Bug 1358849 - CA replica install logs to wrong log file
Summary: CA replica install logs to wrong log file
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: ipa
Version: 7.3
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: rc
: ---
Assignee: IPA Maintainers
QA Contact: Kaleem
URL:
Whiteboard:
Keywords:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-07-21 15:24 UTC by Petr Vobornik
Modified: 2016-11-04 05:58 UTC (History)
4 users (show)

(edit)
Clone Of:
(edit)
Last Closed: 2016-11-04 05:58:48 UTC


Attachments (Terms of Use)


External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2016:2404 normal SHIPPED_LIVE ipa bug fix and enhancement update 2016-11-03 13:56:18 UTC

Description Petr Vobornik 2016-07-21 15:24:56 UTC
This bug is created as a clone of upstream ticket:
https://fedorahosted.org/freeipa/ticket/6086

When running ipa-ca-install to install a CA replica, if the
installation fails it says:

{{{
Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

Unexpected error - see /var/log/ipareplica-ca-install.log for details:
}}}

However, the actual log file was `/var/log/ipaserver-ca-install.log`.

Expected behaviour: progress is logged to `/var/log/ipareplica-ca-install.log`
as suggested by the error message.

Comment 1 Martin Babinsky 2016-07-21 16:38:46 UTC
Fixed upstream
master:
https://fedorahosted.org/freeipa/changeset/1b8a36d134dd320896e05809cc6b49f725eadda7

Comment 3 Scott Poore 2016-09-12 15:45:37 UTC
Petr,

Was this change reverted/undone?

I tried ipa-ca-install with pki-tomcatd down on IPA master as well as with a version of pki-core with known issue.  In both cases, I only saw:

...start truncated...
  [4/26]: creating installation admin user
  [5/26]: setting up certificate server
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL Failed to configure CA instance: Command '/usr/sbin/pkispawn -s CA -f /tmp/tmpDxqpZU' returned non-zero exit status 1
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL See the installation logs and the following files/directories for more information:
ipa.ipaserver.install.cainstance.CAInstance: CRITICAL   /var/log/pki/pki-tomcat
  [error] RuntimeError: CA configuration failed.

Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

CA configuration failed.
...end...

I don't see a mention of ipareplica-ca-install.log.  Is that not shown in all cases?

Any thoughts on how I might be able to force a failure that would show the log?

Comment 4 Scott Poore 2016-09-12 15:51:55 UTC
Never mind, I found a way.  Will post verification shortly.

Comment 5 Scott Poore 2016-09-12 15:53:01 UTC
Verified.

Version ::

ipa-server-4.4.0-10.el7.x86_64


Results ::

[root@vm2 ~]# chattr +i /tmp/ca.p12

[root@vm2 ~]# rm /tmp/ca.p12
rm: remove regular empty file ‘/tmp/ca.p12’? y
rm: cannot remove ‘/tmp/ca.p12’: Operation not permitted

[root@vm2 ~]# ipa-ca-install -p Secret123 -U
Run connection check to master
Connection check OK
/usr/lib/python2.7/site-packages/urllib3/connection.py:251: SecurityWarning: Certificate has no `subjectAltName`, falling back to check for a `commonName` for now. This feature is being removed by major browsers and deprecated by RFC 2818. (See https://github.com/shazow/urllib3/issues/497 for details.)
  SecurityWarning
Configuring certificate server (pki-tomcatd). Estimated time: 3 minutes 30 seconds
  [1/26]: creating certificate server user
  [2/26]: creating certificate server db
  [3/26]: setting up initial replication
Starting replication, please wait until this has completed.
Update in progress, 3 seconds elapsed
Update succeeded

  [4/26]: creating installation admin user
  [5/26]: setting up certificate server
  [error] IOError: [Errno 13] Permission denied: '/tmp/ca.p12'

Your system may be partly configured.
Run /usr/sbin/ipa-server-install --uninstall to clean up.

Unexpected error - see /var/log/ipareplica-ca-install.log for details:
IOError: [Errno 13] Permission denied: '/tmp/ca.p12'

Comment 6 Scott Poore 2016-09-12 15:53:54 UTC
forgot to mention before the chattr that I merely ran:

touch /tmp/ca.p12

Comment 8 errata-xmlrpc 2016-11-04 05:58:48 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2404.html


Note You need to log in before you can comment on or make changes to this bug.