Aka ms healthcheck

Learn more about the IdM Healthcheck tool and how to install and run it. 24.1. Healthcheck in IdM The Healthcheck tool in Identity Management (IdM) helps find issues that might impact the health of your IdM environment. The Healthcheck tool is a command line tool that can be used without Kerberos authentication. Modules are Independent Healthcheck consists of independent modules which test for: Replication issues Certificate validity Certificate Authority infrastructure issues IdM and Active Directory trust issues Correct file permissions and ownership settings Two output formats Healthcheck generates the following outputs, which you can set using the output-type option: json: Machine-readable output in JSON format (default) human: Human-readable output You can specify a different file destination with the --output-file option. Results Each Healthcheck module returns one of the following results: SUCCESS configured as expected WARNING not an error, but worth keeping an eye on or evaluating ERROR not configured as expected CRITICAL not configured as expected, with a high possibility for impact 24.2. Installing IdM Healthcheck You can install the IdM Healthcheck tool. Procedure Install the ipa-healthcheck package: [root@server ~]# dnf install ipa-healthcheckVerification Use the --failures-only option to have ipa-healthcheck only report errors. A fully-functioning IdM installation returns an empty result of []. [root@server ~]# ipa-healthcheck --failures-only[]Additional resources Use ipa-healthcheck --help to see all supported arguments. 24.3. Running IdM Healthcheck Healthcheck can be run manually or automatically using log rotation Procedure To run healthcheck manually, enter the ipa-healthcheck command. [root@server ~]# ipa-healthcheckAdditional resources For all options, see the man page: man ipa-healthcheck. 24.4. Additional resources See the following sections of the Using IdM Healthcheck to monitor your IdM environment guide for examples of using IdM Healthcheck. Checking services Verifying your IdM and AD trust configuration Verifying certificates Verifying system certificates Checking disk space Verifying permissions of IdM configuration files Checking replication

Use the health check endpoint and script, enable either of the following configuration options:Using the network configuration element:XMLYAML ... ...hazelcast: network: rest-api: enabled: true endpoint-groups: HEALTH_CHECK: enabled: trueUsing the advanced-network configuration element:XMLYAML ... ...hazelcast: advanced-network: rest-server-socket-endpoint-config: endpoint-groups: HEALTCH_CHECK: enabled: trueHealth CheckYou can use Hazelcast’s HTTP-based health check implementation to get basic information about the cluster and member on which it is launched.To use the HTTP-based health check:Enable the health check endpoint.Launch the health check from your preferred browser: health check retrieves information about your cluster’s health status, such as member state,cluster state, cluster size, etc. For example:{ "nodeState": "ACTIVE", "clusterState": "ACTIVE", "clusterSafe": false, "migrationQueueSize": 0, "clusterSize": 3}nodeState: State of the member on which the health check is launched. See Cluster and Member States to learn more about the states of cluster members.clusterState: State of cluster that the health-checked member belongs to. See Cluster and Member States to learn more about cluster states.clusterSafe: Whether the cluster is safe, i.e., there are no active partitionmigrations and all backups are in sync for each partition in the cluster. See Shutting Down Members and Clusters to learn how to check the safety of active clusters.The clusterSafe indicator is useful when your cluster is in a passive state. If the cluster is in an active state, the indicator value continually changes due to the dynamic state of the cluster. Also, checking the cluster safety triggers additional operations for each partition and replica. Frequent safety checks of a cluster under load may impact cluster performance.migrationQueueSize: A count of the remaining migration tasks while the cluster datais being repartitioned. See Data Partitioningto learn about Hazelcast’s partitioning mechanism.clusterSize: A count of the cluster member count.Using the hz-healthcheck ScriptThe hz-healthcheck script comes with the Hazelcast package. Internally, it usesthe HTTP-based health check endpoint.To run the hz-healthcheck script:Enable the health check endpoint.Run the hz-healthcheck script with parameters using the following format:./hz-healthcheck You can use the following parameters to perform checks and operations on your Hazelcast clusters:ParameterDefault ValueDescription-o or --operationget-stateHealth check operation. It can be all, node-state,cluster-state, cluster-safe, migration-queue-size and cluster-size.The cluster-safe option is useful when your cluster is in a passive state. If the cluster is in an active state, the indicator value continually changes due to the dynamic state of the cluster. Also, checking the cluster safety triggers additional operations for each partition and replica. Frequent safety checks of a cluster under load may impact cluster performance.-a or --address127.0.0.1Defines

