The account “sadmin” has been deleted out from under us!

[cam]

We have a new Intel Xserve we recently set up with 10.6 Server. Initially we ran OD, DNS, and DHCP only on the machine while our file shares continued to run on our older 10.4 Servers. When I moved our Xserve RAID off of the old server and onto the Xserve we started experiencing issues where after approximately 24 hours we would have authentication issues connecting via SMB or AFP. Also, when I tried to connect via ARD or SSH I was unable to authenticate. Sometimes I could SSH in as root but others I would have to go to the console directly. A reboot clears the issue but about 24 hours later it comes back.

Looking at the console I see:
3/5/10 8:08:58 AM com.apple.launchd.peruser.501187 (com.apple.PreferenceSyncAgent58171) The account “sadmin” has been deleted out from under us!
3/5/10 8:08:58 AM com.apple.launchd.peruser.501187 (com.apple.PreferenceSyncAgent58171) In a future build of the OS, this error will be fatal.
3/5/10 8:09:23 AM com.apple.launchd.peruser.501187 (com.apple.SubmitDiagInfo58190) The account “sadmin” has been deleted out from under us!
3/5/10 8:09:23 AM com.apple.launchd.peruser.501187 (com.apple.SubmitDiagInfo58190) In a future build of the OS, this error will be fatal.
3/5/10 8:09:29 AM com.apple.launchd.peruser.501187 (0x0-0x61061.com.apple.iCal.helper58201) The account “sadmin” has been deleted out from under us!
3/5/10 8:09:29 AM com.apple.launchd.peruser.501187 (0x0-0x61061.com.apple.iCal.helper58201) In a future build of the OS, this error will be fatal.

(note: iCal service is not running)

Any ideas on this? Daily reboots are annoying.

[cam]

sadmin is the local account created during original setup.

[tlarkin]

Did you upgrade from 10.4 server to 10.6, or did you wipe and reload? I am sure that directory services has had a bit of an overhaul since the release of 10.4.11 all the way to 10.6.2. I know that I had several bug reports filed with Apple and Directory Services with my enterprise support last year.

If you created the sadmin account locally during initial set up of OS X Server, and it cannot read the user, then your local BSD database is corrupting and directory services cannot read that user account.

[cam]

The OS is a fresh install of 10.6, the OD was restored from a backup of our previous 10.5 server, which had previously been migrated from a 10.4 server.

When this occurs not only are we blocked from authenticating with sadmin but AFP and SAMBA connections are refused to workgroup users. A reboot clears all issues.

[tlarkin]

Was it a full back up that included passwords? Or just a plain text export of users/groups? When this problem occurs, what else is shown in the system log and what is shown in the server logs?

[cam]

Full Archive with password. Here is the Console log:

