Could we leverage zabbix in this case?

@kevin @zlopez could you assign this to me ? , I can take a look .

@seddik I assigned it to you, have fun :-)

@kevin or @zlopez could you please run ipa command on ipa servers ??

/sbin/ipa-replica-manage -p ${ipa_passwd} list -v $(hostname) | grep replica | awk -F: '{print $1}'

and

/sbin/ipa-replica-manage -p ${ipa_passwd} list -v $(hotname) | grep "last update status" | awk -F\( '{print $2}' | awk -F\) '{print $1}'

Thanks

So, on ipa03:

# ipa-replica-manage list -v ipa03.iad2.fedoraproject.org | grep replica | aw
k -F: '{print $1}'
Directory Manager password: 
ipa01.iad2.fedoraproject.org
ipa02.iad2.fedoraproject.org

# ipa-replica-manage list -v ipa03.iad2.fedoraproject.org | grep "last update status" | awk -F\( '{print $2}' | awk -F\) '{print $1}'
Directory Manager password: 
0
0

@kevin could you test this simple script to check replica status .
https://paste.centos.org/view/43423762

The password is set as argument ;)

Thanks

Very nice. I will try and look tomorrow if no one else has. ;)

Can you also attach it here? (pastes expire in 1 day)

File in attachment
thanks

ok... the script does work and return 0 in staging (which is replicating ok).

A few comments:

• Is there any way we can avoid needing the directory manager password? If we do it this way that password will be on noc01... or I suppose we could read it from a file on ipa servers, but thats still not great. The directory manager password basically lets you do anything to the backend. ;( If there's any way to avoid it that would sure be good.

• Consider using $() instead of ``

• a --help or error explaining what it is expecting if not passed any arguments would be nice.

ok... the script does work and return 0 in staging (which is replicating ok).

A few comments:

• Is there any way we can avoid needing the directory manager password? If we do it this way that password will be on noc01... or I suppose we could read it from a file on ipa servers, but thats still not great. The directory manager password basically lets you do anything to the backend. ;( If there's any way to avoid it that would sure be good.

it's really quick version to check replication status, i know we can do something better, and avoiding password it's more secure .
I will setup the check on another way

• Consider using $() instead of ``
  totally agree

• a --help or error explaining what it is expecting if not passed any arguments would be nice.

@kevin could you test this version of check_ipa_replication script ??
I push PR here : https://pagure.io/fedora-infra/ansible/pull-request/1800#

check_ipa_replication is re-deployed
Let's close this issue