Q: What is "Locker killed to resolve a deadlock"

Many Open Directory problems can be resolved by taking the following steps. Test after each one, and back up all data before making any changes.

1. The OD master must have a static IP address on the local network, not a dynamic address.

2. You must have a working DNS service, and the server's hostname must match its fully-qualified domain name. To confirm, select the server by name in the sidebar of the Server application window, then select the Overview tab. Click the Edit button on the Host Name line. On the Accessing your Server sheet, Domain Name should be selected. Change the Host Name, if necessary. The server must have at least a three-level name (e.g. "server.yourdomain.com"), and the name must not be in the ".local" top-level domain, which is reserved for Bonjour.

3. The primary DNS server used by the server must be 127.0.0.1 (that is, itself) unless you're using another server for internal DNS. The only DNS server set on the clients should be the internal one, which they should get from DHCP if applicable.

4. Follow these instructions to rebuild the Kerberos configuration on the master.

5. If you use authenticated binding, check the validity of the master's certificate. The common name must match the hostname and domain name. Deselecting and then reselecting the certificate in Server.app has been reported to have an effect in some cases.

6. Unbind and then rebind the clients in the Users & Groups preference pane. Use the fully-qualified domain name of the master.

7. Reboot the master and the clients.

8. Don't log in to the server with a network user's account.

9. As a last resort, export all OD users. In the Open Directory pane of Server, delete the OD server. Then recreate it and import the users. Ensure that the UID's are in the 1001+ range.

@Linc Davis. The instructions you pointed to, to rebuild the Kerberos configuration on the master, state that these are for OS X Server on Mavericks and not to be used on Yosemite.  Do you know what needs to be done differently? I have `slapconfig -restoredb` after `diskutil repairPermissions` but still list_server seems to ignore some users's and I am trying to eliminate OD as the culprit. These `DB_LOCK_DEADLOCK` messages flooding the LDAP log made me look to try to ensure everything related to OD got some attention.

...  => bdb_idl_insert_key: c_get failed: DB_LOCK_DEADLOCK: Locker killed to resolve a deadlock (-30994)
...: conn=1606 op=5: attribute "entryCSN" index add failure

I don't now think OD is the cause of my current concern. More to do with how list_server chooses which of a user's several email addresses to use. If the domain part of the user's primary (or ..  chosen by list_server by some means or other) email address is a virtual domain and not the server's own domain (even though the server is serving the virtual domain) then the user is not  included in the list.

More diagnostic info to nail this problem but ... for now those troublesome log messages about db deadlocks are going to have to wait.