第 2 章 使用健康检查来识别问题

流程

• 要运行健康检查，请输入：

  # dsctl instance_name healthcheckdsctl instance_name healthcheckdsctl instance_name healthcheck
  Beginning lint report, this could take a while ...
  Checking Backends ...
  Checking Config ...
  Checking Encryption ...
  Checking FSChecks ...
  Checking ReferentialIntegrityPlugin ...
  Checking MonitorDiskSpace ...
  Checking Replica ...
  Checking Changelog ...
  Checking NssSsl ...
  Healthcheck complete.
  1 Issue found!  Generating report ...

  Copy to Clipboard Toggle word wrap

  要以 JSON 格式显示输出，请将 --json 参数传递给命令：

  # dsctl --json instance_name healthcheckdsctl --json instance_name healthcheckdsctl --json instance_name healthcheck

  Copy to Clipboard Toggle word wrap

  例 2.1. 健康检查的可能报告

  [1] DS Lint Error: DSELE0001
  --------------------------------------------------------------------------------
  Severity: MEDIUM
  Affects:
   -- cn=encryption,cn=config
  
  Details:
  -----------
  This Directory Server may not be using strong TLS protocol versions. TLS1.0 is known to
  have a number of issues with the protocol. Please see:
  
  https://tools.ietf.org/html/rfc7457
  
  It is advised you set this value to the maximum possible.
  
  Resolution:
  -----------
  There are two options for setting the TLS minimum version allowed.  You,
  can set "sslVersionMin" in "cn=encryption,cn=config" to a version greater than "TLS1.0"
  You can also use 'dsconf' to set this value.  Here is an example:
  
      # dsconf slapd-instance_name security set --tls-protocol-min=TLS1.2
  
  You must restart the Directory Server for this change to take effect.
  
  Or, you can set the system wide crypto policy to FUTURE which will use a higher TLS
  minimum version, but doing this affects the entire system:
  
      # update-crypto-policies --set FUTURE
  
  
  ===== End Of Report (1 Issue found) =====

  Copy to Clipboard Toggle word wrap

  例 2.2. 以 JSON 格式检查健康检查的可能报告

  [
      {
          "dsle": "DSELE0001",
          "severity": "MEDIUM",
          "items": [
              "cn=encryption,cn=config"
          ],
          "detail": "This Directory Server may not be using strong TLS protocol versions. TLS1.0 is known to\nhave a number of issues with the protocol. Please see:\n\nhttps://tools.ietf.org/html/rfc7457\n\nIt is advised you set this value to the maximum possible.",
          "fix": "There are two options for setting the TLS minimum version allowed.  You,\ncan set \"sslVersionMin\" in \"cn=encryption,cn=config\" to a version greater than \"TLS1.0\"\nYou can also use 'dsconf' to set this value.  Here is an example:\n\n    # dsconf slapd-instance_name security set --tls-protocol-min=TLS1.2\n\nYou must restart the Directory Server for this change to take effect.\n\nOr, you can set the system wide crypto policy to FUTURE which will use a higher TLS\nminimum version, but doing this affects the entire system:\n\n    # update-crypto-policies --set FUTURE"
      }
  ]

  Copy to Clipboard Toggle word wrap