[OpenAFS] Odd syncing behaviour AFTER upgrade

[Norman P. B. Joseph]

We're using the Transarc patch for our database servers, installed on
Monday after the hubbub this weekend.  Up to now, apparently, without
issue.

But now our help desk is getting calls from irate Windows users whose
accounts were unexpectedly locked.  The help desk admin would check the
account with kas which would say the account was -not- locked, and then
have the user restart the AFS service and/or reboot the desktop, which
usually cleared it up.

But looking at an account today I suspected that maybe the databases
were not in sync, and that the user and the admin were getting different
answers from talking to different servers (we have three).  So I tried
the following with the following results:

% kas exa JoeUser -server server1
  ...
  User is locked forever.
  ...
% kas exa JoeUser -server server2
  ...
  User is not locked.
  ...
% kas exa JoeUser -server server3
  ...
  User is not locked.
  ...

Wait a minute.  Aren't these databases supposed to agree?

I restarted and then checked sync status with udebug on all three
server's kaserver processes and they seem to all agree on who the sync
site is.  There are no odd messages in the server's log files.

Anybody seen this?  What's going on, and how do I fix it?

Thanks,

-- 
 Norman Joseph, Systems Engineer           joseph@ctcgsc.org      IC|XC
 Concurrent Technologies Corporation         814/269.2633         --+--
 Global Systems Center                                            NI|KA

  ***  Be kind, for everyone you meet is fighting a great battle  ***