10.3. Gathering debug logs of an attempt to establish an AD trust

Procedure

1. To enable debugging for the IdM server, create the file /etc/ipa/server.conf with the following contents.

   [global]
   debug=True

2. Restart the httpd service to load the debugging configuration.

   [root@trust_controller ~]# systemctl restart httpd

3. Stop the smb and winbind services.

   [root@trust_controller ~]# systemctl stop smb winbind

4. Set the debugging log level for the smb and winbind services.

   [root@trust_controller ~]# net conf setparm global 'log level' 100

5. To enable debug logging for Samba client code used by the IdM framework, edit the /usr/share/ipa/smb.conf.empty configuration file to have the following contents.

       [global]
       log level = 100

6. Remove previous Samba logs.

   [root@trust_controller ~]# rm /var/log/samba/log.*

7. Start the smb and winbind services.

   [root@trust_controller ~]# systemctl start smb winbind

8. Print a timestamp as you attempt to establish a trust with verbose mode enabled.

   [root@trust_controller ~]# date; ipa -vvv trust-add --type=ad ad.example.com

9. Review the following error log files for information about the failed request:

   1. /var/log/httpd/error_log
   2. /var/log/samba/log.*

10. Disable debugging.

    [root@trust_controller ~]# mv /etc/ipa/server.conf /etc/ipa/server.conf.backup
    [root@trust_controller ~]# systemctl restart httpd
    [root@trust_controller ~]# systemctl stop smb winbind
    [root@trust_controller ~]# net conf setparm global 'log level' 0
    [root@trust_controller ~]# mv /usr/share/ipa/smb.conf.empty /usr/share/ipa/smb.conf.empty.backup
    [root@trust_controller ~]# systemctl start smb winbind

11. Optional: If you are unable to determine the cause of the authentication issue:

    1. Collect and archive the log files you recently generated.

       [root@trust_controller ~]# tar -cvf debugging-trust.tar /var/log/httpd/error_log /var/log/samba/log.*

    2. Open a Red Hat Technical Support case and provide the timestamp and debug logs from the attempt.