Using IdM Healthcheck to monitor your IdM environment

• Replication issues
• Certificate validity
• Certificate authority infrastructure issues
• IdM and Active Directory trust issues
• Correct file permissions and ownership settings

• json: Machine-readable output in JSON format (default)
• human: Human-readable output

Prerequisites

• You are logged in as root.

Procedure

• Install the ipa-healthcheck package:

  [root@server ~]# dnf install ipa-healthcheck

  Copy to Clipboard

Verification

• Perform a basic Healthcheck test:

  [root@server ~]# ipa-healthcheck
  []

  Copy to Clipboard

  The empty square brackets [] indicate a fully-functioning IdM installation.

• Manually
• Automatically by using log rotation.

Prerequisites

• The Healthcheck tool is installed. See Installing IdM Healthcheck.

• The systemd timer to run the Healthcheck tool periodically and generate the logs.
• The crond service to ensure log rotation.

Prerequisites

• You have root privileges.

Prerequisites

• Your system is running RHEL 9.1 or later.
• You have root privileges.
• You have previously configured log rotation on a timer.

• certmonger
• dirsrv
• gssproxy
• httpd
• ipa_custodia
• ipa_otpd
• kadmin
• krb5kdc
• named
• ods_enforcerd
• ipa_dnskeysyncd
• pki_tomcatd
• sssd
• chronyd
• smb
• winbind

Procedure

• Enter:

  # ipa-healthcheck --source=ipahealthcheck.meta.services

  Copy to Clipboard
  • The --source=ipahealthcheck.meta.services option ensures that IdM Healthcheck only performs the services test.
  • The --failures-only option is enabled by default and it ensures that IdM Healthcheck only reports warnings, errors and critical issues.

  A successful test displays empty brackets:

  [ ]

  Copy to Clipboard

  If one of the services fails, the result can looks similarly to this example:

  {
    "source": "ipahealthcheck.meta.services",
    "check": "httpd",
    "result": "ERROR",
    "kw": {
      "status": false,
      "msg": "httpd: not running"
    }
  }

  Copy to Clipboard
  Note

  Run this test on all IdM servers when trying to discover issues.

• The minimum raw free bytes needed.
• The percentage — the minimum free disk space is hardcoded to 20%.

• Logging
• Execution
• Backups

Procedure

• Enter:

  # ipa-healthcheck --source=ipahealthcheck.system.filesystemspace

  Copy to Clipboard
  • The --source=ipahealthcheck.meta.services option ensures that IdM Healthcheck only performs the disk space test.

• Including only ownership and permissions tests: --source=ipahealthcheck.ipa.files

Prerequisites

• You have root privileges.

Procedure

• Enter:

  # ipa-healthcheck --source ipahealthcheck.ipa.idns

  Copy to Clipboard

  • The --source ipahealthcheck.ipa.idns option ensures that IdM Healthcheck only performs the DNS records test.

    If the record is resolvable, the test returns SUCCESS as a result:

    {
        "source": "ipahealthcheck.ipa.idns",
        "check": "IPADNSSystemRecordsCheck",
        "result": "SUCCESS",
        "uuid": "eb7a3b68-f6b2-4631-af01-798cac0eb018",
        "when": "20200415143339Z",
        "duration": "0.210471",
        "kw": {
          "key": "_ldap._tcp.idm.example.com.:server1.idm.example.com."
        }
    }

    Copy to Clipboard

    The test returns a WARNING when, for example, the number of records does not match the expected number:

  {
      "source": "ipahealthcheck.ipa.idns",
      "check": "IPADNSSystemRecordsCheck",
      "result": "WARNING",
      "uuid": "972b7782-1616-48e0-bd5c-49a80c257895",
      "when": "20200409100614Z",
      "duration": "0.203049",
      "kw": {
        "msg": "Got {count} ipa-ca A records, expected {expected}",
        "count": 2,
        "expected": 1
      }
  }

  Copy to Clipboard

Prerequisites

• You have root privileges.

Procedure

• Enter:

  # ipa-healthcheck --source=ipahealthcheck.ds.replication --source=ipahealthcheck.ipa.topology

  Copy to Clipboard
  • The --source=ipahealthcheck.ds.replication and --source=ipahealthcheck.ipa.topology options ensure that IdM Healthcheck only performs the replication conflict and topology tests.

  Four different results are possible:

  • SUCCESS — the test passed successfully.

    {
      "source": "ipahealthcheck.ipa.topology",
      "check": "IPATopologyDomainCheck",
      "result": "SUCCESS",
      "kw": {
        "suffix": "domain"
      }
    }

    Copy to Clipboard
  • WARNING — the test passed but there might be a problem.

  • ERROR — the test failed.

    {
      "source": "ipahealthcheck.ipa.topology",
      "check": "IPATopologyDomainCheck",
      "result": "ERROR",
      "uuid": d6ce3332-92da-423d-9818-e79f49ed321f
      "when": 20191007115449Z
      "duration": 0.005943
      "kw": {
        "msg": "topologysuffix-verify domain failed, server2 is not connected (server2_139664377356472 in MainThread)"
      }
    }

    Copy to Clipboard
  • CRITICAL — the test failed and it affects the IdM server functionality.

• Healthcheck in IdM

Procedure

• Enter:

  # ipa-healthcheck --source=ipahealthcheck.ipa.trust --failures-only

  Copy to Clipboard
  • The --source=ipahealthcheck.ipa.trust option ensures that IdM Healthcheck only performs the trust tests.

Procedure

• Enter:

  # ipa-healthcheck --source=ipahealthcheck.dogtag.ca

  Copy to Clipboard
  • The --source=ipahealthcheck.dogtag.ca option ensures that Healthcheck only performs the certificate tests.

Prerequisites

• You have root privileges.

Procedure

• Enter:

  # ipa-healthcheck --source=ipahealthcheck.ipa.certs --failures-only

  Copy to Clipboard

  • The --source=ipahealthcheck.ipa.certs option ensures that IdM Healthcheck only performs the certmonger certificate tests.

    Successful test displays empty brackets:

    []

    Copy to Clipboard

    Failed test shows you the following output:

    {
      "source": "ipahealthcheck.ipa.certs",
      "check": "IPACertfileExpirationCheck",
      "result": "ERROR",
      "kw": {
        "key": 1234,
        "dbdir": "/path/to/nssdb",
        "error": [error],
        "msg": "Unable to open NSS database '/path/to/nssdb': [error]"
      }
    }

    Copy to Clipboard

  This IPACertfileExpirationCheck test failed on opening the NSS database.