Chapter 53. Collecting IdM Healthcheck information

Healthcheck has been designed as a manual command line tool which should help you to identify possible problems in Identity Management (IdM).

This chapter describes how you can create a collection of logs based on the Healthcheck output with 30-day rotation.

Prerequisites

  • The Healthcheck tool is only available on RHEL 8.1 or newer

53.1. Healthcheck in IdM

The Healthcheck tool in Identity Management (IdM) helps find issues that may impact the health of your IdM environment.

Note

The Healthcheck tool is a command line tool that can be used without Kerberos authentication.

53.1.1. Modules are Independent

Healthcheck consists of independent modules which test for:

  • Replication issues
  • Certificate validity
  • Certificate Authority infrastructure issues
  • IdM and Active Directory trust issues
  • Correct file permissions and ownership settings

53.1.2. Two output formats

Healthcheck generates the following outputs:

  • Human-readable output
  • Machine-readable output in JSON format

The output destination for both human and JSON is standard output by default. You can specify a different destination with the --output-file option.

53.1.3. Results

Each Healthcheck module returns one of the following results:

SUCCESS
configured as expected
WARNING
not an error, but worth keeping an eye on or evaluating
ERROR
not configured as expected
CRITICAL
not configured as expected, with a high possibility for impact

53.1.4. Running IdM Healthcheck

Healthcheck can be run:

  • Manually 

    [root@master ~]# ipa-healthcheck

    For all options, see the man page: man ipa-healthcheck.

  • Automatically using log rotation.

53.2. Log rotation

Log rotation creates a new log file every day, and the files are organized by date. Since log files are saved in the same directory, you can select a particular log file according to the date.

Rotation means that there is configured a number for max number of log files and if the number is exceeded, the newest file rewrites and renames the oldest one. For example, if the rotation number is 30, the thirty-first log file replaces the first (oldest) one.

Log rotation reduces voluminous log files and organizes them, which can help with analysis of the logs.

53.3. Configuring log rotation using the IdM Healthcheck

This section describes how to configure a log rotation with:

  • the systemd timer
  • the crond service

The systemd timer runs the Healthcheck tool periodically and generates the logs. The default value is set to 4 am every day.

The crond service is used for log rotation.

The default log name is healthcheck.log and the rotated logs use the healthcheck.log-YYYYMMDD format.

Prerequisites

  • You must execute commands as root.

Procedure

  1. Enable a systemd timer: 

    # systemctl enable ipa-healthcheck.timer
Created symlink /etc/systemd/system/multi-user.target.wants/ipa-healthcheck.timer -> /usr/lib/systemd/system/ipa-healthcheck.timer.

  2. Start the systemd timer: 

    # systemctl start ipa-healthcheck.timer

  3. Open the /etc/logrotate.d/ipahealthcheck file to configure the number of logs which should be saved.

    By default, log rotation is set up for 30 days.

  4. In the /etc/logrotate.d/ipahealthcheck file, configure the path to the logs.

    By default, logs are saved in the /var/log/ipa/healthcheck/ directory.

  5. In the /etc/logrotate.d/ipahealthcheck file, configure the time for log generation.

    By default, a log is created daily at 4 AM.

  6. To use log rotation, ensure that the crond service is enabled and running: 

    # systemctl enable crond
# systemctl start crond

To start with generating logs, start the IPA healthcheck service: 

# systemctl start ipa-healthcheck

To verify the result, go to /var/log/ipa/healthcheck/ and check if logs are created correctly.