title: Got error message „files: Hit reconnection limit“ in radius.log
body: <p>I am, using FreeRadius v3.0.13 for a while. Starting yesterday I  receive the a error message and some users unable to authenticate.</p>
  
  <pre class="lang-sh prettyprint-override"><code>$ radiusd -v
  radiusd: FreeRADIUS Version 3.0.13, for host x86_64-redhat-linux-gnu, built on Apr 26 2019 at 09:30:22
  FreeRADIUS Version 3.0.13
  </code></pre>
  
  <pre class="lang-sh prettyprint-override"><code>$ tail -f /var/log/radius/radius.log | grep reconnection\ limit
  Wed Sep  4 15:26:52 2019 : Auth: (814) Login incorrect (files: Hit reconnection limit): [ut5000@example.org] (from client t5000 port 132416 cli 192.168.0.1)
  </code></pre>
  
  <p>The radius server uses LDAP for authorization (group membership) and authentication (user id / password).</p>
  
  <p>Further investigation has shown that the issue seams to be related to the number of members in the authorization-LDAP-group. At Monday was one new member added and today one was removed – this resolved the issue.</p>
  
  <p>What drives the error message or which config value is affecting the error?</p>
  
  <p>A search in the source code was not helpful. The message is shown in the module <code>rlm_sql</code> but this is not used in my setup. I would expect it is driven from the module <code>rlm_files</code> according to the message itself.</p>
  
  <p>Any help is welcome, thanks</p>
  
  <p>Below are a traces done with <code>raddebug -u ut5000@example.org</code> and filtered for one request (<code>grep -E '^\(30065\)' trace-radius.out</code>)</p>
  
