DirectoryServices daily crash

[Anonymous]

hi,

i am in the process of integrating OD and AD domains but am having a problem with DirectoryServices crashing once per day usualy in the afternoon. watchdog automatically relaunches it, but any user who is not already logged on will not be able to login.

% sudo kill -9 PID

temporarily resolves the problem. any suggestions how i may narrow down the cause of the problem would be welcome.

a brief description of the set up is as follows:

two mac os x servers. one for MCX and the other is the file server.

single sign on for afp, etc is not yet set up. sso for smb is set up.

the file server is set up to join the OD domain because it is supplying afp automounts to the mac os x clients.

all the os x clients are joined to the AD domain using a single computer account. (i will change this to unique accounts as soon as i update my radmind loadset.)

i tried:
rejoining the AD domain on the file server.
reordering the list of domains the file server authenticates to.

but neither resolved the problem. crashreporter logs the crash details but i didnt find anything that suggested a cause.

[Anonymous]

thanks for the suggestions.

1, i disconnected the file server from the OD domain and the automounts work as expected. however, if i automount a group folder located on the file server with the users credentials the automount process doesnt work right. the library folder ends up pointing to the applications folder. ive disabled it for now and will investigate this further at a later time.

2, the above didnt resolve the problem. i turned on directory service debugging log with the above command and am tailing the log using tail -fF DirectoryService.debug.log. will report back if i resolve the issue or have additional info.

i noticed that the time on the AD server was off by 4-5 minutes. will try to resolve this also.

3, thanks.

[Anonymous]

thanks for all your help.

time time was corrected on the windows server and now all the computers are in sync.. the crash took a lot longer than usual to reoccur. it usually occurs by 2:00pm – 3:00pm daily but it missed one day (yesterday) and did not occur until 4:27:33pm today. i have attached what i think is the pertinent section of the debug log. is the user id too high?

i also noticed that there is not error log for directory services. i am not sure why. i touch(ed) an error log file so that i do not get an error message in serveradmin. however nothing is logged to the file.

2004-10-27 17:27:33 EDT – ADPlugin: Calling AttributeValueSearch
2004-10-27 17:27:33 EDT – ADPlugin: Search Records called in ADSWrapper
2004-10-27 17:27:33 EDT – ADPlugin: Searching attribute: dsAttrTypeStandard:UniqueID
2004-10-27 17:27:33 EDT – ADPlugin: Search for ObjectWithUID called person with UID = 961826601
2004-10-27 17:27:33 EDT – ADPlugin: Good credentials for macserver2$@INTRANET.DOMAIN.COM
2004-10-27 17:27:33 EDT – ADPlugin: Retrieved connection from connection mgr macserver2$@INTRANET.DOMAIN.COM@AD GC Node:3268
2004-10-27 17:27:33 EDT – ADPlugin: LDAP Error during Search of 81
2004-10-27 17:27:33 EDT – ADPlugin: 16777236 – Put 0 records in Buffer for AttributeValueSearch

Host Name: macserver2.intranet.domain.com
Date/Time: 2004-10-27 17:27:33 -0400
OS Version: 10.3.5 (Build 7M34)
Report Version: 2

Command: DirectoryService
Path: /usr/sbin/DirectoryService
Version: ??? (???)
PID: 451
Thread: 4

Exception: EXC_BAD_ACCESS (0x0001)
Codes: KERN_INVALID_ADDRESS (0x0001) at 0x7265676d

[Anonymous]

it crashed again last night. this time it crashed when it tried to connect to the other AD server. we have two one runs exchange and the other is a backup. it was the backup one that crashed. for historical reasons the backup is called ntserver1 (but it is running win 2000 server).

2004-10-28 03:25:19 EDT – ADPlugin: Searching attribute: dsAttrTypeStandard:UniqueID
2004-10-28 03:25:19 EDT – ADPlugin: Search for ObjectWithUID called person with UID = 233834398
2004-10-28 03:25:19 EDT – ADPlugin: Good credentials for macserver2$@INTRANET.DOMAIN.COM
2004-10-28 03:25:19 EDT – ADPlugin: No connection in connection mgr for macserver2$@INTRANET.DOMAIN.COM@AD GC Node:3268
2004-10-28 03:25:19 EDT – ADPlugin: Secure BIND Session with server ntserver1.intranet.domain.com:3268
2004-10-28 03:25:19 EDT – ADPlugin: LDAP Error during Search of 81
2004-10-28 03:25:19 EDT – ADPlugin: 16777231 – Put 0 records in Buffer for AttributeValueSearch

the following is what was in the samba logs. the mac users usually log in on a pc with windows rip software. i usually see the following in the log when a user tries to log in.

log.smbd

[2004/10/28 09:44:52, 1] /SourceCache/samba/samba-56/samba/source/smbd/sesssetup.c:reply_spnego_kerberos(245)
Username DEC\PC-0311$ is invalid on this system

i also see the following not necessarily related to a user logging in.

nmbd.log

[2004/10/28 09:45:19, 1] /SourceCache/samba/samba-56/samba/source/nsswitch/winbindd_util.c:winbindd_lookup_name_by_sid(429)
Can’t find domain from sid

[Anonymous]

i made two changes to the setup and i (hope) this resolves the issue. so far i so good.

1, the first change i made was to change the order in the directory service authentication pane for all the computers. i listed AD first followed by OD.

initially i had the file server set up to authenticate to OD first then to AD. with that setup passwordserver was crashing ever 2 or 3 seconds. when i changed the order passwordserver stopped crashing, but directoryservice crashed in general once per day.

i then changed the order on the mac clients so that they check AD first and then OD. directoryservice still crashed once per day on the fileserver but when the service ran again clients were able to log in. before changing the order on the clients i would have to sudo kill -9 the directoryservice on the file server to allow them to log in.

i was looking at the contents of some of the files and noticed in the edu.mit.kerberos file that the fqdn for the OD server was incorrect. it contained the reverse record for our old domain. what probably happened is when the company moved we changed our ip network from 10.0.0.0 to 192.168.10.0 and the server records in edu.mit.kerberos file were not updated. they were something like macserver1.intranet.domain.com.in-arpa-0.0.10. i corrected this problem and now the file has the fqdn for the OD server (macserver1.intranet.domain.com) and the logs have a lot less errors in them. so far directory service has not crashed.

[Anonymous]

all but one of the users is in AD. i can move that remaining user from OD to AD.

i was trying to get single sign on for afp, ssh, etc working by following the UNIX centric instructions oin michael bartosh’s article, but could not get it to work. is this one of the issues you refer to?

[Author]

Posts