Re: [389-users] Replication hell - picking apart info/warning/error messages

2014-05-05 Thread Ludwig Krispenz
A generation ID is an id generated when the backend is created or when data from an ldif (without generation id) is imported. So when setting up an environment all servers have a different generation ID, to make replication work you need to choose one server and initialize all otheres from

Re: [389-users] Failed to send extended operation: LDAP error -1 (Can't contact LDAP server)

2014-05-05 Thread Graham Leggett
On 04 May 2014, at 9:35 PM, David Boreham david_l...@boreham.org wrote: It should be possible to add an N+1th replica to an N-node deployment. Replication agreements are peer-to-peer, so you just add a new replication agreement from each of the servers you want to feed changes to the N+1th

[389-users] bak2db script: how do you use it?

2014-05-05 Thread Graham Leggett
Hi all, I am now trying to make the initial replication happen manually through the restoration of a backup. This is also turning out to be strangely difficult. After backing up servera I have the following directory on serverc: [root@serverc ~]# ls -al /tmp/replicate/ total 16 drwx--. 4

[389-users] archive2db: Failed to read backup file set. Either the directory specified doesn't exist, or it exists but doesn't contain a valid backup set, or file permissions prevent the server readin

2014-05-05 Thread Graham Leggett
Hi all, I am now trying to use the bak2db.pl script in an effort to restore a backup as follows, and receive the error below. Can anyone point out what I am doing wrong? (I had to manually hack the bak2db.pl script to change the host to localhost, the script blindly assumes the box is

Re: [389-users] Failed to send extended operation: LDAP error -1 (Can't contact LDAP server)

2014-05-05 Thread Graham Leggett
On 05 May 2014, at 11:37 AM, Graham Leggett minf...@sharp.fm wrote: It should be possible to add an N+1th replica to an N-node deployment. Replication agreements are peer-to-peer, so you just add a new replication agreement from each of the servers you want to feed changes to the N+1th

Re: [389-users] Failed to send extended operation: LDAP error -1 (Can't contact LDAP server)

2014-05-05 Thread David Boreham
On 5/5/2014 3:37 AM, Graham Leggett wrote: What appears to be happening is that during the replication process, an LDAP operation that is accepted on servera is being rejected by serverc. The replication process is brittle, and has not been coded to handle any kind of error during the

Re: [389-users] Failed to send extended operation: LDAP error -1 (Can't contact LDAP server)

2014-05-05 Thread Rich Megginson
On 05/05/2014 08:55 AM, Graham Leggett wrote: On 05 May 2014, at 11:37 AM, Graham Leggett minf...@sharp.fm wrote: It should be possible to add an N+1th replica to an N-node deployment. Replication agreements are peer-to-peer, so you just add a new replication agreement from each of the

Re: [389-users] dsgw not checking passwords during auth

2014-05-05 Thread Rich Megginson
On 05/05/2014 07:34 AM, Ted Strother wrote: I have a web server running dsgw which is pointing at an ldap instance on another server in the config. Searches work fine, actions tht require auth work fine when the password was correct. When an incorrect password is entered it is still accepted, a

Re: [389-users] Failed to send extended operation: LDAP error -1 (Can't contact LDAP server)

2014-05-05 Thread David Boreham
On 5/5/2014 8:55 AM, Graham Leggett wrote: One of the objects being replicated is a large group containing about 21000 uniqueMembers. When it comes to replicate this object, the replication pauses for about 6 seconds or so, and at that point it times out, responding with the following

Re: [389-users] dsgw not checking passwords during auth

2014-05-05 Thread Ted Strother
An indication that the password was incorrect, as in another dsgw instance that we have (from back when it was netscape directory): Authentication Failed Authentication failed because the password you supplied is incorrect. Please click the Retry button and try again. If you have forgotten the

Re: [389-users] Failed to send extended operation: LDAP error -1 (Can't contact LDAP server)

2014-05-05 Thread Rich Megginson
On 05/05/2014 09:39 AM, David Boreham wrote: On 5/5/2014 9:24 AM, Rich Megginson wrote: See https://fedorahosted.org/389/ticket/47606 This bug looks quite consistent with the OP's symptoms and the presence of a large group entry, but he should be seeing Incoming BER Element was too long

Re: [389-users] dsgw not checking passwords during auth

2014-05-05 Thread Rich Megginson
On 05/05/2014 09:29 AM, Ted Strother wrote: An indication that the password was incorrect, as in another dsgw instance that we have (from back when it was netscape directory): Authentication Failed Authentication failed because the password you supplied is incorrect. Please click the Retry

