Issue #9321: ipa-ldap-updater - MidairCollision: change collided with another change - freeipa

freeipa

#9321 ipa-ldap-updater - MidairCollision: change collided with another change

Closed: worksforme Feb 2, 2023 by rcritten. Opened Feb 1, 2023 by haleakala269.

Request for enhancement

As , I want so that .

Issue

I need to update nsslapd-cachememsize for at least userRoot & ipaca ldbm databases.
We have the same error as described in https://pagure.io/freeipa/issue/9300

I'm using ipa-ldap-updater command with the following ldif file :

dn: cn=ipaca,cn=ldbm database,cn=plugins,cn=config
replace:nsslapd-cachememsize:134217728::268435456

But :
ipa-ldap-updater -v ./cachememsize.update ./cachememsize.update
=>
ipaserver.install.ldapupdate: DEBUG: [(1, u'nsslapd-cachememsize', [u'134217728']), (0, u'nsslapd-cachememsize', [u'268435456'])]
ipaserver.install.ldapupdate: DEBUG: Updated 1
ipalib.backend: DEBUG: Destroyed connection context.ldap2_140589261201936
ipapython.admintool: DEBUG: File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_ldap_updater.py", line 152, in run
modified = ld.update(self.files) or modified
File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 966, in update
self._run_updates(all_updates)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 930, in _run_updates
entry, modified = self._update_record(update)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 853, in _update_record
self.conn.update_entry(entry)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1629, in update_entry
self.conn.modify_s(str(entry.dn), modlist)
File "/usr/lib64/python2.7/contextlib.py", line 35, in exit
self.gen.throw(type, value, traceback)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1051, in error_handler
raise errors.MidairCollision()

ipapython.admintool: DEBUG: The ipa-ldap-updater command failed, exception: MidairCollision: change collided with another change
ipapython.admintool: ERROR: Unexpected error - see /var/log/ipaupgrade.log for details:
MidairCollision: change collided with another change
ipapython.admintool: ERROR: The ipa-ldap-updater command failed. See /var/log/ipaupgrade.log for more information

MidairCollision: change collided with another change

Steps to Reproduce

Create the ldif file
Launch ipa-ldap-updater with ldif file as parameter

Actual behavior

We get an error (Cf. above)

Expected behavior

nsslapd-cachememsize updated with the correct value

Version/Release/Distribution

$ rpm -q freeipa-server freeipa-client ipa-server ipa-client 389-ds-base pki-ca krb5-server
=>
package freeipa-server is not installed
package freeipa-client is not installed
ipa-server-4.6.8-5.el7.centos.10.x86_64
ipa-client-4.6.8-5.el7.centos.10.x86_64
389-ds-base-1.3.10.2-15.el7_9.x86_64
pki-ca-10.5.18-19.el7_9.noarch
krb5-server-1.15.1-51.el7_9.x86_64

Additional info:

Any additional information, configuration, data or log snippets that is needed for reproduction or investigation of the issue.

Log file locations: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/config-files-logs.html
Troubleshooting guide: https://www.freeipa.org/page/Troubleshooting

rcritten commented Feb 1, 2023

Look in /var/log/dirsrv/slapd-REALM/errors. Do you have something like:

[01/Feb/2023:10:04:42.011880614 -0500] - ERR - ldbm_instance_config_cachememsize_set - "nsslapd-cachememsize" can not be set while "nsslapd-cache-autosize" is set in "cn=config,cn=ldbm database,cn=plugins,cn=config".

389 returns LDAP_NO_SUCH_ATTRIBUTE in this case which is treated as a MidairCollision because the value cannot be deleted.

haleakala269 commented Feb 1, 2023

Yes :
[01/Feb/2023:14:46:05.279312574 +0100] - ERR - ldbm_instance_config_cachememsize_set - "nsslapd-cachememsize" can not be set while "nsslapd-cache-autosize" is set in "cn=config,cn=ldbm database,cn=plugins,cn=config".

