[Freeipa-users] start and stop of ipa commands in systemd

[Martin (Lists)]

Hallo

I have a question regarding enabling/disabling separate ipa parts in
systemd. Is it necessarry or required to have httpd, directory server,
named memcache and all the other ipa services to be enabled in systemd?
Or is it recomended to have only the main ipa service enabled (and all
the other disabled)?

Regards
Martin

[Martin Babinsky]

Post by Martin (Lists)
Hallo
I have a question regarding enabling/disabling separate ipa parts in
systemd. Is it necessarry or required to have httpd, directory server,
named memcache and all the other ipa services to be enabled in systemd?
Or is it recomended to have only the main ipa service enabled (and all
the other disabled)?
Regards
Martin

Hi Martin,

ipa.service actually calls `ipactl` command which starts/stops all
individual components at once (dirsrv, http, kdc, kpasswd, memcache,
pki-tomcat etc.). All of these services (which are listed in `ipactl
status`) must be up and running for IPA server to work correctly in all
aspects.

So in this sense 'ipa.service' is just an umbrella that groups all the
components of FreeIPA installation.

[Alexander Bokovoy]

Post by Martin Babinsky

Post by Martin (Lists)
Hallo
I have a question regarding enabling/disabling separate ipa parts in
systemd. Is it necessarry or required to have httpd, directory server,
named memcache and all the other ipa services to be enabled in systemd?
Or is it recomended to have only the main ipa service enabled (and all
the other disabled)?
Regards
Martin

Hi Martin,
ipa.service actually calls `ipactl` command which starts/stops all
individual components at once (dirsrv, http, kdc, kpasswd, memcache,
pki-tomcat etc.). All of these services (which are listed in `ipactl
status`) must be up and running for IPA server to work correctly in
all aspects.
So in this sense 'ipa.service' is just an umbrella that groups all the
components of FreeIPA installation.

I think Martin's question was more about those services being enabled in
systemd by themselves. The answer is 'no', because ipa.service takes
care of that based on the state of services we keep in LDAP.

Unfortunately, all init systems to date only care about a single host's
status. In IPA case we have multinode environment where different
services may be activated on the nodes depending on what was enabled.
You can have base IPA (dirsrv, KDC, httpd) running on majority of
masters but then some of them would be also running CAs and potentially
they can run Samba services for AD integration. The status of these
services is recorded in LDAP because this is what we have as a
replicated store that all IPA masters know about. This information is
needed for more uses than just init system on a specific host, though.

[Jan Pazdziora]

Post by Martin Babinsky

Post by Martin (Lists)
I have a question regarding enabling/disabling separate ipa parts in
systemd. Is it necessarry or required to have httpd, directory server,
named memcache and all the other ipa services to be enabled in systemd?
Or is it recomended to have only the main ipa service enabled (and all
the other disabled)?

ipa.service actually calls `ipactl` command which starts/stops all
individual components at once (dirsrv, http, kdc, kpasswd, memcache,
pki-tomcat etc.). All of these services (which are listed in `ipactl
status`) must be up and running for IPA server to work correctly in all
aspects.
So in this sense 'ipa.service' is just an umbrella that groups all the
components of FreeIPA installation.

For production operation, what Martin B. has said is the recommended
way.

It the future, native systemd approach is likely to be used:

https://fedorahosted.org/freeipa/ticket/4552

At the same time, we will likely explore the possibility of running
various pieces on different machines (or in different containers).

If you are interested in exploring those areas and helping us develop
them, we'll be happy to hear about your findings.

[Martin (Lists)]

Post by Martin Babinsky

Post by Martin (Lists)
Hallo
I have a question regarding enabling/disabling separate ipa parts in
systemd. Is it necessarry or required to have httpd, directory server,
named memcache and all the other ipa services to be enabled in systemd?
Or is it recomended to have only the main ipa service enabled (and all
the other disabled)?
Regards
Martin

Hi Martin,
ipa.service actually calls `ipactl` command which starts/stops all
individual components at once (dirsrv, http, kdc, kpasswd, memcache,
pki-tomcat etc.). All of these services (which are listed in `ipactl
status`) must be up and running for IPA server to work correctly in all
aspects.
So in this sense 'ipa.service' is just an umbrella that groups all the
components of FreeIPA installation.

For starting and stopping all neccessarry parts this is OK. But if I
have enabled some of these services directly in systemd (lets say
memcached or the ldap server) does that make problems during startup or
shutdown.

May be it is just a coincidence, but I had several warnings (up to
thousands) in the past from the LDAP Server at a simple restart of the
server:

DSRetroclPlugin - delete_changerecord: could not delete change record
553423 (rc: 32): 1 Time(s)

An I have not found any reason for this. Therefore the question: can
this be due to a false shutdown or startup sequence by systemd?

Last time I run "ipactl stop" before restarting the server and had no
such warnings. As I said may be its just a coincidence.

I run ipa on a up to date fedora 23 server.

Regards
Martin

[Ludwig Krispenz]

Post by Martin (Lists)

Post by Martin Babinsky

Post by Martin (Lists)
Hallo
I have a question regarding enabling/disabling separate ipa parts in
systemd. Is it necessarry or required to have httpd, directory server,
named memcache and all the other ipa services to be enabled in systemd?
Or is it recomended to have only the main ipa service enabled (and all
the other disabled)?
Regards
Martin

Hi Martin,
ipa.service actually calls `ipactl` command which starts/stops all
individual components at once (dirsrv, http, kdc, kpasswd, memcache,
pki-tomcat etc.). All of these services (which are listed in `ipactl
status`) must be up and running for IPA server to work correctly in all
aspects.
So in this sense 'ipa.service' is just an umbrella that groups all the
components of FreeIPA installation.

For starting and stopping all neccessarry parts this is OK. But if I
have enabled some of these services directly in systemd (lets say
memcached or the ldap server) does that make problems during startup or
shutdown.
May be it is just a coincidence, but I had several warnings (up to
thousands) in the past from the LDAP Server at a simple restart of the
DSRetroclPlugin - delete_changerecord: could not delete change record
553423 (rc: 32): 1 Time(s)
An I have not found any reason for this. Therefore the question: can
this be due to a false shutdown or startup sequence by systemd?

The DSRetroclPlugin messages occur when the starting point for trimming
the retro changelog was incorrectly set. The messages themselves are
harmless, just skipping no longer existing changes.
I think a crash or kill at shutdown will increase the probabilty to run
into these scenarios

Post by Martin (Lists)
Last time I run "ipactl stop" before restarting the server and had no
such warnings. As I said may be its just a coincidence.
I run ipa on a up to date fedora 23 server.
Regards
Martin