3/4/10 7:09:09 AM com.apple.launchd[1] *** launchd[1] has started up. ***
3/4/10 7:09:17 AM com.apple.SystemStarter[59] Starting Retrospect Client
3/4/10 7:09:17 AM edu.mit.kadmind[54] kadmind: starting…
3/4/10 7:09:23 AM com.apple.launchd.peruser.501[187] (com.apple.ReportCrash) Falling back to default Mach exception handler. Could not find: com.apple.ReportCrash.Self
3/4/10 7:09:23 AM com.apple.launchd[1] (com.apple.CoreRAID) Throttling respawn: Will start in 4 seconds
3/4/10 7:09:24 AM ServerScanner[212] Preference says we shouldn’t scan
3/4/10 7:09:24 AM com.apple.launchd.peruser.501[187] (com.apple.Kerberos.renew.plist[216]) Exited with exit code: 1
3/4/10 7:51:01 AM com.apple.WindowServer[117] Thu Mar 4 07:51:01 manowar.griffininternal.com WindowServer[117] : kCGErrorFailure: Set a breakpoint @ CGErrorBreakpoint() to catch errors as they are logged.
3/4/10 7:51:09 AM Workgroup Manager[1945] *** WARNING: Method selectedRowEnumerator in class RecordListTableView is deprecated. It will be removed in a future release and should no longer be used.
3/4/10 7:51:47 AM Workgroup Manager[1945] *** WARNING: Method selectRow:byExtendingSelection: in class RecordListTableView is deprecated. It will be removed in a future release and should no longer be used.
3/4/10 12:08:24 PM com.apple.AppleFileServer[256] MDSChannelPeerCreate: (os/kern) invalid argument
3/4/10 2:54:10 PM com.apple.afctl[20566] ip6fw: rule 1700: setsockopt(IPV6_FW_DEL): Invalid argument
3/4/10 2:54:11 PM com.apple.afctl[20566] ip6fw: rule 1701: setsockopt(IPV6_FW_DEL): Invalid argument
3/4/10 4:54:10 PM com.apple.afctl[24834] ip6fw: rule 1700: setsockopt(IPV6_FW_DEL): Invalid argument
3/4/10 7:09:30 PM com.apple.launchd[1] (com.apple.suhelperd[29551]) Exited with exit code: 2
3/4/10 11:50:00 PM com.apple.emailrules.nightly[40568] /System/Library/Frameworks/Python.framework/Versions/2.6/Extras/lib/python/zope/__init__.py:1: UserWarning: Module twisted was already imported from /usr/share/caldavd/lib/python/twisted/__init__.pyc, but /System/Library/Frameworks/Python.framework/Versions/2.6/Extras/lib/python is being added to sys.path
3/4/10 11:50:00 PM com.apple.emailrules.nightly[40568] __import__(‘pkg_resources’).declare_namespace(__name__)
3/4/10 11:50:00 PM com.apple.emailrules.nightly[40568] /usr/share/caldavd/lib/python/twisted/mail/smtp.py:10: DeprecationWarning: the MimeWriter module is deprecated; use the email package instead
3/4/10 11:50:00 PM com.apple.emailrules.nightly[40568] import MimeWriter, tempfile, rfc822
3/5/10 12:00:00 AM com.apple.RemoteDesktop.agent[213] stream had too few bytes
3/5/10 12:00:00 AM com.apple.RemoteDesktop.agent[213] stream had too few byte
3/5/10 12:00:00 AM com.apple.RemoteDesktop.agent[213] s
3/5/10 12:00:00 AM com.apple.RemoteDesktop.agent[213] stream had too few by
3/5/10 12:00:00 AM com.apple.RemoteDesktop.agent[213] tes
3/5/10 12:00:00 AM com.apple.RemoteDesktop.agent[213] stream had too fe
3/5/10 12:00:00 AM com.apple.RemoteDesktop.agent[213] w bytes
3/5/10 12:00:00 AM com.apple.RemoteDesktop.agent[213] stream had too few bytes
3/5/10 12:00:00 AM com.apple.RemoteDesktop.agent[213] stream had too few bytes
3/5/10 12:00:00 AM com.apple.RemoteDesktop.agent[213] stream had too
3/5/10 12:00:00 AM com.apple.RemoteDesktop.agent[213] few bytes
3/5/10 12:00:00 AM com.apple.RemoteDesktop.agent[213] stream had too few bytes
3/5/10 12:00:00 AM com.apple.RemoteDesktop.agent[213] stream had too few by
3/5/10 12:00:00 AM com.apple.RemoteDesktop.agent[213] tes
3/5/10 12:00:02 AM com.apple.RemoteDesktop.agent[213] Encountered unexpected E
3/5/10 12:00:02 AM com.apple.RemoteDesktop.agent[213] OF
3/5/10 12:00:02 AM com.apple.RemoteDesktop.agent[213] stream had too few byt
3/5/10 12:00:02 AM com.apple.RemoteDesktop.agent[213] es
3/5/10 12:20:50 AM com.apple.RemoteDesktop.agent[213] SystemFlippers: didn’t consume all data for vers ID 1 (pBase = 0x100308a00, p = 0x100308a25, pEnd = 0x100308a2d)
3/5/10 12:20:50 AM com.apple.RemoteDesktop.agent[213] SystemFlippers: didn’t consume all data for vers ID 1 (pBase = 0x104022980, p = 0x1040229a5, pEnd = 0x1040229ad)
3/5/10 3:09:11 AM com.apple.afctl[47575] ip6fw: rule 1700: setsockopt(IPV6_FW_DEL): Invalid argument
3/5/10 3:15:00 AM com.apple.launchd[1] (com.apple.wikid.logcompressor[47771]) posix_spawn(“/usr/bin/logcompressor.sh”, …): No such file or directory
3/5/10 3:15:00 AM com.apple.launchd[1] (com.apple.wikid.logcompressor[47771]) Exited with exit code: 1
3/5/10 5:00:23 AM ServerScanner[51457] Preference says we shouldn’t scan
3/5/10 7:09:23 AM com.apple.launchd.peruser.501[187] (com.apple.SubmitDiagInfo[56018]) The account “sadmin” has been deleted out from under us!
3/5/10 7:09:23 AM com.apple.launchd.peruser.501[187] (com.apple.SubmitDiagInfo[56018]) In a future build of the OS, this error will be fatal.
3/5/10 7:09:29 AM com.apple.launchd.peruser.501[187] ([0x0-0x60060].com.apple.iCal.helper[56036]) The account “sadmin” has been deleted out from under us!
3/5/10 7:09:29 AM com.apple.launchd.peruser.501[187] ([0x0-0x60060].com.apple.iCal.helper[56036]) In a future build of the OS, this error will be fatal.
3/5/10 7:09:31 AM com.apple.launchd[1] (com.apple.suhelperd[56027]) Exited with exit code: 2
3/5/10 7:24:11 AM com.apple.afctl[56518] ip6fw: rule 1700: setsockopt(IPV6_FW_DEL): Invalid argument
3/5/10 8:08:58 AM com.apple.launchd.peruser.501[187] (com.apple.PreferenceSyncAgent[58171]) The account “sadmin” has been deleted out from under us!
3/5/10 8:08:58 AM com.apple.launchd.peruser.501[187] (com.apple.PreferenceSyncAgent[58171]) In a future build of the OS, this error will be fatal.
3/5/10 8:09:11 AM com.apple.afctl[58172] ip6fw: rule 1700: setsockopt(IPV6_FW_DEL): Invalid argument
3/5/10 8:09:23 AM com.apple.launchd.peruser.501[187] (com.apple.SubmitDiagInfo[58190]) The account “sadmin” has been deleted out from under us!
3/5/10 8:09:23 AM com.apple.launchd.peruser.501[187] (com.apple.SubmitDiagInfo[58190]) In a future build of the OS, this error will be fatal.
3/5/10 8:09:29 AM com.apple.launchd.peruser.501[187] ([0x0-0x61061].com.apple.iCal.helper[58201]) The account “sadmin” has been deleted out from under us!
3/5/10 8:09:29 AM com.apple.launchd.peruser.501[187] ([0x0-0x61061].com.apple.iCal.helper[58201]) In a future build of the OS, this error will be fatal.

