Hi Orion, That is a transient lock conflict (-12795 = DBI_RC_RETRY): a range search on the entryusn index collided with a concurrent write and gave up. On IPA this is common because the USN plugin updates that index on every write while SSSD reads it with "(entryUSN>=N)" refreshes.It is not corruption, so reindexing won't help; the failing searches are SSSD's background refreshes rather than per-user lookups. So, unless I miss something, the practical impact is delayed visibility of new entries during write bursts. It is a side effect of a recent change that made index scans transactional to fix a crash (#7125): scans now fail fast on a lock collision instead of risking cursor corruption, and the retry that absorbs those collisions was added for equality lookups (#7126) but was missing for range scans until #7670.
Tracked and fixed upstream (the range scan now retries like the equality path does): https://github.com/389ds/389-ds-base/issues/7670 Regards, Simon On Thu, Aug 13, 2026 at 8:52 AM Orion Poplawski via FreeIPA-users < [email protected]> wrote: > I've been starting to see these messages in some of our IPA servers: > > [08/Aug/2026:03:00:29.126842569 -0600] - ERR - idl_new_range_fetch - > Failed to > build range candidate list on entryusn index. Error is -12795 > [08/Aug/2026:03:00:29.128977448 -0600] - ERR - build_candidate_list - > Database > error -12795 > > Any idea what this means? Google came up empty. > > Orion > > -- > Orion Poplawski > he/him/his - surely the least important thing about me > Manager of IT Systems 720-772-5637 > NWRA, Boulder Office FAX: 303-415-9702 > 3380 Mitchell Lane [email protected] > Boulder, CO 80301 https://www.nwra.com/ > > -- > _______________________________________________ > FreeIPA-users mailing list -- [email protected] > To unsubscribe send an email to [email protected] > Fedora Code of Conduct: > https://docs.fedoraproject.org/en-US/project/code-of-conduct/ > List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines > List Archives: > https://lists.fedorahosted.org/archives/list/[email protected] > Do not reply to spam, report it: > https://forge.fedoraproject.org/infra/tickets/issues/new >
-- _______________________________________________ FreeIPA-users mailing list -- [email protected] To unsubscribe send an email to [email protected] Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/ List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines List Archives: https://lists.fedorahosted.org/archives/list/[email protected] Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new
