Sounds great! Where do we find this tool? In an upcoming release or as a stand-alone
package?
John
On 14 Jun 2019, at 16:29, Rob Crittenden via FreeIPA-users
<freeipa-users(a)lists.fedorahosted.org> wrote:
I'd like to introduce a new tool for an IPA adminstrators tool kit we're
working on, currently in a beta state and shipping in Fedora 29+.
ipa-healthcheck is proactive tool for identifying current, potential and
future issues within an IPA installation.
It executes a series of checks in the areas of certificates, AD trust,
replication and the filesystem (and a few others). These checks can
return a success, warning or error. Any check executed will return a
value, the idea being if something with the check blows up and causes it
to not execute you'd otherwise not know and would have a false sense of
security.
A systemd timer is configured which will execute this on a nightly
basis, dumping the output in JSON format in /var/log/ipa/healthcheck/.
It can also be executed from the command-line as root and requires an
admin Kerberos ticket. From the command-line it is probably most useful
to use the --failures-only option in order to suppress the SUCCESS
messages: no news is good news in this case.
It currently only works with IPA 4.7.2+. Will we backport to 4.6? I
don't know yet.
I'd appreciate any feedback on whether it:
- is helpful
- works
- doesn't report false positives
- is usable: a lot of the output is what I think would be useful but we
won't know until applied in the real world
- does what you need. We can add more checks so if you have ideas please
let us know
Note that there are a few things we run that just produce output that
needs to be analyzed separately. DNA range checking is an example. It is
perfectly fine to not have a DNA range assigned on all masters but you'd
want to know if you had none defined on all masters.
thanks
rob
_______________________________________________
FreeIPA-users mailing list -- freeipa-users(a)lists.fedorahosted.org
To unsubscribe send an email to freeipa-users-leave(a)lists.fedorahosted.org
Fedora Code of Conduct:
https://getfedora.org/code-of-conduct.html
List Guidelines:
https://fedoraproject.org/wiki/Mailing_list_guidelines
List Archives:
https://lists.fedorahosted.org/archives/list/freeipa-users@lists.fedoraho...