New subject: Directory service stop and won't stay up when restarted

24 Nov 2017

I believe I found the root cause.There are replication conflicts.

ldapsearch -x -D "cn=directory manager" -w password -b
"dc=ipa,dc=domain,dc=com" "nsds5ReplConflict=*" \* nsds5ReplConflict

# extended LDIF
#
# LDAPv3
# base <dc=ipa,dc=domain,dc=com> with scope subtree
# filter: nsds5ReplConflict=*
# requesting: * nsds5ReplConflict
#

# oldipaserver + b4066f9e-cf0b11e7-9ad4d14c-07041c4f,
ipa.domain.com <http://ipa.domain.com>., dns, t
enant.domain.com <http://enant.domain.com>
dn:
idnsName=oldipaserver+nsuniqueid=b4066f9e-cf0b11e7-9ad4d14c-07041c4f,id
 nsname=ipa.domain.com
<http://ipa.domain.com>.,cn=dns,dc=ipa,dc=domain,dc=com
idnsName: oldipaserver
objectClass: idnsRecord
objectClass: top
aRecord: 10.28.247.230
sSHFPRecord: 1 1 D179038D4D2918411C32C2E6052CBB561050EA48
sSHFPRecord: 1 2
78E7197543306DDA840AFF07296F66CBDA5BCC35A06E7A2E5229FC43 F28A
 E7EF
sSHFPRecord: 3 1 8C9BF123F46F8F65507059F1CE670589B8A7B84A
sSHFPRecord: 3 2
B60CE25FE4DB91975EB9055CADE6FF203F1154C6406B5DA6177659DF B88F
 0E46
sSHFPRecord: 4 1 2FF7427DE66D360644E2901930F9CA105D47C33F
sSHFPRecord: 4 2
98C424319EFF9D8EC8DFD12BB13286FC99F6006873D86739E2AA4A55 4C46
 0E04
dNSTTL: 1200
nsds5ReplConflict: namingConflict
idnsName=oldipaserver,idnsname=ipa.domain
 .com.,cn=dns,dc=ipa,dc=domain,dc=com

