Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve reporting when checks time out #322

Open
yrro opened this issue Mar 12, 2024 · 0 comments · May be fixed by #323
Open

Improve reporting when checks time out #322

yrro opened this issue Mar 12, 2024 · 0 comments · May be fixed by #323

Comments

@yrro
Copy link
Contributor

yrro commented Mar 12, 2024

# ipa-healthcheck --source=pki.server.healthcheck.clones.connectivity_and_data --check=ClonesConnectivyAndDataCheck  --output-type=human
    Unable to reach KRA at [https://ipa6.example.com:443](https://ipa6.example.com/): Request timed out
    ERROR: pki.server.healthcheck.clones.connectivity_and_data.ClonesConnectivyAndDataCheck

The 'request timed out' message implies that an attempt to fetch a URL on ipa6 timed out. But that's not the case. The timeout is really caused by the 10 second limit on health checks. Let's improve the reporting in this case.

I've modified the plugin run code to produce something a bit clearer:

Command: pki -d /etc/pki/pki-tomcat/alias -C /tmp/tmp7nbqgra3/password.txt nss-cert-export --with-chain --format PEM Server-Cert cert-pki-ca /etc/pki/pki-tomcat/alias/ca.crt
Starting new HTTPS connection (1): ipa5.example.com:443
https://ipa5.example.com:443 "GET /kra/admin/kra/getStatus HTTP/1.1" 200 195
Content:
<?xml version="1.0" encoding="UTF-8" standalone="no"?><XMLResponse><State>1</State><Type>KRA</Type><Status>running</Status><Version>10.14.3-1.module+el8.8.0+18059+6d4394a9</Version></XMLResponse>
Status: running
KRA at https://ipa5.example.com:443 is running
Command: pki -d /etc/pki/pki-tomcat/alias -C /tmp/tmp4ej0vqt_/password.txt nss-cert-export --with-chain --format PEM Server-Cert cert-pki-ca /etc/pki/pki-tomcat/alias/ca.crt
--- Health check pki.server.healthcheck.clones.connectivity_and_data:ClonesConnectivyAndDataCheck cancelled after after 7 sec ---
  File "/bin/ipa-healthcheck", line 11, in <module>
    load_entry_point('ipahealthcheck==0.12', 'console_scripts', 'ipa-healthcheck')()
  File "/usr/lib/python3.6/site-packages/ipahealthcheck/core/main.py", line 52, in main
    sys.exit(ipachecks.run_healthcheck())
  File "/usr/lib/python3.6/site-packages/ipahealthcheck/core/core.py", line 475, in run_healthcheck
    config.timeout))
  File "/usr/lib/python3.6/site-packages/ipahealthcheck/core/core.py", line 219, in run_plugins
    for result in run_plugin(plugin, available, timeout):
  File "/usr/lib/python3.6/site-packages/ipahealthcheck/core/core.py", line 66, in run_plugin
    for result in plugin.check():
  File "/usr/lib/python3.6/site-packages/ipahealthcheck/core/plugin.py", line 18, in wrapper
    for result in f(*args, **kwds):
  File "/usr/lib/python3.6/site-packages/pki/server/healthcheck/clones/connectivity_and_data.py", line 161, in check
    self.check_kra_clones()
  File "/usr/lib/python3.6/site-packages/pki/server/healthcheck/clones/connectivity_and_data.py", line 56, in check_kra_clones
    '/kra/admin/kra/getStatus')
  File "/usr/lib/python3.6/site-packages/pki/server/healthcheck/clones/plugin.py", line 52, in get_status
    self.instance.export_ca_cert()
  File "/usr/lib/python3.6/site-packages/pki/server/__init__.py", line 277, in export_ca_cert
    nssdb.extract_ca_cert(self.ca_cert, nickname)
  File "/usr/lib/python3.6/site-packages/pki/nssdb.py", line 1865, in extract_ca_cert
    output_format="PEM")
  File "/usr/lib/python3.6/site-packages/pki/nssdb.py", line 1449, in export_cert_from_db
    subprocess.check_call(cmd)
  File "/usr/lib64/python3.6/subprocess.py", line 306, in check_call
    retcode = call(*popenargs, **kwargs)
  File "/usr/lib64/python3.6/subprocess.py", line 289, in call
    return p.wait(timeout=timeout)
  File "/usr/lib64/python3.6/subprocess.py", line 1477, in wait
    (pid, sts) = self._try_wait(0)
  File "/usr/lib64/python3.6/subprocess.py", line 1424, in _try_wait
    (pid, sts) = os.waitpid(self.pid, wait_flags)
  File "/usr/lib/python3.6/site-packages/ipahealthcheck/core/core.py", line 58, in signal_handler
    traceback.print_stack()
--- The following messages were logged by the plugin after it was cancelled. They may not indicate the reason why the plugin took too long to run. ---
Unable to reach KRA at https://ipa6.example.com:443: Health check pki.server.healthcheck.clones.connectivity_and_data:ClonesConnectivyAndDataCheck cancelled after after 7 sec
--- Increasing the timeout in /etc/ipahealthcheck/ipahealthcheck.conf may allow this healthcheck to complete before the deadline. ---
[
  {
    "source": "pki.server.healthcheck.clones.connectivity_and_data",
    "check": "ClonesConnectivyAndDataCheck",
    "result": "ERROR",
    "uuid": "a4703c19-8437-4408-a771-8e811311ff81",
    "when": "20240312165942Z",
    "duration": "0.468623",
    "kw": {
      "status": "ERROR:  pki-tomcat : Internal error testing CA clone. Host: ipa6.example.com Port: 443"
    }
  },
  {
    "source": "pki.server.healthcheck.clones.connectivity_and_data",
    "check": "ClonesConnectivyAndDataCheck",
    "result": "ERROR",
    "uuid": "2921d951-bff6-4d4f-a241-6765c068c50f",
    "when": "20240312165949Z",
    "duration": "7.017142",
    "kw": {
      "status": "ERROR:  pki-tomcat : Unable to reach KRA at https://ipa6.example.com:443: Health check pki.server.healthcheck.clones.connectivity_and_data:ClonesConnectivyAndDataCheck cancelled after after 7 sec"
    }
  },
  {
    "source": "pki.server.healthcheck.clones.connectivity_and_data",
    "check": "ClonesConnectivyAndDataCheck",
    "result": "ERROR",
    "uuid": "0eedc845-6cc6-4e60-8641-7d5d47a57e62",
    "when": "20240312165949Z",
    "duration": "7.018444",
    "kw": {
      "exception": "Health check pki.server.healthcheck.clones.connectivity_and_data:ClonesConnectivyAndDataCheck cancelled after after 7 sec"
    }
  }
]
FileNotFoundException: /tmp/tmp4ej0vqt_/password.txt (No such file or directory)

I'm going to clean that up and submit a pull request.

yrro added a commit to yrro/freeipa-healthcheck that referenced this issue Mar 12, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant