Bug 1990192

Summary: RHEL-8 IPA LDAP oom investigation
Product: Red Hat Enterprise Linux 8 Reporter: Marc Sauton <msauton>
Component: 389-ds-baseAssignee: LDAP Maintainers <ldap-maint>
Status: CLOSED DUPLICATE QA Contact: RHDS QE <ds-qe-bugs>
Severity: high Docs Contact:
Priority: unspecified    
Version: 8.4CC: ldap-maint, vashirov
Target Milestone: betaFlags: pm-rhel: mirror+
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-08-21 12:18:08 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Marc Sauton 2021-08-05 01:16:44 UTC
Description of problem:

this description is mostly for the record as the LDAP logs did not correspond to the OOM timing ( to be added )

The IPA LDAP service was terminated as "Out of memory: Killed process 2184890 (ns-slapd)" after over 8 hours in a deployment with 6 RHEL IdM servers all with a CA and capable of PKINIT

        ipa2 ( OOM )
                |  
ipa3 - ipa1 ( OOM ) - ipa5 - ipa6
                | 
             ipa4

1-2K established connections, some time_wait, system had default settings for TCP Q (128), and LDAP fd and timeouts

unknown number of users, groups, hbac, sudo rules ( to be added )


Version-Release number of selected component (if applicable):

RHEL_8.4
389-ds-base-1.4.3.16-13.module+el8.4.0+10307+74bbfb4e.x86_64
ipa-server-4.9.2-3.module+el8.4.0+10412+5ecb5b37.x86_64
redhat-release-8.4-0.6.el8.x86_64
slapi-nis-0.56.6-2.module+el8.4.0+10615+2234cc2c.x86_64


How reproducible:
N/A, but appears in over 8 hours


Steps to Reproduce:
1. N/A, unknown scenario
2.
3.


Actual results:
[Wed Jul 21 02:10:00 2021] Out of memory: Killed process 2184890 (ns-slapd) total-vm:46361340kB, anon-rss:28366956kB, file-rss:0kB, shmem-rss:8kB, UID:389 pgtables:84344kB oom_score_adj:0


Expected results:
yes


Additional info:

- restart ipactl every eight hours
- collected LDAP logs did not correspond to the system OOM events
- till trying to collect 389-ds valigrind and/or jemalloc reports

Comment 5 Marc Sauton 2021-08-21 12:19:32 UTC
closing this bz 1990192 as a dup of 1967906 for the slapi-nis component