# HTTP/oldipaserver.ipa.domain.com@ipa.domain.com
<mailto:oldipaserver.ipa.domain.com@ipa.domain.com> +
aa37478f-cfb111e7-9ad4d14c
 -07041c4f, services, accounts, ipa.domain.com <http://ipa.domain.com>
dn:
krbprincipalname=HTTP/oldipaserver.ipa.domain.com@ipa.domain.com
<mailto:oldipaserver.ipa.domain.com@ipa.domain.com>+nsunique
 id=aa37478f-cfb111e7-9ad4d14c-07041c4f,cn=services,cn=accounts,dc=ipa,dc=y
 cs,dc=com
ipaUniqueID: c0db959a-cfb1-11e7-8ca5-0050568cb5f0
krbPrincipalName: HTTP/oldipaserver.ipa.domain.com@ipa.domain.com
<mailto:oldipaserver.ipa.domain.com@ipa.domain.com>
managedBy: fqdn=oldipaserver.ipa.domain.com
<http://oldipaserver.ipa.domain.com>,cn=computers,cn=accounts,dc=tena
 nt,dc=domain,dc=com
krbCanonicalName: HTTP/oldipaserver.ipa.domain.com@ipa.domain.com
<mailto:oldipaserver.ipa.domain.com@ipa.domain.com>
ipaKrbPrincipalAlias:
HTTP/oldipaserver.ipa.domain.com@ipa.domain.com
<mailto:oldipaserver.ipa.domain.com@ipa.domain.com>
objectClass: krbprincipal
objectClass: krbprincipalaux
objectClass: krbticketpolicyaux
objectClass: ipaobject
objectClass: ipaservice
objectClass: pkiuser
objectClass: ipakrbprincipal
objectClass: top
userCertificate::
MIIE4zCCA8ugAwIBAgIBFzANBgkqhkiG9w0BAQsFADA4MRYwFAYDVQQKEw1U
RU5BTlQuWUNTLklPMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTcxMTIyMTgyM
DAxWhcNMTkxMTIzMTgyMDAxWjBAMRYwFAYDVQQKDA1URU5BTlQuWUNTLklPMSYwJAYDVQQDDB1tbz
ItdG50LWlwYS0wMDEudGVuYW50Lnljcy5pbzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggE
 BAO9EpY9mT/Z4aA4wWse7rak2/Mh0qcAJHK3u5+SEq5eu70b7XAz/ivSOfn4Q/DJW0jJS03GxLCIC
NUAMzNINnkhuboKceNL1QDz41Bo19tyujhEQlJcdQVa6K0OM7YuKtsXfhI8g8wrcj53YVJailfoSS
 iDmvvg/xNJ9P/6WvmvSNZyf7UkXdEM/lAkjEakqM1FPQN1lk/PB10pV6lZzzXSpBCbAU1GuV+srj6
 zimvOS/WAgv2cG+iE0mDlfBnW+kqTd/qe5vW914oI4i1x5aLncMkNHsCDzNOBL05UV+Ry/3Un4pdi
ZQCZU1BCKSy7hwhu0SgsI5hk5IPte6/aVG8ECAwEAAaOCAe4wggHqMB8GA1UdIwQYMBaAFNiWa54L
yD1nOFo3rjT6SNTGuZfgMD8GCCsGAQUFBwEBBDMwMTAvBggrBgEFBQcwAYYjaHR0cDovL2lwYS1jY
S50ZW5hbnQueWNzLmlvL2NhL29jc3AwDgYDVR0PAQH/BAQDAgTwMB0GA1UdJQQWMBQGCCsGAQUFBw
MBBggrBgEFBQcDAjB4BgNVHR8EcTBvMG2gNaAzhjFodHRwOi8vaXBhLWNhLnRlbmFudC55Y3MuaW8
vaXBhL2NybC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcGFjYTEeMBwGA1UEAwwVQ2Vy
dGlmaWNhdGUgQXV0aG9yaXR5MB0GA1UdDgQWBBTsjF87tMtQQRowrXaotHV5vErhxjCBvQYDVR0RB
IG1MIGygh1tbzItdG50LWlwYS0wMDEudGVuYW50Lnljcy5pb6BABgorBgEEAYI3FAIDoDIMMEhUVF
AvbW8yLXRudC1pcGEtMDAxLnRlbmFudC55Y3MuaW9AVEVOQU5ULllDUy5JT6BPBgYrBgEFAgKgRTB
 DoA8bDVRFTkFOVC5ZQ1MuSU+hMDAuoAMCAQGhJzAlGwRIVFRQGx1tbzItdG50LWlwYS0wMDEudGVu
YW50Lnljcy5pbzANBgkqhkiG9w0BAQsFAAOCAQEAmclabyeU4abixWIv6f6gCRgmXdwBzkvAjTxXP
jfE6ZMwQUFYaoD71j3AxrPJMHnqtYDvPKkr5vkp0qn8ErxjWEBkFH57q0a8z8bwp9enKL4wTALKrc
 NoGr0jCLdzR3RWK3+71ITXmWxb1AUsHFq5nuxktKaJC/5QKNQu2REZSscFlbBvI8gema9cjUm0eQ0
iwmSRSPagBWpYowj5eYV6oZBxRR4gtY3QoUKzWelAqPdkqvbF0u96uKfxET/crEqGGwJdA7xqLm8g
 S655zkM9b/++exlEFCp2cIxbP51Pinli+FRAQv9Bd75DxrXO6FzAU7UfjChzTSfk3LRwpWG8aA==
krbPwdPolicyReference: cn=Default Service Password
Policy,cn=services,cn=accou
 nts,dc=ipa,dc=domain,dc=com
nsds5ReplConflict: namingConflict
krbprincipalname=HTTP/oldipaserver.ipa
 .domain.com@ipa.domain.com
<mailto:domain.com@ipa.domain.com>,cn=services,cn=accounts,dc=ipa,dc=domain,dc=com

