RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 833218 - ldapmodify returns Operations error
Summary: ldapmodify returns Operations error
Alias: None
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: 389-ds-base
Version: 6.4
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Rich Megginson
QA Contact: Sankar Ramalingam
Depends On:
TreeView+ depends on / blocked
Reported: 2012-06-18 22:00 UTC by Nathan Kinder
Modified: 2020-09-13 20:10 UTC (History)
1 user (show)

Fixed In Version: 389-ds-base-
Doc Type: Bug Fix
Doc Text:
Cause: Submitting an LDAP MODIFY operation when the directory server is heavily loaded. Consequence: The LDAP MODIFY operation returns an OPERATIONS_ERROR. Fix: Under a heavy load, the directory server will get deadlocks attempting to write to the database. The bug was caused by improper deadlock handling, which caused the database to report an error instead of retrying the transaction. The fix is to ensure that all deadlocks are handled correctly and their transactions are retried. Result: LDAP MODIFY operations in a heavily loaded directory server should not return OPERATIONS_ERROR.
Clone Of:
Last Closed: 2013-02-21 08:18:11 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github 389ds 389-ds-base issues 360 0 None None None 2020-09-13 20:10:25 UTC
Red Hat Product Errata RHSA-2013:0503 0 normal SHIPPED_LIVE Moderate: 389-ds-base security, bug fix, and enhancement update 2013-02-21 08:18:44 UTC

Description Nathan Kinder 2012-06-18 22:00:07 UTC
This bug is created as a clone of upstream ticket:

https://bugzilla.redhat.com/show_bug.cgi?id=819409 (''Fedora'')

Description of problem:
When installing FreeIPA, ldapmodify reports Operations Error and does not write
data to LDAP (privilege objects in this case). This causes subsequent issues in
FreeIPA install:

# ipa-server-install
Configuring directory server: Estimated time 1 minute
  [1/35]: creating directory server user
  [2/35]: creating directory server instance
  [3/35]: adding default schema
  [4/35]: enabling memberof plugin
  [5/35]: enabling referential integrity plugin
  [6/35]: enabling winsync plugin
  [7/35]: configuring replication version plugin
  [8/35]: enabling IPA enrollment plugin
  [9/35]: enabling ldapi
  [10/35]: configuring uniqueness plugin
  [11/35]: configuring uuid plugin
  [12/35]: configuring modrdn plugin
  [13/35]: enabling entryUSN plugin
  [14/35]: configuring lockout plugin
  [15/35]: creating indices
  [16/35]: configuring ssl for ds instance
  [17/35]: configuring certmap.conf
  [18/35]: configure autobind for root
  [19/35]: configure new location for managed entries
  [20/35]: restarting directory server
  [21/35]: adding default layout
  [22/35]: adding delegation layout
ipa         : CRITICAL Failed to load delegation.ldif: Command
'/usr/bin/ldapmodify -h vm-109.idm.lab.bos.redhat.com -v -f /tmp/tmpM7h8OS -x
-D cn=Directory Manager -y /tmp/tmpW0nOK4' returned non-zero exit status 1
  [23/35]: adding replication acis
  [24/35]: creating container for managed entries
  [25/35]: configuring user private groups
  [26/35]: configuring netgroups from hostgroups

ipaserver-install.log excerpt:
2012-05-07T06:45:15Z DEBUG   [22/35]: adding delegation layout
2012-05-07T06:45:16Z DEBUG args=/usr/bin/ldapmodify -h
vm-109.idm.lab.bos.redhat.com -v -f /tmp/       tmpM7h8OS -x -D cn=Directory
Manager -y /tmp/tmpW0nOK4
2012-05-07T06:45:16Z DEBUG stdout=add objectClass:
add cn:
adding new entry "cn=roles,cn=accounts,dc=idm,dc=lab,dc=bos,dc=redhat,dc=com"
modify complete

add objectClass:
add cn:
adding new entry "cn=pbac,dc=idm,dc=lab,dc=bos,dc=redhat,dc=com"
modify complete
add objectClass:
add cn:
    Group Administrators
add description:
    Group Administrators
adding new entry "cn=Group

2012-05-07T06:45:16Z DEBUG stderr=ldap_initialize(
ldap://vm-109.idm.lab.bos.redhat.com )
ldap_add: Operations error (1)

2012-05-07T06:45:16Z CRITICAL Failed to load delegation.ldif: Command
'/usr/bin/ldapmodify -h vm-109.  idm.lab.bos.redhat.com -v -f /tmp/tmpM7h8OS -x
-D cn=Directory Manager -y /tmp/tmpW0nOK4' returned non-zero exit status 1

