samba - Jul 2024 - dbcheck gets uncaught exception

> Anything after the 'Join failed' can be ignored, it is just an
> artefact of the cleanup.
> 
> I posted this:
> 
> Do not remove the existing database, well not unless you want to
> recreate your domain.
> 
> I will amend it:
> 
> Do not touch 'DC=DOMAINDNSZONES,DC=COMPANY,DC=INTRA.ldb' (or any of
the
> other files in the same directory) directly, do all changes through
> sam.ldb, otherwise you have a very good risk of further damaging your
> database.
> 
> Rowland
Hey Rowland,

thanks for your feedback.
I did this on a cloned system. Original system is still untouched but I 
have no idea how to work around the initial issue not beeing able to do 
a dbcheck or join since something fundamental seams to be broken for 
this toolchain.

The reason I touched the files in the private dir was that even the 
offline backup failed on this database. I'm afraid I have to recreate 
the domain from scratch unless you have a better idea?

sudo samba-tool dbcheck --cross-ncs -d 5 --fix

Checking 3637 objects
ndr_pull_dom_sid: ndr_pull_error(Range Error): value out of range at 
../../librpc/ndr/ndr_sec_helper.c:329
ERROR(ldb): uncaught exception - ldb_wait from (null) with LDB_WAIT_ALL: 
Operations error (1)
   File "/usr/lib/python3/dist-packages/samba/netcmd/__init__.py",
line
186, in _run
     return self.run(*args, **kwargs)
   File "/usr/lib/python3/dist-packages/samba/netcmd/dbcheck.py", line
169, in run
     error_count = chk.check_database(DN=DN, scope=search_scope,
   File "/usr/lib/python3/dist-packages/samba/dbchecker.py", line 255,
in check_database
     error_count += self.check_object(object.dn, requested_attrs=attrs)
   File "/usr/lib/python3/dist-packages/samba/dbchecker.py", line
2310,
in check_object
     res = self.samdb.search(base=dn, scope=ldb.SCOPE_BASE,

Thanks for your patience and help

Heiko

> Do not touch 'DC=DOMAINDNSZONES,DC=COMPANY,DC=INTRA.ldb' (or any of
the
> other files in the same directory) directly, do all changes through
> sam.ldb, otherwise you have a very good risk of further damaging your
> database.
I'm not sure if the dup keys in the 
'DC=DOMAINDNSZONES,DC=COMPANY,DC=INTRA.ldb' is my root issue and why the
dbcheck fails with that uncaught exception. How would I fix such a 
duplicate key in that file through sam.ldb?

To identify the dup key I creted a tdbdump and then counted the keys:

awk '$1 ~ /^key/ {print $3}' DOMAINDNSZONES.tdbdump |sort|uniq -c | sort
-nr | head

the dupliate entry is

{
key(42) = "DN=@INDEX:USNCHANGED:p0000000000000048557\00"
data(116) = 
"h\19\01&\02\00\00\00&\00\00\00 at
INDEX:USNCHANGED:p0000000000000048557\00\00\00\00\00\00)\00\00\00\0B\00\00\00 at
IDXVERSION\00\01\00\00\00\01\01\04\00\00\00 at
IDX\00\01\00\00\00\01\103\00$s$\BB\D6;UJ\B1|\F3\B5\90l6\A4\00"
}


Maybe it is related or not but in log.samba I also see

   ldb: acl_read: cannot get descriptor of 
DC=DomainDnsZones,DC=ecm4u,DC=intra: Operations error

I don't know what to do with all this either. The samba-ad ran for years 
and we never realized that there was a problem. Today I know that a 
replication or an online backup would stumble over such errors.

Any kind of feedback is welcome.