# HTTP/ipaserver002.ipa.domain.com@ipa.domain.com
<mailto:ipaserver002.ipa.domain.com@ipa.domain.com> +
691465b4-d08d11e7-9ad4d14c
 -07041c4f, services, accounts, ipa.domain.com <http://ipa.domain.com>
dn:
krbprincipalname=HTTP/ipaserver002.ipa.domain.com@ipa.domain.com
<mailto:ipaserver002.ipa.domain.com@ipa.domain.com>+nsunique
 id=691465b4-d08d11e7-9ad4d14c-07041c4f,cn=services,cn=accounts,dc=ipa,dc=y
 cs,dc=com
ipaUniqueID: 8d595d9c-d08d-11e7-9954-0050568cb5f0
krbPrincipalName: HTTP/ipaserver002.ipa.domain.com@ipa.domain.com
<mailto:ipaserver002.ipa.domain.com@ipa.domain.com>
managedBy: fqdn=ipaserver002.ipa.domain.com
<http://ipaserver002.ipa.domain.com>,cn=computers,cn=accounts,dc=tena
 nt,dc=domain,dc=com
krbCanonicalName: HTTP/ipaserver002.ipa.domain.com@ipa.domain.com
<mailto:ipaserver002.ipa.domain.com@ipa.domain.com>
ipaKrbPrincipalAlias:
HTTP/ipaserver002.ipa.domain.com@ipa.domain.com
<mailto:ipaserver002.ipa.domain.com@ipa.domain.com>
objectClass: krbprincipal
objectClass: krbprincipalaux
objectClass: krbticketpolicyaux
objectClass: ipaobject
objectClass: ipaservice
objectClass: pkiuser
objectClass: ipakrbprincipal
objectClass: top
userCertificate::
MIIE4zCCA8ugAwIBAgIBGjANBgkqhkiG9w0BAQsFADA4MRYwFAYDVQQKEw1U
RU5BTlQuWUNTLklPMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTcxMTIzMjAzM
zI0WhcNMTkxMTI0MjAzMzI0WjBAMRYwFAYDVQQKDA1URU5BTlQuWUNTLklPMSYwJAYDVQQDDB1tbz
ItdG50LWlwYS0wMDIudGVuYW50Lnljcy5pbzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggE
BALsH9D9LIvvzYThtahRAT3E8QvkZLe/SbMU0P52vC4BVoTCCOYDLo6jCTBd925u0zId20hJx71nC
9wchvP3BLA0JexS8bh7U64u5CSTfLK9EPgsHqJgVve0Jz35KFhgcnOP8GqXvdtu1efMJL0hR4/U50
 lftEZdy5cm/TSrJL/DncZ1Srl7hHgYIjRIQ5R8S/Axw5zE3eGd8+WsAVB5gqq4fOLUUsQp88ImUES
 oYtHHJ1O9s5N/Hz9AAy+TdcKRDj+EEIxoQNUsOms8H7dG6/wFRTb6mq2NBGT9sf2xBW+iUqoKGe0E
kd273xqUGbUyJKuhrGRgHnyrai9G27YqulSsCAwEAAaOCAe4wggHqMB8GA1UdIwQYMBaAFNiWa54L
yD1nOFo3rjT6SNTGuZfgMD8GCCsGAQUFBwEBBDMwMTAvBggrBgEFBQcwAYYjaHR0cDovL2lwYS1jY
S50ZW5hbnQueWNzLmlvL2NhL29jc3AwDgYDVR0PAQH/BAQDAgTwMB0GA1UdJQQWMBQGCCsGAQUFBw
MBBggrBgEFBQcDAjB4BgNVHR8EcTBvMG2gNaAzhjFodHRwOi8vaXBhLWNhLnRlbmFudC55Y3MuaW8
vaXBhL2NybC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcGFjYTEeMBwGA1UEAwwVQ2Vy
dGlmaWNhdGUgQXV0aG9yaXR5MB0GA1UdDgQWBBSsrJU7LDvxTAIbOe1JFI7r6PAcbzCBvQYDVR0RB
IG1MIGygh1tbzItdG50LWlwYS0wMDIudGVuYW50Lnljcy5pb6BABgorBgEEAYI3FAIDoDIMMEhUVF
AvbW8yLXRudC1pcGEtMDAyLnRlbmFudC55Y3MuaW9AVEVOQU5ULllDUy5JT6BPBgYrBgEFAgKgRTB
 DoA8bDVRFTkFOVC5ZQ1MuSU+hMDAuoAMCAQGhJzAlGwRIVFRQGx1tbzItdG50LWlwYS0wMDIudGVu
YW50Lnljcy5pbzANBgkqhkiG9w0BAQsFAAOCAQEAYcv6z2MlwgDOrcF9HHTpQ1e1Xo+aR1kUfyF53
mWTG5FYJ3BJZz00NhzRr16xfs83eFJ6comcJfujQweD2Ojy7d4oMMYDb85+Am132FgpT5V9rcuMenh
 bmAxwXq/7rXZNJzlni+TcPPpHXKgAkdCep+IKrul6r1Ugykj8mWKl2K/+VJaXt9vCZVZUd5G911lu
kLbdFhNLWCkH8ye0WtibOstYi3blSkc3QGt4gCSf0uAe1OiTKMPqpz+uu8rGRpN8bMVmha5JlbE3F
 2zEIbP5xjA2sztPeVOBN+YNn6yi7kmhJAgCpMISQ14G5os7ZIrPtNIs9o7BRIrgOuV6W62UuEw==
krbPwdPolicyReference: cn=Default Service Password
Policy,cn=services,cn=accou
 nts,dc=ipa,dc=domain,dc=com
nsds5ReplConflict: namingConflict
krbprincipalname=HTTP/ipaserver002.ipa
 .domain.com@ipa.domain.com
<mailto:domain.com@ipa.domain.com>,cn=services,cn=accounts,dc=ipa,dc=domain,dc=com

# HTTP/ipaserver001.ipa.domain.com@ipa.domain.com
<mailto:ipaserver001.ipa.domain.com@ipa.domain.com> +
f960b202-d14211e7-965fca1d
 -506f74cb, services, accounts, ipa.domain.com <http://ipa.domain.com>
dn:
krbprincipalname=HTTP/ipaserver001.ipa.domain.com@ipa.domain.com
<mailto:ipaserver001.ipa.domain.com@ipa.domain.com>+nsunique
 id=f960b202-d14211e7-965fca1d-506f74cb,cn=services,cn=accounts,dc=ipa,dc=y
 cs,dc=com
ipaUniqueID: fe68c03a-d142-11e7-b3c2-0050569a7366
krbPrincipalName: HTTP/ipaserver001.ipa.domain.com@ipa.domain.com
<mailto:ipaserver001.ipa.domain.com@ipa.domain.com>
managedBy: fqdn=ipaserver001.ipa.domain.com
<http://ipaserver001.ipa.domain.com>,cn=computers,cn=accounts,dc=tena
 nt,dc=domain,dc=com
krbCanonicalName: HTTP/ipaserver001.ipa.domain.com@ipa.domain.com
<mailto:ipaserver001.ipa.domain.com@ipa.domain.com>
ipaKrbPrincipalAlias:
HTTP/ipaserver001.ipa.domain.com@ipa.domain.com
<mailto:ipaserver001.ipa.domain.com@ipa.domain.com>
objectClass: krbprincipal
objectClass: krbprincipalaux
objectClass: krbticketpolicyaux
objectClass: ipaobject
objectClass: ipaservice
objectClass: pkiuser
objectClass: ipakrbprincipal
objectClass: top
userCertificate::
MIIE5jCCA86gAwIBAgIED/0ABTANBgkqhkiG9w0BAQsFADA4MRYwFAYDVQQK
Ew1URU5BTlQuWUNTLklPMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTcxMTI0M
TgxMjEyWhcNMTkxMTI1MTgxMjEyWjBAMRYwFAYDVQQKDA1URU5BTlQuWUNTLklPMSYwJAYDVQQDDB
1ybzEtdG50LWlwYS0wMDEudGVuYW50Lnljcy5pbzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQo
 CggEBAOE+S90kJ+1zq0Ray0rOYZQn2Rve+Loi8Jy65UUR93CD8XrjHcptPOl3Nha7OM4vodABHgEH
 2by8Qzza4FZkIvE+HbPqsHVATPcU9/WBsbXcCY5f1oD4vnu/Crzc9QYRJrMCoukELLVW7EntPVfZv
 4/TXDIwE5BDiu4b623+JPjZ0sqHyUCKjcWiIexkp0c9TyeV3m1yYTzhA7TXxhCtgkhZCaPRnDFU8G
NBy3upl1ethbPv65e4zwWAniulmIzpZ8jlMLbzeErTXbxAP2vaxpANJHRepd3hexCNRBpO+nOIHAj
 GSdiJhN/JpFS1g6ldTeI+rMxv0hqRQgUiC9CCxgkCAwEAAaOCAe4wggHqMB8GA1UdIwQYMBaAFNiW
a54LyD1nOFo3rjT6SNTGuZfgMD8GCCsGAQUFBwEBBDMwMTAvBggrBgEFBQcwAYYjaHR0cDovL2lwY
S1jYS50ZW5hbnQueWNzLmlvL2NhL29jc3AwDgYDVR0PAQH/BAQDAgTwMB0GA1UdJQQWMBQGCCsGAQ
UFBwMBBggrBgEFBQcDAjB4BgNVHR8EcTBvMG2gNaAzhjFodHRwOi8vaXBhLWNhLnRlbmFudC55Y3M
uaW8vaXBhL2NybC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcGFjYTEeMBwGA1UEAwwV
Q2VydGlmaWNhdGUgQXV0aG9yaXR5MB0GA1UdDgQWBBQW9TaRJG4IdTlAkGGOleOAqYIL3TCBvQYDV
R0RBIG1MIGygh1ybzEtdG50LWlwYS0wMDEudGVuYW50Lnljcy5pb6BABgorBgEEAYI3FAIDoDIMME
hUVFAvcm8xLXRudC1pcGEtMDAxLnRlbmFudC55Y3MuaW9AVEVOQU5ULllDUy5JT6BPBgYrBgEFAgK
 gRTBDoA8bDVRFTkFOVC5ZQ1MuSU+hMDAuoAMCAQGhJzAlGwRIVFRQGx1ybzEtdG50LWlwYS0wMDEu
dGVuYW50Lnljcy5pbzANBgkqhkiG9w0BAQsFAAOCAQEAeEtevJdlJK/EkMeE4lUFk5eMX/uhu8Ewr
RZDpnpqMIp776QH64qiJTc4ZcA0ggrNePb1T92TLcOo4wW9N7Ih6/sgj7zhGS62EfzhRPsMoJayZh
ZhPHkqFEI9UsVKMayBZTnvAB8pgkrmumh7S2rgp4alUSGSPhRMQ2GWEvI8554F2bF4q0wAl0S/qNX
UdFtS76W2OATcZZyYL8ufQfYo6tcFyFTl6KiMPtP8jKi6v3pDjVCR1eHK0YKswBaHCsl9Wlzlnz9U
 Xbt9a/d0x+c1RO9sRkD4RbCQVaWgdlTyllsH66/J9QtG1AbFFidPt8JtxkOXjZ3J9oi/tiLoMUN5i
 A==
krbPwdPolicyReference: cn=Default Service Password
Policy,cn=services,cn=accou
 nts,dc=ipa,dc=domain,dc=com
nsds5ReplConflict: namingConflict
krbprincipalname=http/ipaserver001.ipa
 .domain.com@ipa.domain.com
<mailto:domain.com@ipa.domain.com>,cn=services,cn=accounts,dc=ipa,dc=domain,dc=com