  <pre><code>(30065) Tue Sep 10 11:04:20 2019: Debug: Received Access-Request Id 194 from 192.168.0.135:60602 to 192.168.0.5:1812 length 287
  (30065) Tue Sep 10 11:04:20 2019: Debug:   User-Name = "ut5000@example.org"
  (30065) Tue Sep 10 11:04:20 2019: Debug:   User-Password = "********"
  (30065) Tue Sep 10 11:04:20 2019: Debug:   NAS-Port = 19501056
  (30065) Tue Sep 10 11:04:20 2019: Debug:   Called-Station-Id = "192.168.0.135"
  (30065) Tue Sep 10 11:04:20 2019: Debug:   Calling-Station-Id = "192.168.2.200"
  (30065) Tue Sep 10 11:04:20 2019: Debug:   NAS-Port-Type = Virtual
  (30065) Tue Sep 10 11:04:20 2019: Debug:   Tunnel-Client-Endpoint:0 = "192.168.2.200"
  (30065) Tue Sep 10 11:04:20 2019: Debug:   NAS-IP-Address = 192.168.0.135
  (30065) Tue Sep 10 11:04:20 2019: Debug:   Cisco-AVPair = "audit-session-id=c065c501012880005d776714"
  (30065) Tue Sep 10 11:04:20 2019: Debug:   Cisco-AVPair = "ip:source-ip=192.168.2.200"
  (30065) Tue Sep 10 11:04:20 2019: Debug:   CPVN3000-Tunnel-Group = "sslVPN-tunnel"
  (30065) Tue Sep 10 11:04:20 2019: Debug:   ASA-ClientType = AnyConnect-Client-SSL-VPN
  (30065) Tue Sep 10 11:04:20 2019: Debug:   Cisco-AVPair = "coa-push=true"
  (30065) Tue Sep 10 11:04:20 2019: Debug: # Executing section authorize from file /etc/raddb/sites-enabled/example
  (30065) Tue Sep 10 11:04:20 2019: Debug:   authorize {
  (30065) Tue Sep 10 11:04:20 2019: Debug:     policy filter_username {
  (30065) Tue Sep 10 11:04:20 2019: Debug:       if (&amp;User-Name) {
  (30065) Tue Sep 10 11:04:20 2019: Debug:       if (&amp;User-Name)  -&gt; TRUE
  (30065) Tue Sep 10 11:04:20 2019: Debug:       if (&amp;User-Name)  {
  (30065) Tue Sep 10 11:04:20 2019: Debug:         if (&amp;User-Name =~ / /) {
  (30065) Tue Sep 10 11:04:20 2019: Debug:         if (&amp;User-Name =~ / /)  -&gt; FALSE
  (30065) Tue Sep 10 11:04:20 2019: Debug:         if (&amp;User-Name =~ /@[^@]*@/ ) {
  (30065) Tue Sep 10 11:04:20 2019: Debug:         if (&amp;User-Name =~ /@[^@]*@/ )  -&gt; FALSE
  (30065) Tue Sep 10 11:04:20 2019: Debug:         if (&amp;User-Name =~ /\.\./ ) {
  (30065) Tue Sep 10 11:04:20 2019: Debug:         if (&amp;User-Name =~ /\.\./ )  -&gt; FALSE
  (30065) Tue Sep 10 11:04:20 2019: Debug:         if ((&amp;User-Name =~ /@/) &amp;&amp; (&amp;User-Name !~ /@(.+)\.(.+)$/))  {
  (30065) Tue Sep 10 11:04:20 2019: Debug:         if ((&amp;User-Name =~ /@/) &amp;&amp; (&amp;User-Name !~ /@(.+)\.(.+)$/))   -&gt; FALSE
  (30065) Tue Sep 10 11:04:20 2019: Debug:         if (&amp;User-Name =~ /\.$/)  {
  (30065) Tue Sep 10 11:04:20 2019: Debug:         if (&amp;User-Name =~ /\.$/)   -&gt; FALSE
  (30065) Tue Sep 10 11:04:20 2019: Debug:         if (&amp;User-Name =~ /@\./)  {
  (30065) Tue Sep 10 11:04:20 2019: Debug:         if (&amp;User-Name =~ /@\./)   -&gt; FALSE
  (30065) Tue Sep 10 11:04:20 2019: Debug:       } # if (&amp;User-Name)  = notfound
  (30065) Tue Sep 10 11:04:20 2019: Debug:     } # policy filter_username = notfound
  (30065) Tue Sep 10 11:04:20 2019: Debug:     [preprocess] = ok
  (30065) Tue Sep 10 11:04:20 2019: Debug: suffix: Checking for suffix after "@"
  (30065) Tue Sep 10 11:04:20 2019: Debug: suffix: Looking up realm "example.org" for User-Name = "ut5000@example.org"
  (30065) Tue Sep 10 11:04:20 2019: Debug: suffix: No such realm "example.org"
  (30065) Tue Sep 10 11:04:20 2019: Debug:     [suffix] = noop
  (30065) Tue Sep 10 11:04:20 2019: Debug: files: Searching for user in group "cn=Mgmt-VPN,ou=memberlist,ou=groups,o=example.com"
  (30065) Tue Sep 10 11:04:20 2019: Debug: files: EXPAND (mail=%{%{Stripped-User-Name}:-%{User-Name}})
  (30065) Tue Sep 10 11:04:20 2019: Debug: files:    --&gt; (mail=ut5000@example.org)
  (30065) Tue Sep 10 11:04:20 2019: Debug: files: Performing search in "ou=users,o=example.com" with filter "(mail=ut5000@example.org)", scope "sub"
  (30065) Tue Sep 10 11:04:20 2019: Debug: files: Waiting for search result...
  (30065) Tue Sep 10 11:04:20 2019: Debug: files: User object found at DN "uid=ZZ00BM043,ou=users,o=example.com"
  (30065) Tue Sep 10 11:04:20 2019: Debug: files: Checking for user in group objects
  (30065) Tue Sep 10 11:04:20 2019: Debug: files:   EXPAND (uniquemember=%{control:Ldap-UserDN})
  (30065) Tue Sep 10 11:04:20 2019: Debug: files:      --&gt; (uniquemember=uid\3dZZ00BM043\2cou\3dusers\2co\3dexample.com)
  (30065) Tue Sep 10 11:04:20 2019: Debug: files:   Performing search in "cn=Mgmt-VPN,ou=memberlist,ou=groups,o=example.com" with filter "(uniquemember=uid\3dZZ00BM043\2cou\3dusers\2co\3dexample.com)", scope "base"
  (30065) Tue Sep 10 11:04:20 2019: Debug: files:   Waiting for search result...