So, is it possible to update the value ?

rcritten commented Feb 1, 2023

@mreynolds @tbordaz what would you suggest?

mreynolds commented Feb 2, 2023

You need to set nsslapd-cache-autosize to "0", then you can set the cache sizes manaully

rcritten commented Feb 2, 2023

This worked for me:

dn: cn=ipaca,cn=ldbm database,cn=plugins,cn=config
only:nsslapd-cache-autosize:0
replace:nsslapd-cachememsize:268435456::268435458

Metadata Update from @rcritten:
- Issue close_status updated to: worksforme
- Issue status updated to: Closed (was: Open)

Feb 2, 2023

haleakala269 commented Feb 2, 2023

Thanks for the commands.

I've succeeded in having the memcache size set to twice the initial value but I had to set nsslapd-cache-autosize to 0 instead of 10 in config database

Then, I got this error :
ipaserver.install.ldapupdate: DEBUG: Updating existing entry: cn=userRoot,cn=ldbm database,cn=plugins,cn=config
ipaserver.install.ldapupdate: DEBUG: ---------------------------------------------
ipaserver.install.ldapupdate: DEBUG: Initial value
ipaserver.install.ldapupdate: DEBUG: dn: cn=userRoot,cn=ldbm database,cn=plugins,cn=config
ipaserver.install.ldapupdate: DEBUG: nsslapd-directory:
ipaserver.install.ldapupdate: DEBUG: /var/lib/dirsrv/slapd-DATA-ESAUH/db/userRoot
ipaserver.install.ldapupdate: DEBUG: cn:
ipaserver.install.ldapupdate: DEBUG: userRoot
ipaserver.install.ldapupdate: DEBUG: objectClass:
ipaserver.install.ldapupdate: DEBUG: top
ipaserver.install.ldapupdate: DEBUG: extensibleObject
ipaserver.install.ldapupdate: DEBUG: nsBackendInstance
ipaserver.install.ldapupdate: DEBUG: nsslapd-require-index:
ipaserver.install.ldapupdate: DEBUG: off
ipaserver.install.ldapupdate: DEBUG: aci:
ipaserver.install.ldapupdate: DEBUG: (targetattr=nsslapd-readonly)(version 3.0; acl "Allow marking the database readonly"; allow (write) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=data,dc=esauh";)
ipaserver.install.ldapupdate: DEBUG: nsslapd-suffix:
ipaserver.install.ldapupdate: DEBUG: dc=data,dc=esauh
ipaserver.install.ldapupdate: DEBUG: nsslapd-readonly:
ipaserver.install.ldapupdate: DEBUG: off
ipaserver.install.ldapupdate: DEBUG: nsslapd-dncachememsize:
ipaserver.install.ldapupdate: DEBUG: 67108864
ipaserver.install.ldapupdate: DEBUG: nsslapd-cachesize:
ipaserver.install.ldapupdate: DEBUG: -1
ipaserver.install.ldapupdate: DEBUG: nsslapd-cachememsize:
ipaserver.install.ldapupdate: DEBUG: 512000
ipaserver.install.ldapupdate: DEBUG: only: set nsslapd-cache-autosize to '0', current value []
ipaserver.install.ldapupdate: DEBUG: only: updated value [u'0']
ipaserver.install.ldapupdate: DEBUG: replace: updated value [u'268435458']
ipaserver.install.ldapupdate: DEBUG: ---------------------------------------------
ipaserver.install.ldapupdate: DEBUG: Final value after applying updates
ipaserver.install.ldapupdate: DEBUG: dn: cn=userRoot,cn=ldbm database,cn=plugins,cn=config
ipaserver.install.ldapupdate: DEBUG: nsslapd-cache-autosize:
ipaserver.install.ldapupdate: DEBUG: 0
ipaserver.install.ldapupdate: DEBUG: nsslapd-directory:
ipaserver.install.ldapupdate: DEBUG: /var/lib/dirsrv/slapd-DATA-ESAUH/db/userRoot
ipaserver.install.ldapupdate: DEBUG: cn:
ipaserver.install.ldapupdate: DEBUG: userRoot
ipaserver.install.ldapupdate: DEBUG: objectClass:
ipaserver.install.ldapupdate: DEBUG: top
ipaserver.install.ldapupdate: DEBUG: extensibleObject
ipaserver.install.ldapupdate: DEBUG: nsBackendInstance
ipaserver.install.ldapupdate: DEBUG: nsslapd-require-index:
ipaserver.install.ldapupdate: DEBUG: off
ipaserver.install.ldapupdate: DEBUG: aci:
ipaserver.install.ldapupdate: DEBUG: (targetattr=nsslapd-readonly)(version 3.0; acl "Allow marking the database readonly"; allow (write) groupdn = "ldap:///cn=Remove Replication Agreements,cn=permissions,cn=pbac,dc=data,dc=esauh";)
ipaserver.install.ldapupdate: DEBUG: nsslapd-suffix:
ipaserver.install.ldapupdate: DEBUG: dc=data,dc=esauh
ipaserver.install.ldapupdate: DEBUG: nsslapd-readonly:
ipaserver.install.ldapupdate: DEBUG: off
ipaserver.install.ldapupdate: DEBUG: nsslapd-dncachememsize:
ipaserver.install.ldapupdate: DEBUG: 67108864
ipaserver.install.ldapupdate: DEBUG: nsslapd-cachesize:
ipaserver.install.ldapupdate: DEBUG: -1
ipaserver.install.ldapupdate: DEBUG: nsslapd-cachememsize:
ipaserver.install.ldapupdate: DEBUG: 268435458
ipaserver.install.ldapupdate: DEBUG: [(2, u'nsslapd-cache-autosize', [u'0']), (1, u'nsslapd-cachememsize', [u'512000']), (0, u'nsslapd-cachememsize', [u'268435458'])]
ipaserver.install.ldapupdate: DEBUG: Updated 1
ipalib.backend: DEBUG: Destroyed connection context.ldap2_140050459935632
ipapython.admintool: DEBUG: File "/usr/lib/python2.7/site-packages/ipapython/admintool.py", line 178, in execute
return_value = self.run()
File "/usr/lib/python2.7/site-packages/ipaserver/install/ipa_ldap_updater.py", line 152, in run
modified = ld.update(self.files) or modified
File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 966, in update
self._run_updates(all_updates)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 930, in _run_updates
entry, modified = self._update_record(update)
File "/usr/lib/python2.7/site-packages/ipaserver/install/ldapupdate.py", line 853, in _update_record
self.conn.update_entry(entry)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1629, in update_entry
self.conn.modify_s(str(entry.dn), modlist)
File "/usr/lib64/python2.7/contextlib.py", line 35, in exit
self.gen.throw(type, value, traceback)
File "/usr/lib/python2.7/site-packages/ipapython/ipaldap.py", line 1051, in error_handler
raise errors.MidairCollision()

