We have a DSFW server running OES2SP3 w/ all the current patches.

We have an issue with ndsd dying about every 5 or 7 days. Users will be unable to login in.

A "rcndsd statsu" shows it as dead. Doing a restart of ndsd fixes the issue. A reload of xadcntrl works too.

But I'm not finding much in the logs to indicate the problem. There is no core file and the /var/log/messages shows ldap calls start to fail but nothing to indicate why ndsd is failing.

The ndsd.log file continues to log messages even when its "dead", which seem to indicate the process is still running.

Here are two excerpts from the logs.
1. When its working we get these in the logs:

Jan 19 08:47:35 Listener connectionless port 389 is already in use
Jan 19 08:47:35 Listener cleartext port 3268 is already in use
Jan 19 08:47:35 Listener TLS port 3269 is already in use
Jan 19 08:47:58 Listener connectionless port 389 is already in use
Jan 19 08:47:58 Listener cleartext port 3268 is already in use
Jan 19 08:47:58 Listener TLS port 3269 is already in use

2. When its dead the messages change a bit to this:
Jan 19 02:36:43 Listener connectionless port 389 is already in use
Jan 19 04:46:58 Listener connectionless port 389 is already in use
Jan 19 04:46:58 Listener cleartext port 3268 is already in use
Jan 19 04:46:58 Listener TLS port 3269 is already in use
Jan 19 04:47:34 Listener connectionless port 389 is already in use
Jan 19 05:35:43 Could not get local interfaces,-709
Jan 19 05:35:43 Could not get local interfaces,-709
Jan 19 05:35:43 Could not get local interfaces,-709
Jan 19 05:35:43 Could not get local interfaces,-709
Jan 19 05:35:43 Could not get local interfaces,-709

Other than that I'm not seeing anything else in the logs. Anyone know where to start?

The messages about the port already in use seem weird, but DSFW works fine despite them. You can add new workstations to the domain and authenticate fine.

I wasnt able to find much on the 709 error. I think it might be reference to an "out of sockets" message

Thanks