1012410 – Collect output of `ipa-replica-manage` in ipa module

RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1012410 - Collect output of `ipa-replica-manage` in ipa module

Summary: Collect output of `ipa-replica-manage` in ipa module

Keywords:
Status:	CLOSED ERRATA
Alias:	None
Product:	Red Hat Enterprise Linux 6
Classification:	Red Hat
Component:	sos
Sub Component:
Version:	6.5
Hardware:	Unspecified
OS:	Unspecified
Priority:	unspecified
Severity:	unspecified
Target Milestone:	rc
Target Release:	---
Assignee:	Bryn M. Reeves
QA Contact:	David Kutálek
Docs Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+	depends on / blocked

Reported:	2013-09-26 12:25 UTC by Petr Spacek
Modified:	2019-05-20 11:06 UTC (History)
CC List:	9 users (show)
Fixed In Version:	sos-2.2-56.el6
Doc Type:	Bug Fix
Doc Text:	No documentation needed.
Clone Of:
Environment:
Last Closed:	2014-10-14 07:22:19 UTC
Target Upstream Version:
Embargoed:

Attachments	(Terms of Use)

Links
System	ID	Private	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHBA-2014:1528	0	normal	SHIPPED_LIVE	sos bug fix and enhancement update	2014-10-14 01:22:00 UTC

Description Petr Spacek 2013-09-26 12:25:26 UTC

Description of problem:
Please collect output from following commands (in the ipa module):
ipa-replica-manage -v list
ipa-replica-manage -v list $(hostname)


Actual results:
The output from command `ipa-replica-manage` is missing.


Expected results:
Information about replication topology is included in sosreport.

Comment 2 Bryn M. Reeves 2013-09-26 12:33:22 UTC

Thanks for the report. The utility of this information is clear.

Is there anything in the tool output that we would want to remove? I.e. secrets or tokens that are not of diagnostic value but that could be considered private information?

Would it be possible to paste/attach some sample output to the bug?

Comment 5 Petr Spacek 2013-09-26 13:00:42 UTC

AFAIK there is nothing 'secret', just host names.

Examples:
$ ipa-replica-manage -v list
vm-192.idm.lab.eng.brq.redhat.com: master
vm-127.idm.lab.eng.brq.redhat.com: master

$ ipa-replica-manage -v list $(hostname)
vm-192.idm.lab.eng.brq.redhat.com: replica
  last init status: 0 Total update succeeded
  last init ended: 2013-09-26 11:19:06+00:00
  last update status: 0 Replica acquired successfully: Incremental update succeeded
  last update ended: 2013-09-26 12:50:29+00:00

Comment 6 Martin Kosek 2013-09-26 13:08:18 UTC

That's true. I am just thinking that ipa-replica-manage command won't run without Kerberos credentials. So if user does not run "kinit someuser" and enters password, ipa-replica-manage will fail to bind to LDAP server and will not collect the information.

Comment 7 Petr Spacek 2013-09-26 13:23:24 UTC

Sosreport runs under root, right? Can we hack it to use SLAPI for Bind?

Comment 8 Martin Kosek 2013-09-26 13:39:05 UTC

Unfortunately not. You can only specify bind DN and password.

You would need to prepare ldapsearches doing LDAPI autobind. To search for replication agreements in given replica. Aren't ldapsearches like this one in sos report already? I am not sure now if we added them or not.

Comment 9 Bryn M. Reeves 2013-09-26 13:44:21 UTC

> Aren't ldapsearches like this one in sos report already? I am not sure now if 
> we added them or not.

No.

Happy to make changes to capture this information but we'll need to have something that will "just work" for most configurations (or that can take a simple command line parameter that we can document).

The Debian porters added some ldapsearch stuff upstream to their ldap plug-in but this does not address replication afaik:

        ldap_search = "ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// "

        self.add_cmd_output("ldapsearch -x -b '' -s base 'objectclass=*'")
        self.add_cmd_output(ldap_search + "-b cn=config '(!(objectClass=olcSchemaConfig))'",
            suggest_filename="configuration_minus_schemas")
        self.add_cmd_output(ldap_search + "-b cn=schema,cn=config dn",
            suggest_filename="loaded_schemas")
        self.add_cmd_output(ldap_search + "-b cn=config '(olcAccess=*)' olcAccess olcSuffix",
            suggest_filename="access_control_lists")

Comment 10 RHEL Program Management 2013-10-14 01:55:20 UTC

This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.

Comment 13 Bryn M. Reeves 2014-06-21 14:16:52 UTC

commit 27a05970f747a36a5d8564301240de3c7897b86b
Author: Bryn M. Reeves <bmr>
Date:   Sat Jun 21 15:12:52 2014 +0100

    [ipa] add ipa-replica-manage output
    
    Signed-off-by: Bryn M. Reeves <bmr>

Comment 16 errata-xmlrpc 2014-10-14 07:22:19 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-1528.html

Note You need to log in before you can comment on or make changes to this bug.