I found a strange error in dirsrv error log (full log attached) which may be

[07/May/2012:02:45:13 -0400] - slapd stopped.
[07/May/2012:02:45:14 -0400] - 389-Directory/ B2012.126.1429 starting
[07/May/2012:02:45:14 -0400] attrcrypt - No symmetric key found for cipher AES
in backend userRoot,    attempting to create one...
[07/May/2012:02:45:14 -0400] attrcrypt - Key for cipher AES successfully
generated and stored
[07/May/2012:02:45:14 -0400] attrcrypt - No symmetric key found for cipher 3DES
in backend userRoot,   attempting to create one...
[07/May/2012:02:45:14 -0400] attrcrypt - Key for cipher 3DES successfully
generated and stored
[07/May/2012:02:45:14 -0400] ipaenrollment_start - [file ipa_enrollment.c, line
390]: Failed to get    default realm?!
[07/May/2012:02:45:14 -0400] - slapd started.  Listening on All Interfaces port
389 for LDAP requests
[07/May/2012:02:45:14 -0400] - Listening on All Interfaces port 636 for LDAPS
[07/May/2012:02:45:14 -0400] - Listening on
/var/run/slapd-IDM-LAB-BOS-REDHAT-COM.socket for LDAPI     requests
[07/May/2012:02:45:15 -0400] - Skipping CoS Definition cn=Password
Policy,cn=accounts,dc=idm,dc=lab,   dc=bos,dc=redhat,dc=com--no CoS Templates
found, which should be added before the CoS Definition.
[07/May/2012:02:45:15 -0400] - libdb: BDB0102 previous transaction deadlock
return not resolved
[07/May/2012:02:45:15 -0400] entryrdn-index - _entryrdn_put_data: Adding the
self link (61) failed:    Invalid argument (22)
[07/May/2012:02:45:15 -0400] - add: attempt to index 61 failed

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. Install freeipa on F-17 and observe installation

Actual results:
Installation reports 389-ds errors

Expected results:
Installation succeeds without 389-ds errors

Additional info:
Target VM has 1G memory, there were several related warnings in the beginning
of the error log, not sure if it is connected with the error.

Comment 2 Rich Megginson 2012-07-07 14:32:30 UTC
Covered by the new test multi_plugin - the stress test
r6706 | rmeggins | 2012-07-07 08:24:23 -0600 (Sat, 07 Jul 2012) | 16 lines

Add multi_plugin test suite
This test enables and configures multiple plugins in the style
of ipa.  The stress version of this test will enable the 
TXN_TESTING in the server which will exercise the txn deadlock
and retry code paths in the server.
Tickets covered by this test:
Ticket #345 - db deadlock return should not log error
Ticket #387 - managed entry sometimes doesn't delete the managed entry
Ticket #360 - ldapmodify returns Operations error
Ticket #335 - transaction retries need to be cache aware
Bugs covered by this test:
830336 db deadlock return should not log error
830343 managed entry sometimes doesn't delete the managed entry
833218 ldapmodify returns Operations error
833202 transaction retries need to be cache aware

Comment 4 Jenny Severance 2012-11-19 20:20:22 UTC

[2012-11-12 15:49:35] [multi_plugin][mp_01]
vendorversion: 389-Directory/ B2012.317.946
[2012-11-12 15:49:35] [multi_plugin][mp_01] finished
TestCase [mp_01] result-> [PASS]
[2012-11-12 15:49:35] [multi_plugin][mp_add] - add 5 users
[2012-11-12 15:49:36] [multi_plugin][mp_add] no txn retries - increase TXN_TEST_HOLD_MSEC and/or decrease TXN_TEST_LOOP_MSEC
[2012-11-12 15:49:39] [multi_plugin][mp_add] group members in cn=mpusers,ou=Groups,dc=example,dc=com differ from current dn list - probable memberof failure due to busy/txn retries - allowing
> uid=testuser1,ou=People,dc=example,dc=com
> uid=testuser1,ou=People,dc=example,dc=com
> uid=testuser1,ou=People,dc=example,dc=com
> uid=testuser2,ou=People,dc=example,dc=com
> uid=testuser2,ou=People,dc=example,dc=com
> uid=testuser2,ou=People,dc=example,dc=com
> uid=testuser3,ou=People,dc=example,dc=com
> uid=testuser3,ou=People,dc=example,dc=com
> uid=testuser3,ou=People,dc=example,dc=com
> uid=testuser4,ou=People,dc=example,dc=com
> uid=testuser4,ou=People,dc=example,dc=com
> uid=testuser4,ou=People,dc=example,dc=com
> uid=testuser5,ou=People,dc=example,dc=com
> uid=testuser5,ou=People,dc=example,dc=com
> uid=testuser5,ou=People,dc=example,dc=com
[2012-11-12 15:49:39] [multi_plugin][mp_add] finished
TestCase [mp_add] result-> [PASS]
[2012-11-12 15:49:39] [multi_plugin][mp_mod] - modify users
[2012-11-12 15:49:39] [multi_plugin][mp_mod] no txn retries - increase TXN_TEST_HOLD_MSEC and/or decrease TXN_TEST_LOOP_MSEC
[2012-11-12 15:49:41] [multi_plugin][mp_mod] finished
TestCase [mp_mod] result-> [PASS]
[2012-11-12 15:49:41] [multi_plugin][mp_rename] - rename users
[2012-11-12 15:49:41] [multi_plugin][mp_rename] no txn retries - increase TXN_TEST_HOLD_MSEC and/or decrease TXN_TEST_LOOP_MSEC
[2012-11-12 15:49:43] [multi_plugin][mp_rename] finished
TestCase [mp_rename] result-> [PASS]
[2012-11-12 15:49:43] [multi_plugin][mp_subtreerename] - rename subtree
[2012-11-12 15:49:45] [multi_plugin][mp_subtreerename] finished
TestCase [mp_subtreerename] result-> [PASS]
[2012-11-12 15:49:45] [multi_plugin][mp_delete] delete users in /home/sramling/RHEL64/testcases/DS/6.0/tet_tmp_dir//multi_plugin/dnlist
[2012-11-12 15:49:46] [multi_plugin][mp_delete] no txn retries - increase TXN_TEST_HOLD_MSEC and/or decrease TXN_TEST_LOOP_MSEC
[2012-11-12 15:49:48] [multi_plugin][mp_delete] finished
TestCase [mp_delete] result-> [PASS]



Comment 6 errata-xmlrpc 2013-02-21 08:18:11 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.