  (30065) Tue Sep 10 11:04:22 2019: WARNING: files:   Search failed: Can't contact LDAP server. Got new socket, retrying...
  (30065) Tue Sep 10 11:04:22 2019: Debug: files:   Waiting for search result...
  (30065) Tue Sep 10 11:04:24 2019: WARNING: files:   Search failed: Can't contact LDAP server. Got new socket, retrying...
  (30065) Tue Sep 10 11:04:24 2019: Debug: files:   Waiting for search result...
  (30065) Tue Sep 10 11:04:26 2019: WARNING: files:   Search failed: Can't contact LDAP server. Got new socket, retrying...
  (30065) Tue Sep 10 11:04:26 2019: Debug: files:   Waiting for search result...
  (30065) Tue Sep 10 11:04:27 2019: WARNING: files:   Search failed: Can't contact LDAP server. Got new socket, retrying...
  (30065) Tue Sep 10 11:04:27 2019: Debug: files:   Waiting for search result...
  (30065) Tue Sep 10 11:04:29 2019: WARNING: files:   Search failed: Can't contact LDAP server. Got new socket, retrying...
  (30065) Tue Sep 10 11:04:29 2019: Debug: files:   Waiting for search result...
  (30065) Tue Sep 10 11:04:31 2019: WARNING: files:   Search failed: Can't contact LDAP server. Got new socket, retrying...
  (30065) Tue Sep 10 11:04:31 2019: Debug: files:   Waiting for search result...
  (30065) Tue Sep 10 11:04:34 2019: WARNING: files:   Search failed: Can't contact LDAP server. Got new socket, retrying...
  (30065) Tue Sep 10 11:04:34 2019: Debug: files:   Waiting for search result...
  (30065) Tue Sep 10 11:04:37 2019: WARNING: files:   Search failed: Can't contact LDAP server. Got new socket, retrying...
  (30065) Tue Sep 10 11:04:37 2019: Debug: files:   Waiting for search result...
  (30065) Tue Sep 10 11:04:39 2019: WARNING: files:   Search failed: Can't contact LDAP server. Got new socket, retrying...
  (30065) Tue Sep 10 11:04:39 2019: Debug: files:   Waiting for search result...
  (30065) Tue Sep 10 11:04:41 2019: WARNING: files:   Search failed: Can't contact LDAP server. Got new socket, retrying...
  (30065) Tue Sep 10 11:04:41 2019: Debug: files:   Waiting for search result...
  (30065) Tue Sep 10 11:04:42 2019: WARNING: files:   Search failed: Can't contact LDAP server. Got new socket, retrying...
  (30065) Tue Sep 10 11:04:42 2019: Debug: files:   Waiting for search result...
  (30065) Tue Sep 10 11:04:44 2019: WARNING: files:   Search failed: Can't contact LDAP server. Got new socket, retrying...
  (30065) Tue Sep 10 11:04:44 2019: Debug: files:   Waiting for search result...
  (30065) Tue Sep 10 11:04:47 2019: WARNING: files:   Search failed: Can't contact LDAP server. Got new socket, retrying...
  (30065) Tue Sep 10 11:04:47 2019: ERROR: files:   Hit reconnection limit
  (30065) Tue Sep 10 11:04:47 2019: Debug: files: User is not a member of "cn=Mgmt-VPN,ou=memberlist,ou=groups,o=example.com"
  (30065) Tue Sep 10 11:04:47 2019: Debug:     [files] = noop
  (30065) Tue Sep 10 11:04:47 2019: Debug:     [expiration] = noop
  (30065) Tue Sep 10 11:04:47 2019: Debug:     [logintime] = noop
  (30065) Tue Sep 10 11:04:47 2019: WARNING: pap: No "known good" password found for the user.  Not setting Auth-Type
  (30065) Tue Sep 10 11:04:47 2019: WARNING: pap: Authentication will fail unless a "known good" password is available
  (30065) Tue Sep 10 11:04:47 2019: Debug:     [pap] = noop
  (30065) Tue Sep 10 11:04:47 2019: Debug:   } # authorize = ok
  (30065) Tue Sep 10 11:04:47 2019: ERROR: No Auth-Type found: rejecting the user via Post-Auth-Type = Reject
  (30065) Tue Sep 10 11:04:47 2019: Debug: Failed to authenticate the user
  (30065) Tue Sep 10 11:04:47 2019: Debug: Using Post-Auth-Type Reject
  (30065) Tue Sep 10 11:04:47 2019: Debug: # Executing group from file /etc/raddb/sites-enabled/example
  (30065) Tue Sep 10 11:04:47 2019: Debug:   Post-Auth-Type REJECT {
  (30065) Tue Sep 10 11:04:47 2019: Debug: attr_filter.access_reject: EXPAND %{User-Name}
  (30065) Tue Sep 10 11:04:47 2019: Debug: attr_filter.access_reject:    --&gt; ut5000@example.org
  (30065) Tue Sep 10 11:04:47 2019: Debug: attr_filter.access_reject: Matched entry DEFAULT at line 11
  (30065) Tue Sep 10 11:04:47 2019: Debug:     [attr_filter.access_reject] = updated
  (30065) Tue Sep 10 11:04:47 2019: Debug:   } # Post-Auth-Type REJECT = updated
  (30065) Tue Sep 10 11:04:47 2019: Debug: Delaying response for 1.000000 seconds
  (30065) Tue Sep 10 11:04:58 2019: Debug: Sending delayed response
  (30065) Tue Sep 10 11:04:58 2019: Debug: Sent Access-Reject Id 194 from 192.168.0.5:1812 to 192.168.0.135:60602 length 20
  (30065) Tue Sep 10 11:04:58 2019: Debug: Cleaning up request packet ID 194 with timestamp +504084
  </code></pre>
  
