Re: [Freeipa-users] SSSD Child not responding
On Tue, Jan 12, 2016 at 10:59:28AM -0700, Sean Hogan wrote: > > Hi Jakub, > > I changed the DNS server in resolv.conf to a closer IPA server and it > seems to be stable now. If it bombs out again I will get more info but > right now I don't think we will see anything. Hmm, maybe some of the DNS-related operations like GSSAPI binds were blocking the sssd for too long.. > > > I also found this though from yesterday > > /var/log/sssd/check# cat sssd_watson.local.log.1 > (Mon Jan 11 22:43:40 2016) [sssd[be[watson.local]]] [id_callback] (0x0010): > The Monitor returned an error [org.freedesktop.DBus.Error.NoReply] > > > Sean Hogan > Security Engineer > Watson Security & Risk Assurance > Watson Cloud Technology and Support > email: scho...@us.ibm.com | Tel 919 486 1397 > > > > > > > > > > From: Jakub Hrozek <jhro...@redhat.com> > To: freeipa-users@redhat.com > Date: 01/12/2016 09:46 AM > Subject: Re: [Freeipa-users] SSSD Child not responding > Sent by: freeipa-users-boun...@redhat.com > > > > On Tue, Jan 12, 2016 at 09:06:36AM -0700, Sean Hogan wrote: > > > > > > Hi all, > > > >Over the past couple of months we have been seeing the sssd process > eat > > up 100% cpu and not allowing anyone to log on. Krb5.conf is set for DNS > > discovery, RHEL 6.6. If we kill the java process it clears up the box > and > > able to log back into it. This is due to IBM java ibmjgssprovider.jar > but > > fixes for that are in place. What we do see in the sssd.log is below .. > > has anyone seen this before? > > > > SSSD enumerate is set to false, 120 timeout > > Can you get a pstack of the child that is not responding? > > -- > Manage your subscription for the Freeipa-users mailing list: > https://www.redhat.com/mailman/listinfo/freeipa-users > Go to http://freeipa.org for more info on the project > > > -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project
Re: [Freeipa-users] SSSD Child not responding
Hi Jakub, I changed the DNS server in resolv.conf to a closer IPA server and it seems to be stable now. If it bombs out again I will get more info but right now I don't think we will see anything. I also found this though from yesterday /var/log/sssd/check# cat sssd_watson.local.log.1 (Mon Jan 11 22:43:40 2016) [sssd[be[watson.local]]] [id_callback] (0x0010): The Monitor returned an error [org.freedesktop.DBus.Error.NoReply] Sean Hogan Security Engineer Watson Security & Risk Assurance Watson Cloud Technology and Support email: scho...@us.ibm.com | Tel 919 486 1397 From: Jakub Hrozek <jhro...@redhat.com> To: freeipa-users@redhat.com Date: 01/12/2016 09:46 AM Subject: Re: [Freeipa-users] SSSD Child not responding Sent by:freeipa-users-boun...@redhat.com On Tue, Jan 12, 2016 at 09:06:36AM -0700, Sean Hogan wrote: > > > Hi all, > >Over the past couple of months we have been seeing the sssd process eat > up 100% cpu and not allowing anyone to log on. Krb5.conf is set for DNS > discovery, RHEL 6.6. If we kill the java process it clears up the box and > able to log back into it. This is due to IBM java ibmjgssprovider.jar but > fixes for that are in place. What we do see in the sssd.log is below .. > has anyone seen this before? > > SSSD enumerate is set to false, 120 timeout Can you get a pstack of the child that is not responding? -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project
Re: [Freeipa-users] SSSD Child not responding
On Tue, Jan 12, 2016 at 09:06:36AM -0700, Sean Hogan wrote: > > > Hi all, > >Over the past couple of months we have been seeing the sssd process eat > up 100% cpu and not allowing anyone to log on. Krb5.conf is set for DNS > discovery, RHEL 6.6. If we kill the java process it clears up the box and > able to log back into it. This is due to IBM java ibmjgssprovider.jar but > fixes for that are in place. What we do see in the sssd.log is below .. > has anyone seen this before? > > SSSD enumerate is set to false, 120 timeout Can you get a pstack of the child that is not responding? -- Manage your subscription for the Freeipa-users mailing list: https://www.redhat.com/mailman/listinfo/freeipa-users Go to http://freeipa.org for more info on the project
