freeipa

#8640 ipa-dnskeysyncd stops notifying upon updates
Closed: insufficientinfo by frenaud. Opened by greywolfe.

Closed: insufficientinfo
Reopen Issue

Issue

After some time, ipa-dnskeysyncd stops passing notifications to bind about ldap updates. systemctl restart ipa-dnskeysyncd allows updates to function again until next failure. Have been unable to find anything yet in the logs to indicate any errors. systemctl status shows that service is functioning normally. I recently upgraded to the new 4.9 version on fedora 34. I believe this is the same issue I was experiencing on 4.8.10 on fedora 33, but hadn't been able to track down the culprit.

Steps to Reproduce

  1. wait til updates stop functioning on one of the servers
  2. tail -f /var/log/messages | grep ipaserver.dnssec
  3. add entry to dns through UI
  4. nslookup 'added entry' 127.0.0.1 nxdomain on server that did not receive update
  5. systemctl restart ipa-dnskeysyncd , retry step 3-4, returns correct result
  6. systemctl restart named, return previous results added before restart of ipa-dnskeysyncd

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
freeipa-server-4.9.0-1.fc34.x86_64
freeipa-client-4.9.0-1.fc34.x86_64
package ipa-server is not installed
package ipa-client is not installed
389-ds-base-2.0.1-1.fc34.x86_64
pki-ca-10.10.0-2.fc34.noarch
krb5-server-1.18.3-4.fc34.x86_64

Additional info:

please let me know any particular logs, etc you might need.

This might be another example of syncrepl issues in 389-ds. @frenaud, do you have a tracking bug?

syncrepl is obviously, between the ldap servers. fyi, if it matters, I'll add a dns entry through the UI on the host itself where dnskeysync is not working, querying the local instance of ldap, and it still won't show up until the service is restarted

@abbra this may be a duplicate of https://pagure.io/freeipa/issue/8496 or https://pagure.io/freeipa/issue/8538.

The sync_repl issue has been fixed with 389ds commit ba0e91b that is available in 389-ds-base-2.0.3 (available on Fedora 34), 389-ds-base-1.4.4.12 (available on fedora 33) and 389-ds-base-1.4.3.19 (planned for fedora 32 but not yet available).

@greywolfe can you try to upgrade 389ds to 2.0.3 and let us know if it solves your issue?

Metadata Update from @frenaud:
- Issue set to the milestone: DNSSEC

As this ticket has been waiting for information from the reporter for an extended period of time, closing this issue due to inactivity. Feel free to re-open and attach the needed information if the 389-ds update did not solve the problem.

Metadata Update from @frenaud:
- Issue close_status updated to: insufficientinfo
- Issue status updated to: Closed (was: Open)
Metadata
None
None
None
None
None
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.