[SSSD] Is there a way to check last time SSS cache was updated?

Jakub Hrozek jhrozek at redhat.com
Fri Jun 27 08:11:33 UTC 2014


On Thu, Jun 26, 2014 at 04:56:21PM +0000, Viviano, Brad wrote:
> Hello,
> 
>     I'm running SSSd under RHEL6 using Redhat's standard RPM's (sssd-1.9.2-129). In the last two weeks I've had on two different systems develop a situation where sssd wasn't updating its cache, so new users and group updates from LDAP where not getting picked up. SSSd was still running, but using "getent" wouldn't return information about the user and they could not login. Once I diagnosed the problem, I restarted sssd and it immediately picked up the changes and everything was fine.
> 
>     Which leads me to my question. Is there a way to determine the last time the sss cache was updated successfully for a particular domain? I'd like to write a Nagios plugin that could alert me if sssd gets stuck again. I didn't know if it was as simple as checking the timestamp on the associated "cache_DOMAIN.ldb" file or not. I didn't think to check the timestamp on the two systems that had problems, I was too focused on resolving the issue.
> 
> 
>     Thanks,
> 
>             -Brad Vivaino

Not an easy one, currently.

We have a ticket open to develop a 'sssctl' tool, maybe raising the
priority of this work with your Red Hat support contacts would help:
https://fedorahosted.org/sssd/ticket/385

What you can do, though is:
0) yum install ldb-tools
1) Invalidate a user using the sss_cache tool
2) Check that the cache expiry status (dataExpireTimeStamp), it should
be set to 1 now

ldbsearch -H /var/lib/sss/db/cache_$domain.ldb name=$username dataExpireTimestamp

3) Request the user again
getent passwd $username

4) Check the cache expiry again. If sssd was online when the request was
made, the dataExpireTimestamp would be set to a sensible value.



More information about the sssd-devel mailing list