kinit admin

My IPA server and replica were working before. The above problem started when the ipa-server-upgrade is executed to upgrade from 4.2 to 4.4:

2017-02-23T15:10:59Z ERROR IPA server upgrade failed: Inspect /var/log/ipaupgrade.log and run command ipa-server-upgrade manually.
2017-02-23T15:10:59Z DEBUG File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 171, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_server_upgrade.py", line 48, in run
raise admintool.ScriptError(str(e))

2017-02-23T15:10:59Z DEBUG The ipa-server-upgrade command failed, exception: ScriptError: CA did not start in 300.0s
2017-02-23T15:10:59Z ERROR CA did not start in 300.0s
2017-02-23T15:10:59Z ERROR The ipa-server-upgrade command failed. See /var/log/ipaupgrade.log for more information

Please advise how to fix this problem...

Not sure whether CA is an issue or not. Even though ipaupgrade.log shows CA is down, the command "ipactl -d start" shows CA is up now.

ipa: DEBUG: The CA status is: running

The problem of kinit remain.

In /var/log/dirsrv/slapd-XXX/access.log:

There are hundreds of connection entries:

[25/Feb/2017:19:50:04.705242973 +0000] conn=3810 fd=3889 slot=3889 connection from local to /var/run/slapd-xxx.socket

which bottleneck the ldap server and eventually in /var/log/messages:

PR_Accept() failed, Netscape Portable Runtime error -5971 (Process open FD table is full.)

I googled around and found similar issue being reported:

https://www.redhat.com/archives/freeipa-users/2015-June/msg00392.html

Please advise how to resolve this issue. Many thanks!

Seems that you are running out of file descriptors.

Maybe this will help: https://access.redhat.com/documentation/en-US/Red_Hat_Directory_Server/10/html/Performance_Tuning_Guide/file-descriptors.html

Also quetion is whether directory server is the process which consumes it or if it is consumed by something else.

You can use tool lsof for listing all open file handlers.

Not enough data to investigate. Looks like more an OS configuration issue then FreeIPA issue.