thr3ads.net - samba - [Samba] Replication issue (maybe due to 4.7.0 bug?) [Dec 2017]

If this information is useful, please help other people find it:
Share via:

Gaetan SLONGO

2017-Dec-07 09:33 UTC

[Samba] Replication issue (maybe due to 4.7.0 bug?)

Hi, 


We are facing to a replication issue on a couple of DC. We are now on 4.7.3 but
we have been on 4.7.0 and 4.7.1 shortly


We have a replication issue (samba-tool ldapcmp shows errors). But when trying
to full sync we also get errors :



[root at dc ~]# samba-tool drs replicate nas dc DC=ads,DC=dom,DC=be --full-sync 
Processing section "[netlogon]" 
Processing section "[sysvol]" 
pm_process() returned Yes 
ldb_wrap open of secrets.ldb 
GENSEC backend 'gssapi_spnego' registered 
GENSEC backend 'gssapi_krb5' registered 
GENSEC backend 'gssapi_krb5_sasl' registered 
GENSEC backend 'spnego' registered 
GENSEC backend 'schannel' registered 
GENSEC backend 'naclrpc_as_system' registered 
GENSEC backend 'sasl-EXTERNAL' registered 
GENSEC backend 'ntlmssp' registered 
GENSEC backend 'ntlmssp_resume_ccache' registered 
GENSEC backend 'http_basic' registered 
GENSEC backend 'http_ntlm' registered 
GENSEC backend 'krb5' registered 
GENSEC backend 'fake_gssapi_krb5' registered 
Using binding ncacn_ip_tcp:nas[,seal] 
Mapped to DCERPC endpoint 135 
added interface eth0 ip=10.17.253.167 bcast=10.17.253.255
netmask=255.255.255.128
added interface eth0 ip=10.17.253.167 bcast=10.17.253.255
netmask=255.255.255.128
resolve_lmhosts: Attempting lmhosts lookup for name nas<0x20> 
Mapped to DCERPC endpoint 1024 
added interface eth0 ip=10.17.253.167 bcast=10.17.253.255
netmask=255.255.255.128
added interface eth0 ip=10.17.253.167 bcast=10.17.253.255
netmask=255.255.255.128
resolve_lmhosts: Attempting lmhosts lookup for name nas<0x20> 
Received smb_krb5 packet of length 250 
Received smb_krb5 packet of length 1279 
Received smb_krb5 packet of length 1294 
Received smb_krb5 packet of length 1312 
added interface eth0 ip=10.17.253.167 bcast=10.17.253.255
netmask=255.255.255.128
added interface eth0 ip=10.17.253.167 bcast=10.17.253.255
netmask=255.255.255.128
resolve_lmhosts: Attempting lmhosts lookup for name nas<0x20> 
Received smb_krb5 packet of length 1294 
Received smb_krb5 packet of length 1312 
ERROR(<class 'samba.drs_utils.drsException'>): DsReplicaSync
failed - drsException: DsReplicaSync failed (58, 'WERR_BAD_NET_RESP')
File "/usr/lib64/python2.7/site-packages/samba/netcmd/drs.py", line
386, in run
drs_utils.sendDsReplicaSync(server_bind, server_bind_handle, source_dsa_guid,
NC, req_options)
File "/usr/lib64/python2.7/site-packages/samba/drs_utils.py", line 85,
in sendDsReplicaSync
raise drsException("DsReplicaSync failed %s" % estr) 






and on the destination server, in the logs : 



==> /var/log/samba/log.samba <== 
[2017/12/07 10:10:55.825907, 0]
../source4/dsdb/repl/drepl_out_helpers.c:942(dreplsrv_op_pull_source_apply_changes_trigger)
Failed to commit objects: WERR_GEN_FAILURE/NT_STATUS_INVALID_NETWORK_RESPONSE 




I can't find what is causing this error and the error message doesnt give a
lot of informations


Do you have any idea ? 


Thanks !

Andrew Bartlett

2017-Dec-07 10:35 UTC

head link

[Samba] Replication issue (maybe due to 4.7.0 bug?)

On Thu, 2017-12-07 at 10:33 +0100, Gaetan SLONGO via samba
wrote:> 
> I can't find what is causing this error and the error message doesnt
give a lot of informations
> 
> 
> Do you have any idea ? 
You will get more information if you turn up the log level, eg with
'log level = drs_repl:4'.  Take care before posting any logs that you
don't just reply and post them to this PUBLIC MAILING LIST until you
have checked them for private details, like staff names. 

