I'm working on replacing my RHEL 9 ipa servers with RHEL 10. I'm having trouble running ipa-replica-install on the RHEL 10 machine.
ipa6 is the existing replica, running 389-ds-base-2.7.0-12.el9_7.x86_64 ipa7 will be the new replica, running 389-ds-base-3.1.3-7.el10_1.x86_64 The initial problem is as described in <https://access.redhat.com/solutions/374063>; ipa-replica-install fails on ipa7 with: # ipa-replica-install --setup-dns --auto-forwarder --setup-ca --setup-kra [...] [25/39]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 6 seconds elapsed [ldap://ipa6.example.com:389] reports: Update failed! Status: [Error (-2) connection error: Unknown connection error (-2) - Total update aborted] [error] RuntimeError: Failed to start replication As I understand it, ipa6 is reporting that it's unable to push replication data to ipa7. ipa7's dirsrv error log has: [14/May/2026:08:34:01.024056108 +0000] - NOTICE - NSMMReplicationPlugin - multisupplier_be_state_change - Replica dc=example,dc=com is going offline; disabling replication [14/May/2026:08:34:06.016144780 +0000] - ERR - sasl_io_start_packet - SASL encrypted packet length exceeds maximum allowed limit (length=2097156, limit=2097152). Change the nsslapd-maxsasliosize attribute in cn=config to increase limit. [14/May/2026:08:34:06.020122827 +0000] - ERR - factory_destructor - ERROR bulk import abandoned: conn=6 was closed [14/May/2026:08:34:06.039293730 +0000] - INFO - dbmdb_import_monitor_threads - import userRoot: Import writer thread usage: run: 25.65% read: 38.59% write: 35.50% pause: 0.15% txnbegin: 0.00% txncommit: 0.11% [14/May/2026:08:34:06.187327861 +0000] - INFO - dbmdb_import_monitor_threads - import userRoot: Workers finished; cleaning up... [14/May/2026:08:34:06.190813134 +0000] - INFO - dbmdb_import_monitor_threads - import userRoot: Workers cleaned up. [14/May/2026:08:34:06.192987116 +0000] - ERR - dbmdb_import_run_pass - import userRoot: Thread monitoring returned: -23 [14/May/2026:08:34:06.194912877 +0000] - ERR - dbmdb_public_dbmdb_import_main - import userRoot: Aborting all Import threads... [14/May/2026:08:34:06.196678126 +0000] - ERR - dbmdb_public_dbmdb_import_main - import userRoot: Import threads aborted. [14/May/2026:08:34:06.198682179 +0000] - INFO - dbmdb_public_dbmdb_import_main - import userRoot: Closing files... [14/May/2026:08:34:06.206359538 +0000] - ERR - dbmdb_public_dbmdb_import_main - import userRoot: Import failed. [14/May/2026:08:34:06.208655028 +0000] - INFO - dbmdb_task_finish - userRoot: Finished importing. Exit code is -23 [14/May/2026:08:34:06.624898860 +0000] - ERR - process_bulk_import_op - NULL target sdn So as advised in the knowledge base article, I cleaned up the failing replication agreement on ipa6, reinstalled ipa7 and tried again using a custom dirsrv config file that inreases nsslapd-maxsasliosize nd nsslapd-sasl-max-buffer-size to 5000000. I got the same failure, but with larger numbers: [14/May/2026:09:28:48.090911293 +0000] - ERR - sasl_io_start_packet - SASL encrypted packet length exceeds maximum allowed limit (length=5000004, limit=5000000). Change the nsslapd-maxsasliosize attribute in cn=config to increase limit. So I tried again, this time increasing both nsslapd-maxsasliosize and nsslapd-sasl-max-buffer-size to 8000000. This time ipa-replica-install didn't fail. Instead, the initial replication never completed: # ipa-replica-install --setup-dns --auto-forwarder --setup-ca --setup-kra --dirsrv-config-file=custom.ldif [...] [28/42]: setting up initial replication Starting replication, please wait until this has completed. Update in progress, 2736 seconds elapsed^C [error] KeyboardInterrupt: The ipa-replica-install command failed. See /var/log/ipareplica-install.log for more information The last lines in the error log are: [14/May/2026:09:39:27.252987013 +0000] - NOTICE - NSMMReplicationPlugin - multisupplier_be_state_change - Replica dc=example,dc=com is going offline; disabling replication [14/May/2026:09:39:33.330868063 +0000] - ERR - dbmdb_import_writer - Failed to write in the database. Error is 0xffff87c3: MDB_BAD_VALSIZE: Unsupported size of key/DB name/data, or wrong DUPFIXED size. [14/May/2026:09:39:33.436983183 +0000] - ERR - dbmdb_import_monitor_threads - import userRoot: thread writer aborted ==> Aborting bulk import. [14/May/2026:09:39:33.442402509 +0000] - ERR - process_bulk_import_op - Failed; error = -1 [14/May/2026:09:39:33.445013557 +0000] - ERR - factory_destructor - ERROR bulk import abandoned: conn=6 was closed [14/May/2026:09:39:33.541001450 +0000] - INFO - dbmdb_import_monitor_threads - import userRoot: Workers finished; cleaning up... [14/May/2026:09:39:33.544698620 +0000] - INFO - dbmdb_import_monitor_threads - import userRoot: Workers cleaned up. [14/May/2026:09:39:33.546954292 +0000] - ERR - dbmdb_import_run_pass - import userRoot: Thread monitoring returned: -23 [14/May/2026:09:39:33.548828730 +0000] - ERR - dbmdb_public_dbmdb_import_main - import userRoot: Aborting all Import threads... [14/May/2026:09:39:33.550942484 +0000] - ERR - dbmdb_public_dbmdb_import_main - import userRoot: Import threads aborted. [14/May/2026:09:39:33.553024072 +0000] - INFO - dbmdb_public_dbmdb_import_main - import userRoot: Closing files... [14/May/2026:09:39:33.557336393 +0000] - ERR - dbmdb_public_dbmdb_import_main - import userRoot: Import failed. [14/May/2026:09:39:33.559553914 +0000] - INFO - dbmdb_task_finish - userRoot: Finished importing. Exit code is -23 At this point the dirsrv process is still running but does not respond to any connections: # timeout 5 ldapsearch -Y EXTERNAL -H ldapi://%2frun%2fslapd-EXAMPLE-COM.socket -s base -b cn=config; echo $? SASL/EXTERNAL authentication started 124 ... nor does it respond to SIGTERM, I have to send SIGKILL to kill it. Summing up: 1. Something in my directory causes LMDB to fail with this error. But I don't know how do debug this further. 2. I think dirsrv hanging after this error is a bug that I can file separately once I've got past the MDB_BAD_VALSIZE error. 3. My database isn't all that large; a dozen users, several dozen hosts and serviecs. I wonder if it's worth increasing the defaults values for nsslapd-maxsasliosize and nsslapd-sasl-max-buffer-size? Assuming the place to request this would be with 389-ds-base I can do that as well. I've done some very preliminary investigation of my directory to maybe see where the problem might be. Taking the LMDB error at face value, and looking at the sizes of the files in the userRoot backend: root@ipa6:~# ls -1sh /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/* --sort=s -r | tail 120K /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/krbPrincipalName.db 128K /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/nsuniqueid.db 168K /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/entryusn.db 360K /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/cn.db 368K /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/memberOf.db 616K /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/member.db 4.1M /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/entryrdn.db 15M /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/id2entry.db 16M /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/userCertificate.db 39M /var/lib/dirsrv/slapd-EXAMPLE-COM/db/userRoot/replication_changelog.db ... I've got a couple of ideas: * Maybe I've got too many userCertificate attributes, or one or more of them are too large? * One of my users had a 23 KiB jpegPhoto attribute which I have removed; however maybe it's still in the replication changelog and could therefore continue to cause problems? * It actually looks like <https://redhat.atlassian.net/browse/RHEL-133085> is this issue, in which case I should just wait for RHEL 10.2. As always any advice is appreciated! -- Sam Morris <https://robots.org.uk/> PGP: rsa4096/CAAA AA1A CA69 A83A 892B 1855 D20B 4202 5CDA 27B9 -- _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
