Chapter 109. Checking IdM replication using Healthcheck
You can test Identity Management (IdM) replication using the Healthcheck tool.
Prerequisites
- You are using RHEL version 8.1 or newer.
109.1. The IdM replication and topology Healthcheck tests
The Healthcheck tool includes tests of the Identity Management (IdM) topology configuration. The tests search for replication conflict issues.
You can find the IPATopologyDomainCheck
and ReplicationConflictCheck
tests under the ipahealthcheck.ipa.topology
and ipahealthcheck.ds.replication
sources of the output of the ipa-healthcheck --list-sources
command.
- IPATopologyDomainCheck
Tests the following configuration:
- No IdM server is disconnected from the topology.
- The IdM servers do not have more than the recommended number of replication agreements.
If the test succeeds, the test returns the configured domains. Otherwise, specific connection errors are reported.
NoteThe test runs the
ipa topologysuffix-verify
command for thedomain
suffix. It also runs the command for theca
suffix if the IdM Certificate Authority server role is configured on this server.- ReplicationConflictCheck
-
Searches for entries in LDAP matching
(&(!(objectclass=nstombstone))(nsds5ReplConflict=*))
.
109.2. Screening replication using Healthcheck
Follow this procedure to run a standalone manual test of your Identity Management (IdM) replication and topology configuration using the Healthcheck tool.
Prerequisites
-
You have
root
privileges.
Procedure
Enter:
ipa-healthcheck --source=ipahealthcheck.ds.replication --source=ipahealthcheck.ipa.topology
# ipa-healthcheck --source=ipahealthcheck.ds.replication --source=ipahealthcheck.ipa.topology
Copy to Clipboard Copied! -
The
--source=ipahealthcheck.ds.replication
and--source=ipahealthcheck.ipa.topology
options ensure that IdM Healthcheck only performs the replication conflict and topology tests.
Four different results are possible:
SUCCESS — the test passed successfully.
{ "source": "ipahealthcheck.ipa.topology", "check": "IPATopologyDomainCheck", "result": "SUCCESS", "kw": { "suffix": "domain" } }
{ "source": "ipahealthcheck.ipa.topology", "check": "IPATopologyDomainCheck", "result": "SUCCESS", "kw": { "suffix": "domain" } }
Copy to Clipboard Copied! - WARNING — the test passed but there might be a problem.
ERROR — the test failed.
{ "source": "ipahealthcheck.ipa.topology", "check": "IPATopologyDomainCheck", "result": "ERROR", "uuid": d6ce3332-92da-423d-9818-e79f49ed321f "when": 20191007115449Z "duration": 0.005943 "kw": { "msg": "topologysuffix-verify domain failed, server2 is not connected (server2_139664377356472 in MainThread)" } }
{ "source": "ipahealthcheck.ipa.topology", "check": "IPATopologyDomainCheck", "result": "ERROR", "uuid": d6ce3332-92da-423d-9818-e79f49ed321f "when": 20191007115449Z "duration": 0.005943 "kw": { "msg": "topologysuffix-verify domain failed, server2 is not connected (server2_139664377356472 in MainThread)" } }
Copy to Clipboard Copied! - CRITICAL — the test failed and it affects the IdM server functionality.
-
The
Run these tests on all IdM servers when trying to check for issues.