Typically the failure is due to the last object, so the end of the log
is the most useful bit.  I have to say all this because sadly folks
have posted private/secret details here before while hoping for help. 

Thanks,

Andrew Bartlett

-- 
Andrew Bartlett                       http://samba.org/~abartlet/
Authentication Developer, Samba Team  http://samba.org
Samba Developer, Catalyst IT          http://catalyst.net.nz/services/samba

Gaetan SLONGO

2017-Dec-07 11:16 UTC

head link

[Samba] Replication issue (maybe due to 4.7.0 bug?)

Hi Andrew, 


Thank you for your answer. 


Don't have much more informations with these logs : 



==> /var/log/samba/log.samba <== 
[2017/12/07 12:10:58.989255, 2]
../source4/rpc_server/drsuapi/getncchanges.c:1731(getncchanges_collect_objects)
../source4/rpc_server/drsuapi/getncchanges.c:1731: getncchanges on
DC=ads,DC=dom,DC=be using filter (uSNChanged>=1)
[2017/12/07 12:10:59.058507, 3]
../source4/rpc_server/drsuapi/getncchanges.c:2822(dcesrv_drsuapi_DsGetNCChanges)
UpdateRefs on getncchanges for 8dcda717-56de-4ad9-a2e5-fa3d539bfa21 
[2017/12/07 12:10:59.058543, 4]
../source4/rpc_server/drsuapi/updaterefs.c:209(drsuapi_UpdateRefs)
DsReplicaUpdateRefs for host
'8dcda717-56de-4ad9-a2e5-fa3d539bfa21._msdcs.ads.dom.be' with GUID
8dcda717-56de-4ad9-a2e5-fa3d539bfa21 options 0x00000007
nc=<GUID=e88a2ac0-86a7-4e80-b2f0-832e165702d3>;<SID=S-1-5-21-2122692405-1923390809-3425158908>;DC=ads,DC=dom,DC=be
[2017/12/07 12:10:59.058872, 4]
../source4/rpc_server/drsuapi/getncchanges.c:3006(dcesrv_drsuapi_DsGetNCChanges)
DsGetNCChanges with uSNChanged >= 1 flags 0x00200064 on
<GUID=e88a2ac0-86a7-4e80-b2f0-832e165702d3>;<SID=S-1-5-21-2122692405-1923390809-3425158908>;DC=ads,DC=dom,DC=be
gave 133 objects (done 133/515) 0 links (done 0/3 (as
S-1-5-21-2122692405-1923390809-3425158908-11157))
[2017/12/07 12:10:59.539253, 3]
../source4/rpc_server/drsuapi/getncchanges.c:2822(dcesrv_drsuapi_DsGetNCChanges)
UpdateRefs on getncchanges for 8dcda717-56de-4ad9-a2e5-fa3d539bfa21 
[2017/12/07 12:10:59.539286, 4]
../source4/rpc_server/drsuapi/updaterefs.c:209(drsuapi_UpdateRefs)
DsReplicaUpdateRefs for host
'8dcda717-56de-4ad9-a2e5-fa3d539bfa21._msdcs.ads.dom.be' with GUID
8dcda717-56de-4ad9-a2e5-fa3d539bfa21 options 0x00000007
nc=<GUID=e88a2ac0-86a7-4e80-b2f0-832e165702d3>;<SID=S-1-5-21-2122692405-1923390809-3425158908>;DC=ads,DC=dom,DC=be
[2017/12/07 12:10:59.539602, 4]
../source4/rpc_server/drsuapi/getncchanges.c:3006(dcesrv_drsuapi_DsGetNCChanges)
DsGetNCChanges with uSNChanged >= 1 flags 0x00000064 on
<GUID=e88a2ac0-86a7-4e80-b2f0-832e165702d3>;<SID=S-1-5-21-2122692405-1923390809-3425158908>;DC=ads,DC=dom,DC=be
gave 133 objects (done 266/515) 0 links (done 0/63 (as
S-1-5-21-2122692405-1923390809-3425158908-11157))
[2017/12/07 12:11:00.078386, 3]
../source4/rpc_server/drsuapi/getncchanges.c:2822(dcesrv_drsuapi_DsGetNCChanges)
UpdateRefs on getncchanges for 8dcda717-56de-4ad9-a2e5-fa3d539bfa21 
[2017/12/07 12:11:00.078420, 4]
../source4/rpc_server/drsuapi/updaterefs.c:209(drsuapi_UpdateRefs)
DsReplicaUpdateRefs for host
'8dcda717-56de-4ad9-a2e5-fa3d539bfa21._msdcs.ads.dom.be' with GUID
8dcda717-56de-4ad9-a2e5-fa3d539bfa21 options 0x00000007
nc=<GUID=e88a2ac0-86a7-4e80-b2f0-832e165702d3>;<SID=S-1-5-21-2122692405-1923390809-3425158908>;DC=ads,DC=dom,DC=be
[2017/12/07 12:11:00.078732, 4]
../source4/rpc_server/drsuapi/getncchanges.c:3006(dcesrv_drsuapi_DsGetNCChanges)
DsGetNCChanges with uSNChanged >= 1 flags 0x00000064 on
<GUID=e88a2ac0-86a7-4e80-b2f0-832e165702d3>;<SID=S-1-5-21-2122692405-1923390809-3425158908>;DC=ads,DC=dom,DC=be
gave 133 objects (done 399/515) 0 links (done 0/183 (as
S-1-5-21-2122692405-1923390809-3425158908-11157))
[2017/12/07 12:11:00.716327, 3]
../source4/rpc_server/drsuapi/getncchanges.c:2822(dcesrv_drsuapi_DsGetNCChanges)
UpdateRefs on getncchanges for 8dcda717-56de-4ad9-a2e5-fa3d539bfa21 
[2017/12/07 12:11:00.716372, 4]
../source4/rpc_server/drsuapi/updaterefs.c:209(drsuapi_UpdateRefs)
DsReplicaUpdateRefs for host
'8dcda717-56de-4ad9-a2e5-fa3d539bfa21._msdcs.ads.dom.be' with GUID
8dcda717-56de-4ad9-a2e5-fa3d539bfa21 options 0x00000007
nc=<GUID=e88a2ac0-86a7-4e80-b2f0-832e165702d3>;<SID=S-1-5-21-2122692405-1923390809-3425158908>;DC=ads,DC=dom,DC=be
[2017/12/07 12:11:00.724476, 2]
../source4/rpc_server/drsuapi/getncchanges.c:3006(dcesrv_drsuapi_DsGetNCChanges)
DsGetNCChanges with uSNChanged >= 1 flags 0x00000064 on
<GUID=e88a2ac0-86a7-4e80-b2f0-832e165702d3>;<SID=S-1-5-21-2122692405-1923390809-3425158908>;DC=ads,DC=dom,DC=be
gave 116 objects (done 515/515) 575 links (done 575/575 (as
S-1-5-21-2122692405-1923390809-3425158908-11157))






