Unfortunately I can't really say what exactly it was -  all of this dups 
already gone by almost every IPA replica's re-initializing.
But it definitely was related to heavy load due to debug mode. The system 
itself was working as usual - a lot of this domain enrolled servers served 
users logins and so on, nothing special. Heavy loaded IPA servers while they 
was in debug mode failed to authenticate users, so sssd on clients have to use 
secondary servers.

Our IPA/IdM system currently in limited production state, so we cannot repeat 
this conditions to test what exactly happened.
I'm sorry for being useless now to explore the problem :(

WBR,
Alexander Frolushkin
Cell +79232508764
Work +79232507764

From: thierry bordaz [mailto:tbor...@redhat.com]
Sent: Tuesday, June 23, 2015 2:51 PM
To: Alexander Frolushkin (SIB)
Cc: Tamas Papp; 'Christoph Kaminski'; freeipa-users@redhat.com
Subject: Re: [Freeipa-users] Antwort: Re: Antwort: clean-run doesn't work

Hi Alexander,

This is mainly replication logging. Having many instances will increase the 
amount of logging especially if you have updates.
To create duplicate you are doing ADD in parallele of the same dn on differents 
servers. Do you what creates this ADD load ?
Can you see MODs/DELs ?

thanks
thierry
On 06/23/2015 06:01 AM, Alexander Frolushkin wrote:
Hello.
We have 19 RHEL 7.1 IPA (ipa-server-4.1.0-18.el7_1.3.x86_64) servers.
Debug level was changed this way on 4 of them:
dn: cn=config
changetype: modify
replace: nsslapd-errorlog-level
nsslapd-errorlog-level:24576
-
replace: nsslapd-accesslog-level
nsslapd-accesslog-level:256
EOF

After this, IO was increased significally.
Two of servers hangs after some time, a lot of dups appears on most IPA servers 
in domain.


WBR,
Alexander Frolushkin
Cell +79232508764
Work +79232507764

From: thierry bordaz [mailto:tbor...@redhat.com]
Sent: Monday, June 22, 2015 6:21 PM
To: Tamas Papp
Cc: Alexander Frolushkin (SIB); 'Christoph Kaminski'; 
freeipa-users@redhat.com<mailto:freeipa-users@redhat.com>
Subject: Re: [Freeipa-users] Antwort: Re: Antwort: clean-run doesn't work

On 06/22/2015 11:50 AM, Tamas Papp wrote:
Fascinating.

Can you Red Hat guys reproduce this in you test environment?

Most of my tests are on RHEV with RHEL 7.1, I have not seen a crash of DS.
About the test case, you installed a server+replicas (version ?), then turn on 
errorlog-level (do you remember what level).
That would slow down the DS instance and fill errors log.
Then you hit extremely frequently a crash. Do you remember what kind of the 
load search/mod/add/del ?

thanks
thierry



Thanks,
tamas
On 06/22/2015 11:42 AM, Alexander Frolushkin wrote:
Hello everyone.
I can confirm this on VMWare, recently we have the similar issue when enabled 
dirsrv debug on 4 of our 19 IPA servers :(

WBR,
Alexander Frolushkin
Cell +79232508764
Work +79232507764

From: freeipa-users-boun...@redhat.com<mailto:freeipa-users-boun...@redhat.com> 
[mailto:freeipa-users-boun...@redhat.com] On Behalf Of Christoph Kaminski
Sent: Monday, June 22, 2015 2:50 PM
To: Tamas Papp
Cc: freeipa-users@redhat.com<mailto:freeipa-users@redhat.com>
Subject: [Freeipa-users] Antwort: Re: Antwort: clean-run doesn't work

>
> In my particular case I'm interested, whether it can crash servers.
> Does it for you? I don't see it in that thread.
>
> tamas

yes... we has had a really often a crash on virtual machines installations. On 
bare metal we had 2-3x a crash.

That was the reason for us to destroy all IPA VM's. There seems to be an IO 
issue on VM's with IPA (rhev virtualisation here). You can see it extremly if 
you turn the debug level higher.

Greetz

________________________________

Информация в этом сообщении предназначена исключительно для конкретных лиц, 
которым она адресована. В сообщении может содержаться конфиденциальная 
информация, которая не может быть раскрыта или использована кем-либо, кроме 
адресатов. Если вы не адресат этого сообщения, то использование, переадресация, 
копирование или распространение содержания сообщения или его части незаконно и 
запрещено. Если Вы получили это сообщение ошибочно, пожалуйста, незамедлительно 
сообщите отправителю об этом и удалите со всем содержимым само сообщение и 
любые возможные его копии и приложения.

The information contained in this communication is intended solely for the use 
of the individual or entity to whom it is addressed and others authorized to 
receive it. It may contain confidential or legally privileged information. The 
contents may not be disclosed or used by anyone other than the addressee. If 
you are not the intended recipient(s), any use, disclosure, copying, 
distribution or any action taken or omitted to be taken in reliance on it is 
prohibited and may be unlawful. If you have received this communication in 
error please notify us immediately by responding to this email and then delete 
the e-mail and all attachments and any copies thereof.

(c)20mf50






________________________________

Информация в этом сообщении предназначена исключительно для конкретных лиц, 
которым она адресована. В сообщении может содержаться конфиденциальная 
информация, которая не может быть раскрыта или использована кем-либо, кроме 
адресатов. Если вы не адресат этого сообщения, то использование, переадресация, 
копирование или распространение содержания сообщения или его части незаконно и 
запрещено. Если Вы получили это сообщение ошибочно, пожалуйста, незамедлительно 
сообщите отправителю об этом и удалите со всем содержимым само сообщение и 
любые возможные его копии и приложения.

The information contained in this communication is intended solely for the use 
of the individual or entity to whom it is addressed and others authorized to 
receive it. It may contain confidential or legally privileged information. The 
contents may not be disclosed or used by anyone other than the addressee. If 
you are not the intended recipient(s), any use, disclosure, copying, 
distribution or any action taken or omitted to be taken in reliance on it is 
prohibited and may be unlawful. If you have received this communication in 
error please notify us immediately by responding to this email and then delete 
the e-mail and all attachments and any copies thereof.

(c)20mf50


________________________________

Информация в этом сообщении предназначена исключительно для конкретных лиц, 
которым она адресована. В сообщении может содержаться конфиденциальная 
информация, которая не может быть раскрыта или использована кем-либо, кроме 
адресатов. Если вы не адресат этого сообщения, то использование, переадресация, 
копирование или распространение содержания сообщения или его части незаконно и 
запрещено. Если Вы получили это сообщение ошибочно, пожалуйста, незамедлительно 
сообщите отправителю об этом и удалите со всем содержимым само сообщение и 
любые возможные его копии и приложения.

The information contained in this communication is intended solely for the use 
of the individual or entity to whom it is addressed and others authorized to 
receive it. It may contain confidential or legally privileged information. The 
contents may not be disclosed or used by anyone other than the addressee. If 
you are not the intended recipient(s), any use, disclosure, copying, 
distribution or any action taken or omitted to be taken in reliance on it is 
prohibited and may be unlawful. If you have received this communication in 
error please notify us immediately by responding to this email and then delete 
the e-mail and all attachments and any copies thereof.

(c)20mf50
-- 
Manage your subscription for the Freeipa-users mailing list:
https://www.redhat.com/mailman/listinfo/freeipa-users
Go to http://freeipa.org for more info on the project

Reply via email to