Red Hat Summit Red Hat SummitSupportoConsoleSviluppatoriInizia una provaContatti

Questo contenuto non è disponibile nella lingua selezionata.

Chapter 1. Installing and running the IdM Healthcheck tool

Learn more about the IdM Healthcheck tool and how to install and run it.

Note
  • The Healthcheck tool is only available on RHEL 8.1 or later.

1.1. Healthcheck in IdM
Copia collegamento

The Healthcheck command line tool in Identity Management (IdM) helps find issues that can impact the performance of your IdM environment. Using Healthcheck, you can identify an issue in advance so that you can correct it before it becomes critical.

Note

You can use Healthcheck without obtaining a Kerberos ticket.

Modules are independent

Healthcheck consists of independent modules which check for:

  • Replication issues
  • Certificate validity
  • Certificate authority infrastructure issues
  • IdM and Active Directory trust issues
  • Correct file permissions and ownership settings

Output formats and destination

You can set the following types of output for Healthcheck to generate by using the output-type option:

  • json: Machine-readable output in JSON format (default)
  • human: Human-readable output

You can specify a file to store the output by using the --output-file option.

Results

Each Healthcheck module returns one of the following results:

SUCCESS
The system is configured as expected.
WARNING
It is advisable to monitor or evaluate the configuration.
ERROR
The system is not configured as expected.
CRITICAL
The configuration is not as expected, with a significant potential to impact the functioning of your IdM deployment.

1.2. Installing IdM Healthcheck
Copia collegamento

Learn how you can install the IdM Healthcheck tool.

Prerequisites

  • You are logged in as root.

Procedure

  • Install the ipa-healthcheck package: 

    [root@server ~]# yum install ipa-healthcheck
    Copy to Clipboard Toggle word wrap
    Note

    On RHEL 8.1 and 8.2 systems, use the yum install /usr/bin/ipa-healthcheck command instead.

Verification

  • Perform a basic Healthcheck test: 

    [root@server ~]# ipa-healthcheck
[]
    Copy to Clipboard Toggle word wrap

    The empty square brackets [] indicate a fully-functioning IdM installation.

1.3. Running IdM Healthcheck
Copia collegamento

You can execute Healthcheck tests in one of the following ways:

This section describes how to execute the tests manually.

Prerequisites

Procedure

  1. [Optional] To display a list of all available Healthcheck tests, enter: 

    [root@server ~]# ipa-healthcheck --list-sources
    Copy to Clipboard Toggle word wrap

  2. To run the Healthcheck utility, enter: 

    [root@server ~]# ipa-healthcheck
    Copy to Clipboard Toggle word wrap

1.4. Log rotation
Copia collegamento

Log rotation creates a new log file every day and the files are organized by date. The date is included in the filename.

Using log rotation, you can configure the maximum number of log files to be stored. If this number is exceeded, the newest file replaces the oldest one. For example, if the maximum rotation number is thirty, the thirty-first log file replaces the first, that is the oldest one.

Log rotation reduces voluminous log files and organizes them. This helps you analyze the logs.

1.5. Running IdM Healthcheck on a schedule
Copia collegamento

Follow this procedure to configure IdM Healthcheck to run on a schedule. This includes configuring the following utilities:

  • The systemd timer to run the Healthcheck tool periodically and generate the logs.
  • The crond service to ensure log rotation.

The default log name is healthcheck.log and the rotated logs use the healthcheck.log-YYYYMMDD format.

Note

The Healthcheck timer tool is not a real-time tool. It is only meant to be run a few times an hour. If you require real-time monitoring of, for example, services or disk space, use a different tool.

Prerequisites

  • You have root privileges.

Procedure

  1. Enable a systemd timer: 

    # systemctl enable ipa-healthcheck.timer
Created symlink /etc/systemd/system/multi-user.target.wants/ipa-healthcheck.timer -> /usr/lib/systemd/system/ipa-healthcheck.timer.
    Copy to Clipboard Toggle word wrap

  2. Start the systemd timer: 

    # systemctl start ipa-healthcheck.timer
    Copy to Clipboard Toggle word wrap

  3. Open the /etc/logrotate.d/ipahealthcheck file to configure the number of logs you want to be saved: 

    [...]
    rotate 30
}
    Copy to Clipboard Toggle word wrap

    By default, logs are stored for 30 days before they are overwritten by newer logs.

  4. In the same file, configure the path to the file storing the logs. 

    /var/log/ipa/healthcheck/healthcheck.log {
[...]
    Copy to Clipboard Toggle word wrap

    By default, logs are saved in the /var/log/ipa/healthcheck/ directory.

  5. Save the file.

  6. Ensure that the crond service is enabled and running: 

    # systemctl enable crond
# systemctl start crond
    Copy to Clipboard Toggle word wrap

  7. To start generating logs, start the IdM healthcheck service: 

    # systemctl start ipa-healthcheck
    Copy to Clipboard Toggle word wrap

Verification

  1. Navigate to the /var/log/ipa/healthcheck/ directory.
  2. Display the contents of the log file to check if it was created correctly.

1.6. IdM Healthcheck configuration modifications
Copia collegamento

You can change Identity Management (IdM) Healthcheck settings by adding the desired command line options to the /etc/ipahealthcheck/ipahealthcheck.conf file. This can be useful when, for example, you configured log rotation previously and now want to ensure the logs are in a format suitable for automatic analysis, but do not want to set up a new timer.

Note

This Healthcheck feature is only available on RHEL 8.7 and newer.

After the modification, all logs that Healthcheck creates follow the new settings. These settings also apply to any manual execution of Healthcheck.

Note

When running Healthcheck manually, the settings in the configuration file take precedence over the options specified in the command line. For example, if output_type is set to human in the configuration file, specifying json on the command line has no effect. Any command line options you use that are not specified in the configuration file are applied normally.

1.7. Configuring Healthcheck to change the output logs format
Copia collegamento

Follow this procedure to configure Healthcheck with a timer already configured. In this example, you re-configure Healthcheck to start producing logs in a human-readable format and to also include successful results instead of only errors.

Prerequisites

  • Your system is running RHEL 8.7 or later.
  • You have root privileges.
  • You have previously configured log rotation on a timer.

Procedure

  1. Open the /etc/ipahealthcheck/ipahealthcheck.conf file in a text editor.
  2. Add options output_type=human and all=True to the [default] section.
  3. Save and close the file.

Verification

  1. Run Healthcheck manually: 

    # ipa-healthcheck
    Copy to Clipboard Toggle word wrap
  2. Go to /var/log/ipa/healthcheck/ and check that the logs are in the correct format.
Torna in cima
Red Hat logoGithubredditYoutubeTwitter

Formazione

Prova, acquista e vendi

Community

Informazioni sulla documentazione di Red Hat

Aiutiamo gli utenti Red Hat a innovarsi e raggiungere i propri obiettivi con i nostri prodotti e servizi grazie a contenuti di cui possono fidarsi. Esplora i nostri ultimi aggiornamenti.

Rendiamo l’open source più inclusivo

Red Hat si impegna a sostituire il linguaggio problematico nel codice, nella documentazione e nelle proprietà web. Per maggiori dettagli, visita il Blog di Red Hat.

Informazioni su Red Hat

Forniamo soluzioni consolidate che rendono più semplice per le aziende lavorare su piattaforme e ambienti diversi, dal datacenter centrale all'edge della rete.

Theme

© 2025 Red Hat