These are dropped in the logs from the source when throwing replicate
(samba-tool). On the other side logs are the same as the first mail


Thanks ! 


----- Mail original -----

De: "Andrew Bartlett" <abartlet at samba.org> 
À: "Gaetan SLONGO" <gslongo at it-optics.com>, samba at
lists.samba.org
Envoyé: Jeudi 7 Décembre 2017 11:35:20 
Objet : Re: [Samba] Replication issue (maybe due to 4.7.0 bug?) 

On Thu, 2017-12-07 at 10:33 +0100, Gaetan SLONGO via samba wrote:
> 
> I can't find what is causing this error and the error message doesnt
give a lot of informations
> 
> 
> Do you have any idea ? 
You will get more information if you turn up the log level, eg with 
'log level = drs_repl:4'. Take care before posting any logs that you 
don't just reply and post them to this PUBLIC MAILING LIST until you 
have checked them for private details, like staff names. 

Typically the failure is due to the last object, so the end of the log 
is the most useful bit. I have to say all this because sadly folks 
have posted private/secret details here before while hoping for help. 

Thanks, 

Andrew Bartlett 

-- 
Andrew Bartlett http://samba.org/~abartlet/ 
Authentication Developer, Samba Team http://samba.org 
Samba Developer, Catalyst IT http://catalyst.net.nz/services/samba

Reasonably Related Threads

Search for more apparently analagous threads

samba - Dec 2017 - Replication issue (maybe due to 4.7.0 bug?)

[Samba] Replication issue (maybe due to 4.7.0 bug?)

[Samba] Replication issue (maybe due to 4.7.0 bug?)

[Samba] Replication issue (maybe due to 4.7.0 bug?)

Reasonably Related Threads