  <p>In contrast the same user using another group (smaller) works.</p>
  
  <pre><code>(30151) Tue Sep 10 11:31:39 2019: Debug: Received Access-Request Id 202 from 192.168.0.135:60602 to 192.168.0.5:1812 length 290
  (30151) Tue Sep 10 11:31:39 2019: Debug:   User-Name = "ut5000@example.org"
  (30151) Tue Sep 10 11:31:39 2019: Debug:   User-Password = "********"
  (30151) Tue Sep 10 11:31:39 2019: Debug:   NAS-Port = 19533824
  (30151) Tue Sep 10 11:31:39 2019: Debug:   Called-Station-Id = "192.168.0.135"
  (30151) Tue Sep 10 11:31:39 2019: Debug:   Calling-Station-Id = "192.168.2.200"
  (30151) Tue Sep 10 11:31:39 2019: Debug:   NAS-Port-Type = Virtual
  (30151) Tue Sep 10 11:31:39 2019: Debug:   Tunnel-Client-Endpoint:0 = "192.168.2.200"
  (30151) Tue Sep 10 11:31:39 2019: Debug:   NAS-IP-Address = 192.168.0.135
  (30151) Tue Sep 10 11:31:39 2019: Debug:   Cisco-AVPair = "audit-session-id=c065c501012b00005d776d7b"
  (30151) Tue Sep 10 11:31:39 2019: Debug:   Cisco-AVPair = "ip:source-ip=192.168.2.200"
  (30151) Tue Sep 10 11:31:39 2019: Debug:   CPVN3000-Tunnel-Group = "sslVPN-ng-tunnel"
  (30151) Tue Sep 10 11:31:39 2019: Debug:   ASA-ClientType = AnyConnect-Client-SSL-VPN
  (30151) Tue Sep 10 11:31:39 2019: Debug:   Cisco-AVPair = "coa-push=true"
  (30151) Tue Sep 10 11:31:39 2019: Debug: # Executing section authorize from file /etc/raddb/sites-enabled/example
  (30151) Tue Sep 10 11:31:39 2019: Debug:   authorize {
  (30151) Tue Sep 10 11:31:39 2019: Debug:     policy filter_username {
  (30151) Tue Sep 10 11:31:39 2019: Debug:       if (&amp;User-Name) {
  (30151) Tue Sep 10 11:31:39 2019: Debug:       if (&amp;User-Name)  -&gt; TRUE
  (30151) Tue Sep 10 11:31:39 2019: Debug:       if (&amp;User-Name)  {
  (30151) Tue Sep 10 11:31:39 2019: Debug:         if (&amp;User-Name =~ / /) {
  (30151) Tue Sep 10 11:31:39 2019: Debug:         if (&amp;User-Name =~ / /)  -&gt; FALSE
  (30151) Tue Sep 10 11:31:39 2019: Debug:         if (&amp;User-Name =~ /@[^@]*@/ ) {
  (30151) Tue Sep 10 11:31:39 2019: Debug:         if (&amp;User-Name =~ /@[^@]*@/ )  -&gt; FALSE
  (30151) Tue Sep 10 11:31:39 2019: Debug:         if (&amp;User-Name =~ /\.\./ ) {
  (30151) Tue Sep 10 11:31:39 2019: Debug:         if (&amp;User-Name =~ /\.\./ )  -&gt; FALSE
  (30151) Tue Sep 10 11:31:39 2019: Debug:         if ((&amp;User-Name =~ /@/) &amp;&amp; (&amp;User-Name !~ /@(.+)\.(.+)$/))  {
  (30151) Tue Sep 10 11:31:39 2019: Debug:         if ((&amp;User-Name =~ /@/) &amp;&amp; (&amp;User-Name !~ /@(.+)\.(.+)$/))   -&gt; FALSE
  (30151) Tue Sep 10 11:31:39 2019: Debug:         if (&amp;User-Name =~ /\.$/)  {
  (30151) Tue Sep 10 11:31:39 2019: Debug:         if (&amp;User-Name =~ /\.$/)   -&gt; FALSE
  (30151) Tue Sep 10 11:31:39 2019: Debug:         if (&amp;User-Name =~ /@\./)  {
  (30151) Tue Sep 10 11:31:39 2019: Debug:         if (&amp;User-Name =~ /@\./)   -&gt; FALSE
  (30151) Tue Sep 10 11:31:39 2019: Debug:       } # if (&amp;User-Name)  = notfound
  (30151) Tue Sep 10 11:31:39 2019: Debug:     } # policy filter_username = notfound
  (30151) Tue Sep 10 11:31:39 2019: Debug:     [preprocess] = ok
  (30151) Tue Sep 10 11:31:39 2019: Debug: suffix: Checking for suffix after "@"
  (30151) Tue Sep 10 11:31:39 2019: Debug: suffix: Looking up realm "example.org" for User-Name = "ut5000@example.org"
  (30151) Tue Sep 10 11:31:39 2019: Debug: suffix: No such realm "example.org"
  (30151) Tue Sep 10 11:31:39 2019: Debug:     [suffix] = noop
  (30151) Tue Sep 10 11:31:39 2019: Debug: files: Searching for user in group "cn=NG-SSL-VPN,ou=memberlist,ou=groups,o=example.org"
