Upgrade to UCS 4.4 failing join script for Radius and Appcenter


#22

The errors I see before it goes back to it’s normal output are:

24.04.19 12:56:49.530  DEBUG_INIT
24.04.19 12:56:49.556  TRANSFILE   ( ERROR   ) : Could not open /var/lib/univention-ldap/replog/replog
25.04.19 07:48:21.033  TRANSFILE   ( ERROR   ) : 27301728 ldap_add(): Other (e.g., implementation specific) error

And an ls -l of /var/lib/univention-ldap/replog/ is just:

# ls -l
total 0
-rw-r--r-- 1 root root 0 Apr 24 12:56 replog.lock

#23

@Christian_Voelker so how do I get it to create the replog? I’ve tried restarting the service innumerable times and restarted the server.


#24

@Christian_Voelker Still having issues. Updated to errata 78 and still can’t execute domain join scripts for radius or app center.

univention-run-join-scripts started
Sat May 4 07:49:25 MDT 2019

univention-join-hooks: looking for hook type "join/pre-joinscripts" on ad.skaggscatholiccenter.org
Found hooks:

RUNNING 30univention-appcenter.inst
2019-05-04 07:49:25.878584061-06:00 (in joinscript_init)
Object exists: cn=apps,cn=univention,dc=skaggscatholiccenter,dc=org
Object exists: cn=ldapschema,cn=univention,dc=skaggscatholiccenter,dc=org
INFO: No change of core data of object univention-app.
Object exists: cn=ldapacl,cn=univention,dc=skaggscatholiccenter,dc=org
INFO: No change of core data of object 66univention-appcenter_app.
Object exists: cn=udm_syntax,cn=univention,dc=skaggscatholiccenter,dc=org
INFO: No change of core data of object app_syntax.
Object exists: cn=udm_module,cn=univention,dc=skaggscatholiccenter,dc=org
INFO: No change of core data of object appcenter/app.
No modification: cn=univention-app,cn=ldapschema,cn=univention,dc=skaggscatholiccenter,dc=org

No modification: cn=66univention-appcenter_app,cn=ldapacl,cn=univention,dc=skaggscatholiccenter,dc=org

No modification: cn=app_syntax,cn=udm_syntax,cn=univention,dc=skaggscatholiccenter,dc=org

No modification: cn=appcenter/app,cn=udm_module,cn=univention,dc=skaggscatholiccenter,dc=org

Waiting for activation of the extension object univention-app: OK
Waiting for activation of the extension object 66univention-appcenter_app: OK
Waiting for activation of the extension object app_syntax:.......................................................ERROR: Master did not mark the extension object active within 180 seconds.
ERROR
ucs_registerLDAPExtension: registraton of /usr/share/univention-appcenter/app_syntax.py failed.

EXITCODE=1
2313bbb7-ae52-4b51-802c-bb24755b8ca9
RUNNING 80univention-radius.inst
2019-05-04 07:52:29.244868079-06:00 (in joinscript_init)
Object exists: cn=services,cn=univention,dc=skaggscatholiccenter,dc=org
Object exists: cn=RADIUS,cn=services,cn=univention,dc=skaggscatholiccenter,dc=org
WARNING: cannot append RADIUS to service, value exists
No modification: cn=ad,cn=dc,cn=computers,dc=skaggscatholiccenter,dc=org
Generating DH parameters, 1024 bit long safe prime, generator 2
This is going to take a long time
..+.................................................................................+.....+...................+......................................+................................+................................................................................+............................................+.......+.........................+.....+...................................................+.................+............................+........................................................................................+.......................................+......+..........+...+...............................................+..............................................................+.................................................+.........................+.....................+...................................+.......................................................................................................................................................................................................+................+............................+...+.............................................................................................................................................................+.......+..........+.........+......................................................+............................................+.................................................+........................................+.........+..................................................................................................+...................................................................................................................................+....+......................................................................................................................................................+.................................................................+..............................................................+..........................................................+............................+.....+........+.....................................................................................................................................................+......+........................................................+................................................................................................................................+.................+..................+.........................................................++*++*++*++*++*
unable to write 'random state'
Object exists: cn=ldapschema,cn=univention,dc=skaggscatholiccenter,dc=org
INFO: No change of core data of object networkaccess.
Object exists: cn=ldapacl,cn=univention,dc=skaggscatholiccenter,dc=org
INFO: No change of core data of object 59univention-radius.
INFO: No change of core data of object 66univention-radius.
No modification: cn=networkaccess,cn=ldapschema,cn=univention,dc=skaggscatholiccenter,dc=org

