diff --git a/sources/config_reader.c b/sources/config_reader.c
index 304813f47..74d0fe1d4 100644
--- a/sources/config_reader.c
+++ b/sources/config_reader.c
@@ -769,18 +769,18 @@ static int od_config_reader_storage(od_config_reader_t *reader,
 
 	/* name */
 	if (!od_config_reader_string(reader, &storage->name))
-		return NOT_OK_RESPONSE;
+		goto error;
 
 	if (od_rules_storage_match(reader->rules, storage->name) != NULL) {
 		od_config_reader_error(reader, NULL,
 				       "duplicate storage definition: %s",
 				       storage->name);
-		return NOT_OK_RESPONSE;
+		goto error;
 	}
 	od_rules_storage_add(reader->rules, storage);
 	/* { */
 	if (!od_config_reader_symbol(reader, '{'))
-		return NOT_OK_RESPONSE;
+		goto error;
 
 	for (;;) {
 		od_token_t token;
@@ -789,51 +789,53 @@ static int od_config_reader_storage(od_config_reader_t *reader,
 		switch (rc) {
 		case OD_PARSER_KEYWORD:
 			break;
-		case OD_PARSER_EOF:
+		case OD_PARSER_EOF: {
 			od_config_reader_error(reader, &token,
 					       "unexpected end of config file");
-			return NOT_OK_RESPONSE;
+			goto error;
+		}
 		case OD_PARSER_SYMBOL:
 			/* } */
 			if (token.value.num == '}') {
 				return OK_RESPONSE;
 			}
 			/* fall through */
-		default:
+		default: {
 			od_config_reader_error(
 				reader, &token,
 				"incorrect or unexpected parameter");
-			return NOT_OK_RESPONSE;
+			goto error;
+		}
 		}
 		od_keyword_t *keyword;
 		keyword = od_keyword_match(od_config_keywords, &token);
 		if (keyword == NULL) {
 			od_config_reader_error(reader, &token,
 					       "unknown parameter");
-			return NOT_OK_RESPONSE;
+			goto error;
 		}
 
 		switch (keyword->id) {
 		/* type */
 		case OD_LTYPE:
 			if (!od_config_reader_string(reader, &storage->type))
-				return NOT_OK_RESPONSE;
+				goto error;
 			continue;
 		/* host */
 		case OD_LHOST:
 			if (od_config_reader_storage_host(reader, storage) !=
 			    OK_RESPONSE)
-				return NOT_OK_RESPONSE;
+				goto error;
 			continue;
 		/* port */
 		case OD_LPORT:
 			if (!od_config_reader_number(reader, &storage->port))
-				return NOT_OK_RESPONSE;
+				goto error;
 			continue;
 		/* target_session_attrs */
 		case OD_LTARGET_SESSION_ATTRS:
 			if (!od_config_reader_string(reader, &tmp)) {
-				return NOT_OK_RESPONSE;
+				goto error;
 			}
 
 			if (strcmp(tmp, "read-write") == 0) {
@@ -846,7 +848,7 @@ static int od_config_reader_storage(od_config_reader_t *reader,
 				storage->target_session_attrs =
 					OD_TARGET_SESSION_ATTRS_RO;
 			} else {
-				return NOT_OK_RESPONSE;
+				goto error;
 			}
 
 			free(tmp);
@@ -857,57 +859,62 @@ static int od_config_reader_storage(od_config_reader_t *reader,
 		case OD_LTLS:
 			if (!od_config_reader_string(reader,
 						     &storage->tls_opts->tls))
-				return NOT_OK_RESPONSE;
+				goto error;
 			continue;
 		/* tls_ca_file */
 		case OD_LTLS_CA_FILE:
 			if (!od_config_reader_string(
 				    reader, &storage->tls_opts->tls_ca_file))
-				return NOT_OK_RESPONSE;
+				goto error;
 			continue;
 		/* tls_key_file */
 		case OD_LTLS_KEY_FILE:
 			if (!od_config_reader_string(
 				    reader, &storage->tls_opts->tls_key_file))
-				return NOT_OK_RESPONSE;
+				goto error;
 			continue;
 		/* tls_cert_file */
 		case OD_LTLS_CERT_FILE:
 			if (!od_config_reader_string(
 				    reader, &storage->tls_opts->tls_cert_file))
-				return NOT_OK_RESPONSE;
+				goto error;
 			continue;
 		/* tls_protocols */
 		case OD_LTLS_PROTOCOLS:
 			if (!od_config_reader_string(
 				    reader, &storage->tls_opts->tls_protocols))
-				return NOT_OK_RESPONSE;
+				goto error;
 			continue;
 		/* server_max_routing */
 		case OD_LSERVERS_MAX_ROUTING:
 			if (!od_config_reader_number(
 				    reader, &storage->server_max_routing))
-				return NOT_OK_RESPONSE;
+				goto error;
 			continue;
 		/* watchdog */
 		case OD_LWATCHDOG:
 			storage->watchdog =
 				od_storage_watchdog_allocate(reader->global);
-			if (storage->watchdog == NULL) {
-				return NOT_OK_RESPONSE;
-			}
+			if (storage->watchdog == NULL)
+				goto error;
 			if (od_config_reader_watchdog(reader, storage->watchdog,
 						      extentions) ==
 			    NOT_OK_RESPONSE)
-				return NOT_OK_RESPONSE;
+				goto error;
 			continue;
-		default:
+		default: {
 			od_config_reader_error(reader, &token,
 					       "unexpected parameter");
-			return NOT_OK_RESPONSE;
+			goto error;
+		}
 		}
 	}
 	/* unreach */
+error:
+	if (storage->watchdog) {
+		od_storage_watchdog_free(storage->watchdog);
+	}
+	od_rules_storage_free(storage);
 	return NOT_OK_RESPONSE;
 }
 