Re: [389-users] Failed to send extended operation: LDAP error -1 (Can't contact LDAP server)

2014-05-05 Thread Graham Leggett
On 05 May 2014, at 5:39 PM, David Boreham david_l...@boreham.org wrote: See https://fedorahosted.org/389/ticket/47606 This bug looks quite consistent with the OP's symptoms and the presence of a large group entry, but he should be seeing Incoming BER Element was too long in the consumer

Re: [389-users] Failed to send extended operation: LDAP error -1 (Can't contact LDAP server)

2014-05-05 Thread David Boreham
On 5/5/2014 9:46 AM, Graham Leggett wrote: [05/May/2014:17:36:04 +0200] NSMMReplicationPlugin - agmt=cn=Agreement servera.example.com (servera:636): Replica has a different generation ID than the local data. I haven't the faintest clue what a generation ID is, how you set it, or what the

Re: [389-users] Failed to send extended operation: LDAP error -1 (Can't contact LDAP server)

2014-05-05 Thread Graham Leggett
On 05 May 2014, at 5:41 PM, Rich Megginson rmegg...@redhat.com wrote: See https://fedorahosted.org/389/ticket/47606 This bug looks quite consistent with the OP's symptoms and the presence of a large group entry, but he should be seeing Incoming BER Element was too long in the consumer log

Re: [389-users] Failed to send extended operation: LDAP error -1 (Can't contact LDAP server)

2014-05-05 Thread Mark Reynolds
On 05/05/2014 12:13 PM, Graham Leggett wrote: On 05 May 2014, at 5:41 PM, Rich Megginson rmegg...@redhat.com wrote: See https://fedorahosted.org/389/ticket/47606 This bug looks quite consistent with the OP's symptoms and the presence of a large group entry, but he should be seeing Incoming

Re: [389-users] Failed to send extended operation: LDAP error -1 (Can't contact LDAP server)

2014-05-05 Thread Rich Megginson
On 05/05/2014 10:13 AM, Graham Leggett wrote: On 05 May 2014, at 5:41 PM, Rich Megginson rmegg...@redhat.com wrote: See https://fedorahosted.org/389/ticket/47606 This bug looks quite consistent with the OP's symptoms and the presence of a large group entry, but he should be seeing Incoming

Re: [389-users] Failed to send extended operation: LDAP error -1 (Can't contact LDAP server)

2014-05-05 Thread Graham Leggett
On 04 May 2014, at 10:18 PM, Graham Leggett minf...@example.com wrote: We got ber_get_next failed for connection 2 without being told what exactly failed. Will dig on the other side to see if there are any clues. On the other side we see this: [04/May/2014:21:29:10 +0100]

Re: [389-users] Failed to send extended operation: LDAP error -1 (Can't contact LDAP server)

2014-05-05 Thread Graham Leggett
On 05 May 2014, at 6:18 PM, Mark Reynolds marey...@redhat.com wrote: nsslapd-maxbersize: 0 0 tells the server to use the default value of 2mb, you need to set it higher(5mb?). You're kidding. Zero actually means 2MB. Intuitive. I double checked servera and serverb, both have these set as

Re: [389-users] Failed to send extended operation: LDAP error -1 (Can't contact LDAP server)

2014-05-05 Thread Graham Leggett
On 05 May 2014, at 6:24 PM, Rich Megginson rmegg...@redhat.com wrote: I think the problem is this: [05/May/2014:17:34:41 +0200] - import userRoot: WARNING: Skipping entry nsuniqueid=---,o=Foo,c=ZA which has no parent, ending at line 18 of file

Re: [389-users] Failed to send extended operation: LDAP error -1 (Can't contact LDAP server)

2014-05-05 Thread Mark Reynolds
On 05/05/2014 12:46 PM, Graham Leggett wrote: On 05 May 2014, at 6:18 PM, Mark Reynolds marey...@redhat.com wrote: nsslapd-maxbersize: 0 0 tells the server to use the default value of 2mb, you need to set it higher(5mb?). You're kidding. Zero actually means 2MB. Intuitive. I agree, I don't

Re: [389-users] Failed to send extended operation: LDAP error -1 (Can't contact LDAP server)

2014-05-05 Thread Rich Megginson
On 05/05/2014 10:49 AM, Graham Leggett wrote: On 05 May 2014, at 6:24 PM, Rich Megginson rmegg...@redhat.com wrote: I think the problem is this: [05/May/2014:17:34:41 +0200] - import userRoot: WARNING: Skipping entry nsuniqueid=---,o=Foo,c=ZA which has no