How to reset Listener / Notifier replication

[requate]

Problem

In case severe inconsistency or corruption has be detected for the translog file we recommend to reset the replication for all systems in the domain. Please note that this is a major operation and will induce temporary downtimes for all services in the UCS domain.

These steps described in this article only apply to you, if you are sure, that the LDAP replication in your UCS domain has severe inconsistencies. Make sure to first follow the analysis described in

Problem: UMC Diagnostic Module Complains about Problems with UDN Replication

Problem The diagnostic module in Univention Management Console (UMC) reports a warning about problems with UDN replication similar to: Error retrieving notifier ID from the UDN. or Univention Directory Notifier ID and the locally stored version differ. This might indicate an error or still processing transactions. Solution Step 1 Please log on to the console as root e.g. via ssh and use the command /usr/lib/nagios/plugins/check_univention_replication to check which replication state the…

before continuing with this article.

Solution

Step 1: Reset LDAP transaction status on the UCS Master

As a first step, stop the LDAP-Server slapd, univention-directory-notifier (UDN) and univention-directory-listener (UDL) on all servers by logging in as root on each server and running

service slapd stop
service univention-directory-notifier stop
service univention-directory-listener stop

On Member servers there is only the listener running.

On the UCS Master run the following commands to reset the replication counters:
Note: You might download the script univention-reset-replication-counters.py (1.2 KB) and start it with python univention-reset-replication-counters.py.

python -c "
#!/usr/bin/python
from os import unlink
from os.path import getsize
from subprocess import Popen, PIPE
from univention.config_registry import ConfigRegistry

ucr = ConfigRegistry()
ucr.load()

# get last transaction ID from UDL
p = Popen(['/usr/sbin/univention-directory-listener-dump', '-i'], stdout=PIPE)
stdout, stderr = p.communicate()
lid = nid = last_id = int(stdout.split()[0])

# get first and last transaction ID of pending transactions (not yet processed by UDN)
if getsize('/var/lib/univention-ldap/listener/listener') > 0:
    with open('/var/lib/univention-ldap/listener/listener') as f:
        first = f.readline()
        head, tail = first.split(' ', 1)
        nid = int(head)
        for line in f:
            pass
        head, tail = line.split(' ', 1)
        last_id = int(head)

# Fill transaction file with dummy entries for missing transactions
with open('/var/lib/univention-ldap/notify/transaction', 'w') as f:
    for id in xrange(lid, nid):
        f.write('%d %s m\n' % (id, ucr['ldap/base']))

# Write last transaction ID for slapd
with open('/var/lib/univention-ldap/last_id', 'w') as f:
    f.write(str(last_id))

# Force UDN to re-build index
unlink('/var/lib/univention-ldap/notify/transaction.index')
"

Sine UCS 4.3-3 erratum 426 the transactions must also be re-imported into the cn=translog database:

/usr/share/univention-ldap/setup-translog init --force
service slapd start
/usr/share/univention-directory-notifier/univention-translog import

Now the translog should be ok again. Optionally this can be checked be running

/usr/share/univention-directory-notifier/univention-translog check --skip-services

After this, the remaining services UDN and UDL need to be started again:

service slapd start
service univention-directory-notifier start
service univention-directory-listener start

Step 2: Rejoin all systems

Next all other UCS servers need to be joined again. It is a good idea to start re-joining with the UCS Backup systems in the domain and continue with UCS Slave and Memberserver systems. On all system roles this can be achieved by running univention-join.