# HTTP/ipaserver003.ipa.domain.com@ipa.domain.com
<mailto:ipaserver003.ipa.domain.com@ipa.domain.com> +
5fffd19d-d21011e7-9ad4d14c
 -07041c4f, services, accounts, ipa.domain.com <http://ipa.domain.com>
dn:
krbprincipalname=HTTP/ipaserver003.ipa.domain.com@ipa.domain.com
<mailto:ipaserver003.ipa.domain.com@ipa.domain.com>+nsunique
 id=5fffd19d-d21011e7-9ad4d14c-07041c4f,cn=services,cn=accounts,dc=ipa,dc=y
 cs,dc=com
ipaUniqueID: 78d35f24-d210-11e7-b055-0050568cb5f0
krbPrincipalName: HTTP/ipaserver003.ipa.domain.com@ipa.domain.com
<mailto:ipaserver003.ipa.domain.com@ipa.domain.com>
managedBy: fqdn=ipaserver003.ipa.domain.com
<http://ipaserver003.ipa.domain.com>,cn=computers,cn=accounts,dc=tena
 nt,dc=domain,dc=com
krbCanonicalName: HTTP/ipaserver003.ipa.domain.com@ipa.domain.com
<mailto:ipaserver003.ipa.domain.com@ipa.domain.com>
ipaKrbPrincipalAlias:
HTTP/ipaserver003.ipa.domain.com@ipa.domain.com
<mailto:ipaserver003.ipa.domain.com@ipa.domain.com>
objectClass: krbprincipal
objectClass: krbprincipalaux
objectClass: krbticketpolicyaux
objectClass: ipaobject
objectClass: ipaservice
objectClass: pkiuser
objectClass: ipakrbprincipal
objectClass: top
userCertificate::
MIIE4zCCA8ugAwIBAgIBHjANBgkqhkiG9w0BAQsFADA4MRYwFAYDVQQKEw1U
RU5BTlQuWUNTLklPMR4wHAYDVQQDExVDZXJ0aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTcxMTI1MTg0M
zA0WhcNMTkxMTI2MTg0MzA0WjBAMRYwFAYDVQQKDA1URU5BTlQuWUNTLklPMSYwJAYDVQQDDB1ybz
EtdG50LWlwYS0wMDMudGVuYW50Lnljcy5pbzCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggE
 BANFhBMKFTE4xsmcld+NTEDgr5RyeHiQoVi695Lxh7LmT9ccBNPtZG6/4sceGQpcyJpdoZTFMxrFp