No modification: cn=59univention-radius,cn=ldapacl,cn=univention,dc=skaggscatholiccenter,dc=org

No modification: cn=66univention-radius,cn=ldapacl,cn=univention,dc=skaggscatholiccenter,dc=org

Waiting for activation of the extension object networkaccess: OK
Waiting for activation of the extension object 59univention-radius:.......................................................ERROR: Master did not mark the extension object active within 180 seconds.
ERROR
ucs_registerLDAPExtension: registraton of /usr/share/univention-radius/59univention-radius.acl failed.
EXITCODE=1
e0ce6ed2-514f-40bd-af0e-a0c148285f7c
univention-join-hooks: looking for hook type "join/post-joinscripts" on ad.skaggscatholiccenter.org
Found hooks:


Sat May 4 07:55:37 MDT 2019
univention-run-join-scripts finished

#25

Hi,

only advice I can give you here is to follow this article step-by-step:

I am pretty sure it will solve your issues.

/CV


#26

@Christian_Voelker Nope. I rand the check script and didn’t get a result. When I tried to start the listener and notifier it claims they don’t exist.

# /usr/share/univention-directory-notifier/univention-translog check
# systemctl start listener
Failed to start listener.service: Unit listener.service not found.
# systemctl start notifier
Failed to start notifier.service: Unit notifier.service not found.
# systemctl start slapd

#27

I did find a listener and notifier in /etc/init.d/ and started them manually. But the two join scripts still won’t execute successfully.

# /etc/init.d/univention-directory-listener start
[ ok ] Starting univention-directory-listener (via systemctl): univention-directory-listener.service.
# /etc/init.d/univention-directory-notifier start
[ ok ] Starting univention-directory-notifier (via systemctl): univention-directory-notifier.service.
# 

#28

I looked in on the listener and notifier logs. I did state earlier in this thread that the listener is failing to connect.

listener.log

13.05.19 09:14:26.996  LISTENER    ( WARN    ) : can not connect any server, retrying in 30 seconds
13.05.19 09:14:56.997  LISTENER    ( WARN    ) : Notifier/LDAP server is ad.skaggscatholiccenter.org:7389
13.05.19 09:14:56.997  LDAP        ( PROCESS ) : connecting to ldap://ad.skaggscatholiccenter.org:7389
13.05.19 09:14:57.000  LDAP        ( INFO    ) : simple_bind as cn=admin,dc=skaggscatholiccenter,dc=org
13.05.19 09:14:57.000  LISTENER    ( INFO    ) : connecting to notifier ad.skaggscatholiccenter.org:6669
13.05.19 09:14:57.000  LISTENER    ( INFO    ) : connection to 172.16.0.9 failed with errorcode 111: Connection refused
13.05.19 09:14:57.000  LISTENER    ( ERROR   ) : failed to connect to any notifier
13.05.19 09:14:57.000  LISTENER    ( WARN    ) : can not connect any server, retrying in 30 seconds
13.05.19 09:15:27.001  LISTENER    ( WARN    ) : Notifier/LDAP server is ad.skaggscatholiccenter.org:7389
13.05.19 09:15:27.001  LDAP        ( PROCESS ) : connecting to ldap://ad.skaggscatholiccenter.org:7389
13.05.19 09:15:27.007  LDAP        ( INFO    ) : simple_bind as cn=admin,dc=skaggscatholiccenter,dc=org
13.05.19 09:15:27.008  LISTENER    ( INFO    ) : connecting to notifier ad.skaggscatholiccenter.org:6669
13.05.19 09:15:27.009  LISTENER    ( INFO    ) : connection to 172.16.0.9 failed with errorcode 111: Connection refused
13.05.19 09:15:27.009  LISTENER    ( ERROR   ) : failed to connect to any notifier
13.05.19 09:15:27.009  LISTENER    ( WARN    ) : can not connect any server, retrying in 30 seconds

notifier.log is still showing the same error about command=‘m’