diff --git a/sources/ldap.c b/sources/ldap.c
index 0129b0668..a71300849 100644
--- a/sources/ldap.c
+++ b/sources/ldap.c
@@ -358,8 +358,7 @@ od_ldap_server_t *od_ldap_server_pull(od_logger_t *logger, od_rule_t *rule,
 			od_debug(logger, "auth_ldap", NULL, NULL,
 				 "pulling ldap_server from ldap_pool");
 			if (rule->ldap_pool_ttl > 0) {
-				if ((int)time(NULL) -
-					    ldap_server->idle_timestamp >
+				if (time(NULL) - ldap_server->idle_timestamp >
 				    rule->ldap_pool_ttl) {
 					od_debug(
 						logger, "auth_ldap", NULL, NULL,
@@ -418,7 +417,6 @@ od_ldap_server_t *od_ldap_server_pull(od_logger_t *logger, od_rule_t *rule,
 		rc = od_ldap_endpoint_wait(le, timeout);
 
 		if (rc == -1) {
-			od_ldap_endpoint_unlock(le);
 			return NULL;
 		}
 
@@ -476,7 +474,7 @@ static inline od_retcode_t od_ldap_server_attach(od_client_t *client)
 			OD_SERVER_UNDEF);
 		od_ldap_server_free(server);
 	} else {
-		server->idle_timestamp = (int)time(NULL);
+		server->idle_timestamp = time(NULL);
 		od_ldap_server_pool_set(
 			client->rule->ldap_endpoint->ldap_search_pool, server,
 			OD_SERVER_IDLE);
@@ -523,7 +521,7 @@ od_retcode_t od_auth_ldap(od_client_t *cl, kiwi_password_t *tok)
 
 	switch (ldap_rc) {
 	case LDAP_SUCCESS: {
-		serv->idle_timestamp = (int)time(NULL);
+		serv->idle_timestamp = time(NULL);
 		od_ldap_server_pool_set(cl->rule->ldap_endpoint->ldap_auth_pool,
 					serv, OD_SERVER_IDLE);
 		rc = OK_RESPONSE;
@@ -532,7 +530,7 @@ od_retcode_t od_auth_ldap(od_client_t *cl, kiwi_password_t *tok)
 	case LDAP_INVALID_SYNTAX:
 		/* fallthrough */
 	case LDAP_INVALID_CREDENTIALS: {
-		serv->idle_timestamp = (int)time(NULL);
+		serv->idle_timestamp = time(NULL);
 		od_ldap_server_pool_set(cl->rule->ldap_endpoint->ldap_auth_pool,
 					serv, OD_SERVER_IDLE);
 		rc = NOT_OK_RESPONSE;
@@ -654,7 +652,7 @@ od_retcode_t od_ldap_endpoint_free(od_ldap_endpoint_t *le)
 	}
 
 	if (le->ldap_auth_pool) {
-		od_ldap_server_pool_free(le->ldap_search_pool);
+		od_ldap_server_pool_free(le->ldap_auth_pool);
 	}
 
 	pthread_mutex_destroy(&le->lock);
diff --git a/sources/od_ldap.h b/sources/od_ldap.h
index a339f49b6..4a90e9e68 100644
--- a/sources/od_ldap.h
+++ b/sources/od_ldap.h
@@ -13,7 +13,7 @@ typedef struct {
 
 	od_global_t *global;
 	void *route;
-	int idle_timestamp;
+	int64_t idle_timestamp;
 
 	od_list_t link;
 } od_ldap_server_t;
diff --git a/sources/router.c b/sources/router.c
index 0c0aa6f4a..72c88cb75 100644
--- a/sources/router.c
+++ b/sources/router.c
@@ -420,7 +420,7 @@ od_router_status_t od_router_route(od_router_t *router, od_client_t *client)
 		switch (ldap_rc) {
 		case OK_RESPONSE: {
 			od_ldap_endpoint_lock(rule->ldap_endpoint);
-			ldap_server->idle_timestamp = (int)time(NULL);
+			ldap_server->idle_timestamp = time(NULL);
 			od_ldap_server_pool_set(
 				rule->ldap_endpoint->ldap_search_pool,
 				ldap_server, OD_SERVER_IDLE);
@@ -439,7 +439,7 @@ od_router_status_t od_router_route(od_router_t *router, od_client_t *client)
 		}
 		case LDAP_INSUFFICIENT_ACCESS: {
 			od_ldap_endpoint_lock(rule->ldap_endpoint);
-			ldap_server->idle_timestamp = (int)time(NULL);
+			ldap_server->idle_timestamp = time(NULL);
 			od_ldap_server_pool_set(
 				rule->ldap_endpoint->ldap_search_pool,
 				ldap_server, OD_SERVER_IDLE);
diff --git a/sources/rules.c b/sources/rules.c
index 45090137a..e517ca0cd 100644
--- a/sources/rules.c
+++ b/sources/rules.c
@@ -1380,12 +1380,12 @@ void od_rules_print(od_rules_t *rules, od_logger_t *logger)
 			od_log(logger, "rules", NULL, NULL,
 			       "  storage_user                      %s",
 			       rule->storage_user);
-		if (rule->catchup_checks)
+		if (rule->catchup_timeout)
 			od_log(logger, "rules", NULL, NULL,
 			       "  catchup timeout   %d", rule->catchup_timeout);
 		if (rule->catchup_checks)
 			od_log(logger, "rules", NULL, NULL,
-			       "  catchup timeout   %d", rule->catchup_checks);
+			       "  catchup checks    %d", rule->catchup_checks);
 
 		od_log(logger, "rules", NULL, NULL,
 		       "  log_debug                         %s",