  (30151) Tue Sep 10 11:31:39 2019: Debug: files: EXPAND (mail=%{%{Stripped-User-Name}:-%{User-Name}})
  (30151) Tue Sep 10 11:31:39 2019: Debug: files:    --&gt; (mail=ut5000@example.org)
  (30151) Tue Sep 10 11:31:39 2019: Debug: files: Performing search in "ou=users,o=example.org" with filter "(mail=ut5000@example.org)", scope "sub"
  (30151) Tue Sep 10 11:31:39 2019: Debug: files: Waiting for search result...
  (30151) Tue Sep 10 11:31:40 2019: Debug: files: User object found at DN "uid=ZZ00BM043,ou=users,o=example.org"
  (30151) Tue Sep 10 11:31:40 2019: Debug: files: Checking for user in group objects
  (30151) Tue Sep 10 11:31:40 2019: Debug: files:   EXPAND (uniquemember=%{control:Ldap-UserDN})
  (30151) Tue Sep 10 11:31:40 2019: Debug: files:      --&gt; (uniquemember=uid\3dZZ00BM043\2cou\3dusers\2co\3dexample.org)
  (30151) Tue Sep 10 11:31:40 2019: Debug: files:   Performing search in "cn=NG-SSL-VPN,ou=memberlist,ou=groups,o=example.org" with filter "(uniquemember=uid\3dZZ00BM043\2cou\3dusers\2co\3dexample.org)", scope "base"
  (30151) Tue Sep 10 11:31:40 2019: Debug: files:   Waiting for search result...
  (30151) Tue Sep 10 11:31:40 2019: Debug: files: User found in group object "cn=NG-SSL-VPN,ou=memberlist,ou=groups,o=example.org"
  (30151) Tue Sep 10 11:31:40 2019: Debug: files: users: Matched entry DEFAULT at line 31
  (30151) Tue Sep 10 11:31:40 2019: Debug:     [files] = ok
  (30151) Tue Sep 10 11:31:40 2019: Debug:     [expiration] = noop
  (30151) Tue Sep 10 11:31:40 2019: Debug:     [logintime] = noop
  (30151) Tue Sep 10 11:31:40 2019: WARNING: pap: No "known good" password found for the user.  Not setting Auth-Type
  (30151) Tue Sep 10 11:31:40 2019: WARNING: pap: Authentication will fail unless a "known good" password is available
  (30151) Tue Sep 10 11:31:40 2019: Debug:     [pap] = noop
  (30151) Tue Sep 10 11:31:40 2019: Debug:   } # authorize = ok
  (30151) Tue Sep 10 11:31:40 2019: Debug: Found Auth-Type = users
  (30151) Tue Sep 10 11:31:40 2019: Debug: # Executing group from file /etc/raddb/sites-enabled/example
  (30151) Tue Sep 10 11:31:40 2019: Debug:   Auth-Type users {
  (30151) Tue Sep 10 11:31:40 2019: Debug: users: Login attempt by "ut5000@example.org"
  (30151) Tue Sep 10 11:31:40 2019: Debug: users: Using user DN from request "uid=ZZ00BM043,ou=users,o=example.org"
  (30151) Tue Sep 10 11:31:40 2019: Debug: users: Waiting for bind result...
  (30151) Tue Sep 10 11:31:40 2019: Debug: users: Bind successful
  (30151) Tue Sep 10 11:31:40 2019: Debug: users: Bind as user "uid=ZZ00BM043,ou=users,o=example.org" was successful
  (30151) Tue Sep 10 11:31:40 2019: Debug:     [users] = ok
  (30151) Tue Sep 10 11:31:40 2019: Debug:   } # Auth-Type users = ok
  (30151) Tue Sep 10 11:31:40 2019: Debug: # Executing section post-auth from file /etc/raddb/sites-enabled/example
  (30151) Tue Sep 10 11:31:40 2019: Debug:   post-auth {
  (30151) Tue Sep 10 11:31:40 2019: Debug:     update {
  (30151) Tue Sep 10 11:31:40 2019: Debug:       No attributes updated
  (30151) Tue Sep 10 11:31:40 2019: Debug:     } # update = noop
  (30151) Tue Sep 10 11:31:40 2019: Debug:     [exec] = noop
  (30151) Tue Sep 10 11:31:40 2019: Debug:   } # post-auth = noop
  (30151) Tue Sep 10 11:31:40 2019: Debug: Sent Access-Accept Id 202 from 192.168.0.5:1812 to 192.168.0.135:60602 length 0
  (30151) Tue Sep 10 11:31:40 2019: Debug: Finished request
  (30151) Tue Sep 10 11:31:45 2019: Debug: Cleaning up request packet ID 202 with timestamp +505723
  </code></pre>
  
