Hi FreeIPA users,
I'm attempting to install a replica on Rocky 10 from an existing replica on
Rocky 9.
On the replica I see:
sudo grep -iE "critical|error|exception" /var/log/ipareplica-install.log
2026-05-14T15:36:52Z DEBUG Entry found
[LDAPEntry(ipapython.dn.DN('cn=meToipa-lon-3.thomac.net,cn=replica,cn=dc\=thomac\,dc\=net,cn=mapping
tree,cn=config'), {'objectClass': [b'nsds5replicationagreement', b'top'],
'cn': [b'meToipa-lon-3.thomac.net'], 'nsDS5ReplicaHost':
[b'ipa-lon-3.thomac.net'], 'nsDS5ReplicaPort': [b'389'], 'nsds5replicaTimeout':
[b'120'], 'nsDS5ReplicaRoot': [b'dc=thomac,dc=net'], 'description': [b'me to
ipa-lon-3.thomac.net'], 'nsDS5ReplicatedAttributeList': [b'(objectclass=*) $
EXCLUDE memberof idnssoaserial entryusn krblastsuccessfulauth krblastfailedauth
krbloginfailedcount passwordgraceusertime'], 'nsDS5ReplicaTransportInfo':
[b'LDAP'], 'nsDS5ReplicaBindMethod': [b'SASL/GSSAPI'],
'nsds5ReplicaStripAttrs': [b'modifiersName modifyTimestamp
internalModifiersName internalModifyTimestamp'],
'nsDS5ReplicatedAttributeListTotal': [b'(objectclass=*) $ EXCLUDE entryusn
krblastsuccessfulauth krblastfailedauth krbloginfailedcount
passwordgraceusertime'], 'nsds5replicareapactive': [b'0'],
'nsds5replicaLastUpdateStart': [b'19700101000000Z'],
'nsds5replicaLastUpdateEnd': [b'19700101000000Z'],
'nsds5replicaChangesSentSinceStartup': [b''], 'nsds5replicaLastUpdateStatus':
[b'Error (49) Problem connecting to replica - LDAP error: Invalid credentials
(connection error)'], 'nsds5replicaLastUpdateStatusJSON': [b'{"state": "red",
"ldap_rc": "49", "ldap_rc_text": "Invalid credentials", "repl_rc": "16",
"repl_rc_text": "connection error", "date": "2026-05-14T15:36:52Z", "message":
"Error (49) Problem connecting to replica - LDAP error: Invalid credentials
(connection error)"}'], 'nsds5replicaUpdateInProgress': [b'FALSE'],
'nsds5replicaLastInitStart': [b'19700101000000Z'], 'nsds5replicaLastInitEnd':
[b'19700101000000Z']})]
2026-05-14T15:36:52Z DEBUG Entry found
[LDAPEntry(ipapython.dn.DN('cn=meToipa-lon-1.thomac.net,cn=replica,cn=dc\=thomac\,dc\=net,cn=mapping
tree,cn=config'), {'objectClass': [b'nsds5replicationagreement', b'top'],
'cn': [b'meToipa-lon-1.thomac.net'], 'nsDS5ReplicaHost':
[b'ipa-lon-1.thomac.net'], 'nsDS5ReplicaPort': [b'389'], 'nsds5replicaTimeout':
[b'120'], 'nsDS5ReplicaRoot': [b'dc=thomac,dc=net'], 'description': [b'me to
ipa-lon-1.thomac.net'], 'nsDS5ReplicatedAttributeList': [b'(objectclass=*) $
EXCLUDE memberof idnssoaserial entryusn krblastsuccessfulauth krblastfailedauth
krbloginfailedcount passwordgraceusertime'], 'nsDS5ReplicaTransportInfo':
[b'LDAP'], 'nsDS5ReplicaBindMethod': [b'SASL/GSSAPI'],
'nsds5ReplicaStripAttrs': [b'modifiersName modifyTimestamp
internalModifiersName internalModifyTimestamp'],
'nsDS5ReplicatedAttributeListTotal': [b'(objectclass=*) $ EXCLUDE entryusn
krblastsuccessfulauth krblastfailedauth krbloginfailedcount
passwordgraceusertime'], 'nsds5replicareapactive': [b'0'],
'nsds5replicaLastUpdateStart': [b'19700101000000Z'],
'nsds5replicaLastUpdateEnd': [b'19700101000000Z'],
'nsds5replicaChangesSentSinceStartup': [b''], 'nsds5replicaLastUpdateStatus':
[b'Error (0) No replication sessions started since server startup'],
'nsds5replicaLastUpdateStatusJSON': [b'{"state": "green", "ldap_rc": "0",
"ldap_rc_text": "success", "repl_rc": "0", "repl_rc_text": "replica acquired",
"date": "2026-05-14T15:36:52Z", "message": "Error (0) No replication sessions
started since server startup"}'], 'nsds5replicaUpdateInProgress': [b'FALSE'],
'nsds5replicaLastInitStart': [b'19700101000000Z'], 'nsds5replicaLastInitEnd':
[b'19700101000000Z']})]
raise RuntimeError("Failed to start replication")
RuntimeError: Failed to start replication
2026-05-14T15:38:58Z DEBUG [error] RuntimeError: Failed to start replication
File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 468,
in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 458,
in _handle_exception
File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 468,
in _handle_execute_exception
self._handle_exception(exc_info)
File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 526,
in _handle_exception
self.__parent._handle_exception(exc_info)
File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 458,
in _handle_exception
File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 523,
in _handle_exception
super(ComponentBase, self)._handle_exception(exc_info)
File "/usr/lib/python3.12/site-packages/ipapython/install/core.py", line 458,
in _handle_exception
raise RuntimeError("Failed to start replication")