[cam]

Things had been running without incident since Friday morning, but just now the server would not allow connection to Workgroup Manager (except from the local machine), ARD, or AFP. I was previously connected so I check Console and saw only:

3/9/10 11:26:43 AM com.apple.AppleFileServer[129] MDSChannelPeerCreate: (os/kern) invalid argument
3/9/10 11:40:28 AM Workgroup Manager[94406] *** WARNING: Method selectedRowEnumerator in class RecordListTableView is deprecated. It will be removed in a future release and should no longer be used.
3/9/10 11:43:34 AM Workgroup Manager[94526] *** WARNING: Method selectedRowEnumerator in class RecordListTableView is deprecated. It will be removed in a future release and should no longer be used.

Also saw a ton of “3/9/10 11:43:34 AM DirectoryService[29] could not load the replica file.” under all messages.

Was about to restart and AFP and ARD connectivity came back, though still couldn’t connect to Workgroup remotely. Rebooted, all seems quiet now.

[tlarkin]

I can not figure out your problem either and google searches point me to your posts here and posts on the apple board. Have you contacted Apple about this? I am taking a total shot in the dark here but it sounds to me like minor BSD database corruption. I could be wrong though.

[Ebonfyre]

Run Activity Monitor in the background and next time it crashes check to see if the DirectoryService process has spiked at 515 threads (if you can). We are experiencing similar problems if we launch Workgroup Manager and our server locks up every time with 515 threads displayed. Many people on the Apple Discussion boards are seeing the same thing.

[Author]

Posts