But :
ldapsearch -x -u -h -LLL -o ldif-wrap=no -D "cn=directory manager" -w '' -b 'cn=userRoot,cn=ldbm database,cn=plugins,cn=config' | grep nsslapd-cachememsize
=> nsslapd-cachememsize: 268435458

Do you think it's normal ?
Also, do you think it's pertinent to increase the value of nsslapd-cachememsize ?
Should nsslapd-cache-autosize be preferred ?

rcritten commented Feb 2, 2023

Looks like I missed a colon in the replace line in the update file. It still seems to have applied it though.

I'd refer you to the 389-ds documentation for tuning, it's available under docs.redhat.com/

haleakala269 commented Feb 6, 2023

I've searched some info about the ipa-ldap-updater command but with quite no success.
Would you please have the direct link ?

frenaud commented Feb 7, 2023

Hi,
ipa-ldap-updater has a man page, also available in the source code: https://pagure.io/freeipa/blob/master/f/install/tools/man/ipa-ldap-updater.1

haleakala269 commented Feb 7, 2023

Thanks :-)

Metadata

Assignee

None

Tags

None

Blocking

None

Depending on

None

Priority

None

freeipa

#9321 ipa-ldap-updater - MidairCollision: change collided with another change Closed: worksforme Feb 2, 2023 by rcritten. Opened Feb 1, 2023 by haleakala269.

Request for enhancement

Issue

Steps to Reproduce

Actual behavior

Expected behavior

Version/Release/Distribution

Additional info:

Metadata

#9321 ipa-ldap-updater - MidairCollision: change collided with another change

Closed: worksforme Feb 2, 2023 by rcritten. Opened Feb 1, 2023 by haleakala269.