Jakub,
Assuming what I'm experiencing is sssd not updating all cached fields, instead
of just the unknown ones. Which I believe is correct because even entries that had been
removed from LDAP for several days where still showing on the systems with the stuck sssd.
It should be a simple matter of writing a script that loops through the output of:
ldbsearch -H /var/lib/sss/db/cache_default.ldb dataExpireTimestamp | grep
dataExpireTimestamp | awk '{ print $2 }'
finding the oldest (smallest) number and comparing that to "date '+%s' -
Y", where Y is the maximum age of the cache I want to allow and then alerting if that
is bigger then what is in ldb. Does that sound reasonable based on how sssd updates
dataExpireTimestamp?
Thanks,
-Brad
===================================================
Brad Viviano
High Performance Computing & Scientific Visualization
Lockheed Martin, Supporting the EPA
Research Triangle Park, NC
919-541-2696
HSCSS Task Order Lead - Ravi Nair
919-541-5467 - Nair.Ravi(a)epa.gov
High Performance Computing Subtask Lead - Durward Jones
919-541-5043 - Jones.Durward(a)epa.gov
Environmental Modeling and Visualization Lead - Heidi Paulsen
919-541-1834 - Paulsen.Heidi(a)epa.gov
________________________________________
From: sssd-devel-bounces(a)lists.fedorahosted.org
<sssd-devel-bounces(a)lists.fedorahosted.org> on behalf of Jakub Hrozek
<jhrozek(a)redhat.com>
Sent: Friday, June 27, 2014 4:11 AM
To: sssd-devel(a)lists.fedorahosted.org
Subject: Re: [SSSD] Is there a way to check last time SSS cache was updated?
On Thu, Jun 26, 2014 at 04:56:21PM +0000, Viviano, Brad wrote:
Hello,
I'm running SSSd under RHEL6 using Redhat's standard RPM's
(sssd-1.9.2-129). In the last two weeks I've had on two different systems develop a
situation where sssd wasn't updating its cache, so new users and group updates from
LDAP where not getting picked up. SSSd was still running, but using "getent"
wouldn't return information about the user and they could not login. Once I diagnosed
the problem, I restarted sssd and it immediately picked up the changes and everything was
fine.
Which leads me to my question. Is there a way to determine the last time the sss
cache was updated successfully for a particular domain? I'd like to write a Nagios
plugin that could alert me if sssd gets stuck again. I didn't know if it was as simple
as checking the timestamp on the associated "cache_DOMAIN.ldb" file or not. I
didn't think to check the timestamp on the two systems that had problems, I was too
focused on resolving the issue.
Thanks,
-Brad Vivaino
Not an easy one, currently.
We have a ticket open to develop a 'sssctl' tool, maybe raising the
priority of this work with your Red Hat support contacts would help:
https://fedorahosted.org/sssd/ticket/385
What you can do, though is:
0) yum install ldb-tools
1) Invalidate a user using the sss_cache tool
2) Check that the cache expiry status (dataExpireTimeStamp), it should
be set to 1 now
ldbsearch -H /var/lib/sss/db/cache_$domain.ldb name=$username dataExpireTimestamp
3) Request the user again
getent passwd $username
4) Check the cache expiry again. If sssd was online when the request was
made, the dataExpireTimestamp would be set to a sensible value.
_______________________________________________
sssd-devel mailing list
sssd-devel(a)lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/sssd-devel