  <p>After spending some time to do ldapsearch and iptraces. It seems the issue is caused by an old load-balancer. One frame of the encrypted response is not proper handled.</p>
  
  <p><strong>Background</strong>
  The LDAP server response with two answer to the query.</p>
  
  <p>Example correct:</p>
  
  <pre><code># extended LDIF
  #
  # LDAPv3
  # base &lt;cn=NG-SSL-VPN,ou=memberlist,ou=groups,o=example.com&gt; with scope baseObject
  # filter: (uniquemember=uid\3dZZ00BM043\2cou\3dusers\2co\3dexample.com)
  # requesting: ALL
  #
  
  # NG-SSL-VPN, memberlist, groups, example.com
  objectClass: groupOfUniqueNames
  objectClass: top
  ou: memberlist
  …
  
  # search result
  search: 2
  result: 0 Success
  
  # numResponses: 2
  # numEntries: 1
  </code></pre>
  
  <p>Example corrupted:</p>
  
  <pre><code># extended LDIF
  #
  # LDAPv3
  # base &lt;cn=Mgmt-VPN,ou=memberlist,ou=groups,o=example.com&gt; with scope baseObject
  # filter: (uniquemember=uid\3dZZ00BM043\2cou\3dusers\2co\3dexample.com)
  # requesting: ALL
  #
  
  # Mgmt-VPN, memberlist, groups, example.com
  objectClass: groupOfUniqueNames
  objectClass: top
  ou: memberlist
  …
  
  # numResponses: 1
  # numEntries: 1
  ldap_result: Can't contact LDAP server (-1)
  </code></pre>
  
  <p>The first answer contains the member list for the group and the second is the search result. In case of the error the second record is destroyed in some way.</p>