Bug 1012410 - Collect output of `ipa-replica-manage` in ipa module
Collect output of `ipa-replica-manage` in ipa module
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: sos (Show other bugs)
6.5
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Bryn M. Reeves
David Kutálek
:
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2013-09-26 08:25 EDT by Petr Spacek
Modified: 2014-12-03 08:36 EST (History)
9 users (show)

See Also:
Fixed In Version: sos-2.2-56.el6
Doc Type: Bug Fix
Doc Text:
No documentation needed.
Story Points: ---
Clone Of:
Environment:
Last Closed: 2014-10-14 03:22:19 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2014:1528 normal SHIPPED_LIVE sos bug fix and enhancement update 2014-10-13 21:22:00 EDT

  None (edit)
Description Petr Spacek 2013-09-26 08:25:26 EDT
Description of problem:
Please collect output from following commands (in the ipa module):
ipa-replica-manage -v list
ipa-replica-manage -v list $(hostname)


Actual results:
The output from command `ipa-replica-manage` is missing.


Expected results:
Information about replication topology is included in sosreport.
Comment 2 Bryn M. Reeves 2013-09-26 08:33:22 EDT
Thanks for the report. The utility of this information is clear.

Is there anything in the tool output that we would want to remove? I.e. secrets or tokens that are not of diagnostic value but that could be considered private information?

Would it be possible to paste/attach some sample output to the bug?
Comment 5 Petr Spacek 2013-09-26 09:00:42 EDT
AFAIK there is nothing 'secret', just host names.

Examples:
$ ipa-replica-manage -v list
vm-192.idm.lab.eng.brq.redhat.com: master
vm-127.idm.lab.eng.brq.redhat.com: master

$ ipa-replica-manage -v list $(hostname)
vm-192.idm.lab.eng.brq.redhat.com: replica
  last init status: 0 Total update succeeded
  last init ended: 2013-09-26 11:19:06+00:00
  last update status: 0 Replica acquired successfully: Incremental update succeeded
  last update ended: 2013-09-26 12:50:29+00:00
Comment 6 Martin Kosek 2013-09-26 09:08:18 EDT
That's true. I am just thinking that ipa-replica-manage command won't run without Kerberos credentials. So if user does not run "kinit someuser" and enters password, ipa-replica-manage will fail to bind to LDAP server and will not collect the information.
Comment 7 Petr Spacek 2013-09-26 09:23:24 EDT
Sosreport runs under root, right? Can we hack it to use SLAPI for Bind?
Comment 8 Martin Kosek 2013-09-26 09:39:05 EDT
Unfortunately not. You can only specify bind DN and password.

You would need to prepare ldapsearches doing LDAPI autobind. To search for replication agreements in given replica. Aren't ldapsearches like this one in sos report already? I am not sure now if we added them or not.
Comment 9 Bryn M. Reeves 2013-09-26 09:44:21 EDT
> Aren't ldapsearches like this one in sos report already? I am not sure now if 
> we added them or not.

No.

Happy to make changes to capture this information but we'll need to have something that will "just work" for most configurations (or that can take a simple command line parameter that we can document).

The Debian porters added some ldapsearch stuff upstream to their ldap plug-in but this does not address replication afaik:

        ldap_search = "ldapsearch -Q -LLL -Y EXTERNAL -H ldapi:/// "

        self.add_cmd_output("ldapsearch -x -b '' -s base 'objectclass=*'")
        self.add_cmd_output(ldap_search + "-b cn=config '(!(objectClass=olcSchemaConfig))'",
            suggest_filename="configuration_minus_schemas")
        self.add_cmd_output(ldap_search + "-b cn=schema,cn=config dn",
            suggest_filename="loaded_schemas")
        self.add_cmd_output(ldap_search + "-b cn=config '(olcAccess=*)' olcAccess olcSuffix",
            suggest_filename="access_control_lists")
Comment 10 RHEL Product and Program Management 2013-10-13 21:55:20 EDT
This request was not resolved in time for the current release.
Red Hat invites you to ask your support representative to
propose this request, if still desired, for consideration in
the next release of Red Hat Enterprise Linux.
Comment 13 Bryn M. Reeves 2014-06-21 10:16:52 EDT
commit 27a05970f747a36a5d8564301240de3c7897b86b
Author: Bryn M. Reeves <bmr@redhat.com>
Date:   Sat Jun 21 15:12:52 2014 +0100

    [ipa] add ipa-replica-manage output
    
    Signed-off-by: Bryn M. Reeves <bmr@redhat.com>
Comment 16 errata-xmlrpc 2014-10-14 03:22:19 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

http://rhn.redhat.com/errata/RHBA-2014-1528.html

Note You need to log in before you can comment on or make changes to this bug.