Kees Bakker via FreeIPA-users wrote:

Hi,

This morning we ran into a problem after updating 386-base to 1.4.4.17 (hoping to solve a trimming [1] issue). The ns-slapd server ended up in a deadlock so I had to revert.

Since then we have ipahealthcheck reporting CRITICAL "is not in synchronization" errors. Also, in one of the replica's there is a message "Incremental update failed and requires administration action". Although I'm the administrator myself I wasn't quite sure what to do. Somewhere I read that I should do a re-initialize. One of the three replica's/masters is still behaving normal (I hope). So I took that one as the source for the re-initialize.

I did do bot commands ipa-replica-manage and ipa-csreplica-manage with re-initialize. Both commands succeeded.

However, ipahealth check keeps complaining. I would like to know where else I should look to figure out the problem.

[   {     "source": "ipahealthcheck.ds.replication",     "check": "ReplicationCheck",     "result": "CRITICAL",     "uuid": "d44af6bf-f7e4-44de-b9c6-f32398ecf7f9",     "when": "20211018104930Z",     "duration": "0.103066",     "kw": {       "key": "DSREPLLE0001",       "items": [         "Replication",         "Agreement"       ],       "msg": "The replication agreement (linge.example.com-to-iparep4.example.com) under "dc=example,dc=com" is not in synchronization."     }   },   {     "source": "ipahealthcheck.ds.replication",     "check": "ReplicationCheck",     "result": "CRITICAL",     "uuid": "239ad7db-8067-4623-b950-5237bef711f6",     "when": "20211018104930Z",     "duration": "0.103075",     "kw": {       "key": "DSREPLLE0001",       "items": [         "Replication",         "Agreement"       ],       "msg": "The replication agreement (metorotte.example.com) under "dc=example,dc=com" is not in synchronization."     }   },   {     "source": "ipahealthcheck.ds.replication",     "check": "ReplicationCheck",     "result": "CRITICAL",     "uuid": "b5fc5f97-08cb-4d26-88cf-33dc04f8498f",     "when": "20211018104930Z",     "duration": "0.103077",     "kw": {       "key": "DSREPLLE0001",       "items": [         "Replication",         "Agreement"       ],       "msg": "The replication agreement (catorotte.example.com) under "o=ipaca" is not in synchronization."     }   },   {     "source": "ipahealthcheck.ds.replication",     "check": "ReplicationCheck",     "result": "CRITICAL",     "uuid": "e633752c-6d5e-4fb7-91e2-218cb514dd61",     "when": "20211018104930Z",     "duration": "0.103078",     "kw": {       "key": "DSREPLLE0001",       "items": [         "Replication",         "Agreement"       ],       "msg": "The replication agreement (linge.example.com-to-iparep4.example.com) under "o=ipaca" is not in synchronization."     }   } ]

[1] https://github.com/389ds/389-ds-base/pull/4895

The 389-ds access and error logs may contain more information. Be sure to check both sides of the agreement.

rob