2019-05-13 09:17:04,660:CRITICAL:ldap_search(reqSession=27301727,cn=translog): No such object
2019-05-13 09:17:04,719:ERROR:ldap_add(Transaction(tid=27230362, dn='dc=skaggscatholiccenter,dc=org', command='m')): Already exists
2019-05-13 09:17:04,719:CRITICAL:ldap_add(Transaction(tid=27230363, dn='dc=skaggscatholiccenter,dc=org', command='m')): {'info': 'txn_commit failed', 'desc': 'Other (e.g., implementation specific) error'}
2019-05-13 09:17:10,058:CRITICAL:ldap_search(reqSession=27301727,cn=translog): No such object
2019-05-13 09:17:10,123:ERROR:ldap_add(Transaction(tid=27230362, dn='dc=skaggscatholiccenter,dc=org', command='m')): Already exists
2019-05-13 09:17:10,123:CRITICAL:ldap_add(Transaction(tid=27230363, dn='dc=skaggscatholiccenter,dc=org', command='m')): {'info': 'txn_commit failed', 'desc': 'Other (e.g., implementation specific) error'}
2019-05-13 09:17:15,386:CRITICAL:ldap_search(reqSession=27301727,cn=translog): No such object
2019-05-13 09:17:15,445:ERROR:ldap_add(Transaction(tid=27230362, dn='dc=skaggscatholiccenter,dc=org', command='m')): Already exists
2019-05-13 09:17:15,446:CRITICAL:ldap_add(Transaction(tid=27230363, dn='dc=skaggscatholiccenter,dc=org', command='m')): {'info': 'txn_commit failed', 'desc': 'Other (e.g., implementation specific) error'}

#29

Hi,

there has been indeed a typo in the article. Fixed it. Should state:

systemctl stop univention-directory-listener
systemctl stop univention-directory-notifer
systemctl stop slapd

So far why you have not been able to start your listener through systemctl.
So please stop services as shown above. Then do:

/usr/share/univention-directory-notifier/univention-translog check

and post the output here.

/CV


#30

Sorry for the long delay. I have to wait until the weekends in case something happens.

Here is the output from the translog check.

root@ad:~# systemctl stop univention-directory-listener
root@ad:~# systemctl stop univention-directory-notifier
root@ad:~# systemctl stop slapd
root@ad:~# tar -C /var/lib/univention-ldap -czpvf /root/replication_backup notify/ listener/
notify/
notify/transaction.index
notify/transaction
notify/transaction.lock
notify/transaction.bak
listener/
listener/listener.bak
listener/listener
listener/listener.lock
root@ad:~# /usr/share/univention-directory-notifier/univention-translog check
root@ad:~# systemctl start univention-directory-listener
root@ad:~# systemctl start univention-directory-notifier
root@ad:~# systemctl start slapd
root@ad:~# 

#31

@Christian_Voelker So it’s been a few days. What’s the solution to this NIGHTMARE? Your translog checking script says everything is fine (no output) when obviously it is not ok.


#32

Closing in on a week here @Christian_Voelker! How do I fix this? None of the articles you’ve linked work in terms of fixing the problem.


#33

Hi,

sorry, currently I do not have the time for deeper troubleshooting here.
Maybe someone else has an idea?

/CV


Critical: Check kerberos authenticated DNS update after restore
#34

@Christian_Voelker How do I get paid support for this problem? I’m sick and tired of this UCS system not working and of all the things I’ve dug up and stuff you’ve linked has not worked.