On the ESP. This is a common configuration; distributions frequently update their own on-ESP boot managers' Shim programs, even if they don't update rEFInd's Shim. Also, in this example, two Shim binaries were found. They are in fact identical, but the one on the ESP has a later timestamp because it was copied after it was written to the /usr/lib/shim directory.When copying a newer Shim binary, refind-sb-healthcheck backs up the original Shim and MokManager binaries by renaming them with .backup added to their filenames. This should enable you to restore the originals if the new binaries give you problems; however, you'll need to boot in some other way, at least into an EFI shell, to do so. Thus, I recommend proceeding with this operation only if you know how to do this.With the Shim binary updated (or the update bypassed, deferred, or unnecessary), refind-sb-healthcheck proceeds to check the rEFInd local keys' expiration dates:************************************************** Checking the local rEFInd keys' expiration date*************************************************Current date is 2023-03-01rEFInd local key's expiration date is 2022-12-07rEFInd's local Secure Boot key has expired!Replacing this key with a new one is recommended!Do you want to replace the current rEFInd local key (y/N)?Unlike checking the Shim binaries' relative ages, this check digs into the key files themselves to identify their expiration dates. In this example, the local keys have expired, so the program gives you the chance to update them. If you choose to do so, the old keys are moved to the /etc/refind.d/keys/backup directory and fresh keys are created in /etc/refind.d/keys. If the existing keys have a year or more of life left in them, refind-sb-healthcheck will declare that replacing the keys is not recommended and move on; you can skip ahead a bit in this example.If you choose to upgrade your keys, refind-sb-healthcheck asks if you want to encrypt them. Encrypting keys means that you'll have to enter a password to use them, which can be a nuisance; but this also makes it much harder for an intruder to use your keys.Do you want to replace the current rEFInd local key (y/N)? yDo you want to encrypt your new keys (y/N)? nGenerating a fresh set of local keys........+...+.....+......+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*......+.....+...+..........+...+...+.....+.....................+.+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*....+...+.....+...+...+.......+........+.+......+...+...........+.+..+...+.........+.+........+.+.....+....+.....+..........+......+...+...............+.....+............+...+.+............+.....+....+......+........+............+.............+......+...+......+..+..................+.+......+...............+...+..+.......+..+......+....+...+..+....+..+.........+....+..+....+...+........+.............+..+...+..........+.....................+.....+...+......+......+.............+.....+...+....+..............................+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++.....+..................+.+..+............+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*.......+..............+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++*..........+..+.....................+....+...+..+.+..+.+...........+...+.+...........+......+...+.....................+...+.......+.....+...+.+..+....+........+...+...+.+.....+.+.........+......+....................+.........+.+.....+...+......+......+.......+..+.............+.....+...+...+......+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-----Once the new key is used to sign an EFI binary, the key must be available tothe EFI to authenticate the newly-signed binaries.Do you want to enroll the new key in your firmware as a MOK (Y/n)? yinput password:input password again:You must reboot after running this program to finish enrolling the MOK.Remember the password you just entered and opt to enroll the MOK in theMokManager program that should appear after you reboot. This program willprompt you to reboot when it ends.Press the Enter key to continue:Whatever choices you make regarding rEFInd's

A big deal, though; in my tests, neither Shim nor the computers I've tested enforce key expiration dates. It may therefore be possible to use even a long-expired key indefinitely. I can't promise this will always be true, though, and in fact I've heard of one server that does enforce key expiration dates. Thus, it's probably prudent to keep ahead of this matter.The refind-sb-healthcheck script can help with maintaining both the Shim you use to launch rEFInd and Secure Boot keys. This script is interactive, and it produces a fair amount of output, which can vary greatly from one computer to another. It includes a number of pause points so that you can read the just-generated output, but in some cases this output may scroll off a screen. It's therefore best to run it in a GUI Terminal program rather than at a text-mode console.To begin, run refind-sb-healthcheck as root or using sudo. (If you run it as an ordinary user, the script will try to escalate its privilege level.) The script begins by trying to update Shim, if your computer uses Shim to boot. (If the script detects a non-Shim boot path, as when you completely control Secure Boot, then it skips this part.)$ sudo refind-sb-healthcheck*********************************"* Checking Secure Boot status....*********************************Secure Boot is activeShim program detected****************************************************** Checking for updates to Shim on the ESP and in /usr*****************************************************Detected ESP mounted at /boot/efiThe current Shim program is /boot/efi//EFI/refind/shimx64.efiIts date stamp is: 2019-02-28-19:39Newer Shim programs are: --> 2023-03-01-03:05: /boot/efi/EFI/ubuntu/shimx64.efi --> Found matching mmx64.efi --> 2023-01-31-11:57: /usr/lib/shim/shimx64.efi --> Found matching mmx64.efiThe newest Shim candidate is /boot/efi/EFI/ubuntu/shimx64.efi,with a date of 2023-03-01-03:05Do you want to copy the newer Shim binary over the current one (y/N)? yBacking up current Shim and MokManager programs....Copying /boot/efi/EFI/ubuntu/shimx64.efi to /boot/efi//EFI/refind/Copying /boot/efi/EFI/ubuntu/mmx64.efi to /boot/efi//EFI/refind/Press the Enter key to continue:In this example, the script has identified that the computer booted through Shim, and it's searched the ESP and the /usr directory tree for a more recent Shim than the one used to boot the computer. The script uses the files' date stamps to determine their age, not the Shim binaries' version numbers! The version numbers would be a better measure of which Shim is the most recent, but version numbers are very difficult to identify, so refind-sb-healthcheck uses the date stamps instead. This is a reasonable, but imperfect, proxy. As noted in the output, the script also looks for a matching mmx64.efi (MokManager) binary; it will not offer to copy a Shim binary without a matching MokManager.In this example, the script has identified a newer Shim binary than the one rEFInd used, and has offered to copy it over the existing rEFInd Shim binary. The newer binary is part of an Ubuntu installation