ago:
> *
> *
>
> [15/Jun/2021:18:57:26.362094959 -0500] - WARN -
> NSMMReplicationPlugin - repl5_inc_update_from_op_result -
> agmt="cn=redactedauth0001.redacted.com-to-redactedauth0003.redacted.com
> <http://redactedauth0001.redacted.com-to-redactedauth0003.redacted.com>"
> (redactedauth0003:389): Consumer failed to replay change
> (uniqueid d5896001-39a111eb-8868efc8-91dc0b98, CSN
> 60c93bc2000400250000): Operations error (1). Will retry later.
>
>
>
>
> I looked for this same uniqueid (they are ALL the same uniqueID) and found this which is interesting and references a specific cn and "optype":
>
>
> [03/Jun/2021:15:45:43.332068775 -0500] - ERR -
> NSMMReplicationPlugin - write_changelog_and_ruv - Can't add a
> change for cn=admin,cn=groups,cn=accounts,dc=redacted,dc=com
> (uniqid: d5896001-39a111eb-8868efc8-91dc0b98, optype: 8) to
> changelog csn 60b93f93005200230000
>
>
>
> Alfred
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> <mailto:freeipa-users@lists.fedorahosted.org>
> To unsubscribe send an email to
> freeipa-users-leave(a)lists.fedorahosted.org
> <mailto:freeipa-users-leave@lists.fedorahosted.org>
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> <https://docs.fedoraproject.org/en-US/project/code-of-conduct/>
> List Guidelines:
> https://fedoraproject.org/wiki/Mailing_list_guidelines
> <https://fedoraproject.org/wiki/Mailing_list_guidelines>
> List Archives:
> https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> <https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...>
> Do not reply to spam on the list, report it:
> https://pagure.io/fedora-infrastructure
> <https://pagure.io/fedora-infrastructure>
>
>
> _______________________________________________
> FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
> To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...
> Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure
1 year, 11 months