97ZgfZwtT09uJxGtTIHVFctGRACm5E4+NlW2MCSwsod9OXH4P8QTCMdAapmMWynKnFx+B3v7TJfES
 7WRP7GkcHofFSVtN3X1bUpfk4Co+1mDV85q7QFTmPaMzcREWmCr+DCwG3cy+YZDIbsih07FkJeaTy
 lzIXvOEbQ7UaoZtMndH+8D/E4VboCV1x0Is0bjuCQqFcEiIQBgBHTPtXkMA5we+ZK4tsUgl1A0As7
Df1oFlISnj2JwrkX6Ox8y7acIPOgnD6ecxesCAwEAAaOCAe4wggHqMB8GA1UdIwQYMBaAFNiWa54L
yD1nOFo3rjT6SNTGuZfgMD8GCCsGAQUFBwEBBDMwMTAvBggrBgEFBQcwAYYjaHR0cDovL2lwYS1jY
S50ZW5hbnQueWNzLmlvL2NhL29jc3AwDgYDVR0PAQH/BAQDAgTwMB0GA1UdJQQWMBQGCCsGAQUFBw
MBBggrBgEFBQcDAjB4BgNVHR8EcTBvMG2gNaAzhjFodHRwOi8vaXBhLWNhLnRlbmFudC55Y3MuaW8
vaXBhL2NybC9NYXN0ZXJDUkwuYmluojSkMjAwMQ4wDAYDVQQKDAVpcGFjYTEeMBwGA1UEAwwVQ2Vy
dGlmaWNhdGUgQXV0aG9yaXR5MB0GA1UdDgQWBBSazpOqyaJc6zL8ZCqZLPIsmpT91jCBvQYDVR0RB
IG1MIGygh1ybzEtdG50LWlwYS0wMDMudGVuYW50Lnljcy5pb6BABgorBgEEAYI3FAIDoDIMMEhUVF
Avcm8xLXRudC1pcGEtMDAzLnRlbmFudC55Y3MuaW9AVEVOQU5ULllDUy5JT6BPBgYrBgEFAgKgRTB
 DoA8bDVRFTkFOVC5ZQ1MuSU+hMDAuoAMCAQGhJzAlGwRIVFRQGx1ybzEtdG50LWlwYS0wMDMudGVu
YW50Lnljcy5pbzANBgkqhkiG9w0BAQsFAAOCAQEAVlKBrfmIUBVU129Dd96328+nBRAmQhEcs5//Y
 C4uF5AQ7a54f9kUWhaRj504E8gXX/Ffen2q3YxXRAl0KKhZDrOCYjjyJE7RfBTv4oNMG48PzoymvX
 RW/e7LWE1x2NtkyXt0MNKpEFFTWVYRq7Fz8KZqnasV48o6NW2js0ZRS3aR8F/SUqTT7hzSo8mTdFe
 07L/MMtImQBFOB7qPZePZMABtkI4ot7sMMB9/tTgvX5bRkKrukGGa08qPBU9mM72V8BURnwKLzWcL
3EHcomjPmZ4Q83XhxeWBDhxC4dtLQ3LvQJEpxPAU/TFiBMxCEChnpWT+EG7tflVKft4nbdYFq3w==
krbPwdPolicyReference: cn=Default Service Password
Policy,cn=services,cn=accou
 nts,dc=ipa,dc=domain,dc=com
nsds5ReplConflict: namingConflict
krbprincipalname=HTTP/ipaserver003.ipa
 .domain.com@ipa.domain.com
<mailto:domain.com@ipa.domain.com>,cn=services,cn=accounts,dc=ipa,dc=domain,dc=com