2026-05-14T15:38:58Z DEBUG The ipa-replica-install command failed, exception:
RuntimeError: Failed to start replication
2026-05-14T15:38:58Z ERROR Failed to start replication
2026-05-14T15:38:58Z ERROR The ipa-replica-install command failed. See
/var/log/ipareplica-install.log for more information
and on the existing replica I see:
[14/May/2026:15:37:10.784513370 +0000] - WARN - content-sync-plugin -
sync_update_persist_betxn_pre_op - DB retried operation targets
"changenumber=68535600,cn=changelog" (op=0x7f62b0043800 idx_pl=1) => op not
changed in PL
[14/May/2026:15:38:50.526377911 +0000] - WARN - content-sync-plugin -
sync_update_persist_betxn_pre_op - DB retried operation targets
"changenumber=68535707,cn=changelog" (op=0x7f638133b800 idx_pl=1) => op not
changed in PL
[14/May/2026:15:38:50.590699199 +0000] - WARN - NSMMReplicationPlugin -
replica_generate_next_csn - opcsn=6a05ee16000500340000 <=
basecsn=6a05ee17000600300000, adjusted opcsn=6a05ee17000700340000
[14/May/2026:15:38:57.511706451 +0000] - ERR - NSMMReplicationPlugin -
perform_operation - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): Failed
to send extended operation: LDAP error -1 (Can't contact LDAP server)
[14/May/2026:15:38:57.517218118 +0000] - ERR - NSMMReplicationPlugin -
repl5_tot_log_operation_failure - agmt="cn=meToipa-lon-3.thomac.net"
(ipa-lon-3:389): Received error -1 (Can't contact LDAP server): for total
update operation
[14/May/2026:15:38:57.520123870 +0000] - ERR - NSMMReplicationPlugin -
release_replica - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): Unable to
send endReplication extended operation (Can't contact LDAP server)
[14/May/2026:15:38:57.522323162 +0000] - ERR - NSMMReplicationPlugin -
repl5_tot_run - Total update failed for replica
"agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389)", error (-11)
[14/May/2026:15:38:57.524104058 +0000] - ERR - NSMMReplicationPlugin -
agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): Total update flow control
triggered 59 times
You may increase nsds5ReplicaFlowControlPause and/or decrease
nsds5ReplicaFlowControlWindow in the replica agreement configuration
[14/May/2026:15:38:57.816155969 +0000] - INFO - NSMMReplicationPlugin -
bind_and_check_pwp - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389):
Replication bind with GSSAPI auth resumed
[14/May/2026:15:38:58.098378634 +0000] - WARN - NSMMReplicationPlugin -
repl5_inc_run - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): The remote
replica has a different database generation ID than the local database. You
may have to reinitialize the remote replica, or the local replica.
[14/May/2026:15:39:00.874788979 +0000] - WARN - NSMMReplicationPlugin -
repl5_inc_run - agmt="cn=meToipa-lon-3.thomac.net" (ipa-lon-3:389): The remote
replica has a different database generation ID than the local database. You
may have to reinitialize the remote replica, or the local replica.
I remove the replica by running:
On the existing replica:
ipa-replica-manage del ipa-lon-3.thomac.net --force --cleanup
ipa server-del ipa-lon-3.thomac.net
ipa host-del ipa-lon-3.thomac.net
dsconf -D "cn=Directory Manager" ldaps://localhost repl-agmt delete --suffix
"dc=thomac,dc=net" meToipa-lon-3.thomac.net
and find no replica agreements with ipa topologysegment-find ca, and ipa
topologysegment-find domain
On the new replica:
ipa-server-install --uninstall -U and kdestroy -A
When I attempt a reinstall I run:
ipa-client-install --server ipa-lon-1.thomac.net --domain=thomac.net
Make sure to add A record with PTR
kinit admin
ipa hostgroup-add-member ipaservers --hosts ipa-lon-3.thomac.net
ipa-replica-install --principal admin -v
and it still fails.
The vms are on the same network, subnet, and have the same mtu
ipa-healthcheck returns []
the clock is the same
dig and host is good from both machines
I've also tried the command to a different replica and it still fails
I was able to upgrade my poc freeipa from rocky 9 and rocky 10 fine using both
manual commands and ansible playbook, but my production freeipa replicas are
failing.
Any ideas of anything else I can try?
Many Thanks,
Tania
--
_______________________________________________
FreeIPA-users mailing list -- [email protected]
To unsubscribe send an email to [email protected]
Fedora Code of Conduct:
https://docs.fedoraproject.org/en-US/project/code-of-conduct/
List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/[email protected]
Do not reply to spam, report it:
https://forge.fedoraproject.org/infra/tickets/issues/new