# search result
search: 2
result: 0 Success

# numResponses: 6
# numEntries: 5

I uninstalled "oldipaserver" but I still get the replication conflict.

I try to use ldapdelete but it keep on complaining about the syntax.

Any suggestions?

Thanks,
Alex

On Sat, Nov 25, 2017 at 11:57 AM, Sumit Bose via FreeIPA-users
<freeipa-users@lists.fedorahosted.org
<mailto:freeipa-users@lists.fedorahosted.org>> wrote:

    On Fri, Nov 24, 2017 at 07:04:10PM -0500, Alexandre Pitre via
    FreeIPA-users wrote:
    > Hi,
    >
    > I had two freeipa replica servers up and running in our
    german DC for
    > nearly 2 months and this morning out of the blue they
    stopped working.
    >
    > Looking at ipactl status, both servers are reporting that
    their directory
    > service is stopped. Trying to restart ipa only works from 2
    minutes to an
    > hour.
    >
    > Looking at the /var/log/dirsrv/slapd-DOMAIN-COM/errors
    there's no errors
    > that show up before it crash.
    >
    > However, looking at /var/log/messages, this lovely segfault
    show up:
    >
    > XXXXXX kernel: ns-slapd[17507]: segfault at 8 ip
    00007fb99e56149f sp
    > 00007fb96bee83c0 error 4 in libslapd.s
    > o.0.1.0[7fb99e483000+128000]
    >
    > Out of despair to get production back up and running
    quickly, I reinstalled
    > one replica...it worked for an hour and came back with the
    same issue.
    >
    > We have 6 other freeipa replica running accross 3 different
    site with zero
    > issues.
    >
    > We're running CentOS 7.4 with the latest packages,
    ipa-server-4.5.0-21 &
    > 389-ds-base-1.3.6.1-21.
    >
    > Any clues why ?

    sorry, no clue but on
    http://www.port389.org/docs/389ds/FAQ/faq.html#debugging-crashes
    <http://www.port389.org/docs/389ds/FAQ/faq.html#debugging-crashes>
    you can
    see how to get a core dump file. Inspecting this might help to
    understand what is going wrong.

    bye,
    Sumit

    >
    > Thanks
    >
    > --
    > Alexandre Pitre
    > alexandre.pitre@gmail.com <mailto:alexandre.pitre@gmail.com>

    > _______________________________________________
    > FreeIPA-users mailing list --
    freeipa-users@lists.fedorahosted.org
    <mailto:freeipa-users@lists.fedorahosted.org>
    > To unsubscribe send an email to
    freeipa-users-leave@lists.fedorahosted.org
    <mailto:freeipa-users-leave@lists.fedorahosted.org>
    _______________________________________________
    FreeIPA-users mailing list --
    freeipa-users@lists.fedorahosted.org
    <mailto:freeipa-users@lists.fedorahosted.org>
    To unsubscribe send an email to
    freeipa-users-leave@lists.fedorahosted.org
    <mailto:freeipa-users-leave@lists.fedorahosted.org>

-- 
Alexandre Pitre
alexandre.pitre@gmail.com <mailto:alexandre.pitre@gmail.com>