Script & Icinga/Nagios plugin to check OpenLDAP syncrepl replication

Find a file

Björn Zettergren 2f6d97f761 fix byte-array / str python3 returns byte-arrays instead of strings for ldap-data in ContextCSNs, which makes the listcomprehension fail with a TypeError when using the --serverID flag like so: CSN = [s for s in contextCSNs if sub in s] TypeError: a bytes-like object is required, not 'str' explicitly encoding 'sub' to byte-array, not sure if this is best way, but seems to work well enough.		2021-03-23 17:48:34 +01:00
.gitignore	Added .gitignore file	2013-05-15 16:30:05 +02:00
.pylintrc	Code cleaning	2020-12-18 11:24:09 +01:00
check_syncrepl_extended	fix byte-array / str	2021-03-23 17:48:34 +01:00
icingaexchange.yml	Release v2017.09.12	2017-09-12 13:12:32 +02:00
README.md	Update README and comments	2020-12-18 14:19:02 +01:00

README.md

Script to check LDAP syncrepl replication state between two servers

This script check LDAP syncrepl replication state between two servers. One server is consider as provider and the other as consumer.

This script can check replication state with two method :

by the fisrt, entryCSN of all entries of LDAP directory will be compare between two servers
by the second, all values of all atributes of all entries will be compare between two servers.

In all case, contextCSN of servers will be compare and entries not present in consumer or in provider will be notice. You can decide to disable contextCSN verification by using argument --no-check-contextCSN.

This script is also able to "touch" LDAP object on provider to force synchronisation of this object. This mechanism consist to add '%%TOUCH%%' value to an attribute of this object and remove it just after. The touched attribute is specify by parameter --touch. Of course, couple of DN and password provided, must have write right on this attribute.

If your prefer, you can use --replace-touch parameter to replace value of touched attribute instead of adding the touched value. Use-ful in case of single-value attribute.

To use this script as an Icinga (or Nagios) plugin, use -n argument

Requirement

A single couple of DN and password able to connect to both server and without restriction to retrieve objects from servers.

Usage

usage: check_syncrepl_extended [-h] [-v] [-p PROVIDER] [-c CONSUMER]
                               [-i SERVERID] [-T] [-D DN] [-P PWD] [-b BASEDN]
                               [-f FILTERSTR] [-d] [-n] [-q]
                               [--no-check-certificate]
                               [--no-check-contextCSN] [-a]
                               [--exclude-attributes EXCL_ATTRS]
                               [--touch TOUCH] [--replace-touch]
                               [--remove-touch-value] [--page-size PAGE_SIZE]

Script to check LDAP syncrepl replication state between two servers.

optional arguments:
  -h, --help            show this help message and exit
  -v, --version         show program's version number and exit
  -p PROVIDER, --provider PROVIDER
                        LDAP provider URI (example:
                        ldaps://ldapmaster.foo:636)
  -c CONSUMER, --consumer CONSUMER
                        LDAP consumer URI (example: ldaps://ldapslave.foo:636)
  -i SERVERID, --serverID SERVERID
                        Compare contextCSN of a specific master. Useful in
                        MultiMaster setups where each master has a unique ID
                        and a contextCSN for each replicated master exists. A
                        valid serverID is a integer value from 0 to 4095
                        (limited to 3 hex digits, example: '12' compares the
                        contextCSN matching '#00C#')
  -T, --starttls        Start TLS on LDAP provider/consumers connections
  -D DN, --dn DN        LDAP bind DN (example:
                        uid=nagios,ou=sysaccounts,o=example
  -P PWD, --pwd PWD     LDAP bind password
  -b BASEDN, --basedn BASEDN
                        LDAP base DN (example: o=example)
  -f FILTERSTR, --filter FILTERSTR
                        LDAP filter (default: (objectClass=*))
  -d, --debug           Debug mode
  -n, --nagios          Nagios check plugin mode
  -q, --quiet           Quiet mode
  --no-check-certificate
                        Don't check the server certificate (Default: False)
  --no-check-contextCSN
                        Don't check servers contextCSN (Default: False)
  -a, --attributes      Check attributes values (Default: check only entryCSN)
  --exclude-attributes EXCL_ATTRS
                        Don't check this attribut (only in attribute check
                        mode)
  --touch TOUCH         Touch attribute giving in parameter to force resync a
                        this LDAP object from provider. A value '%TOUCH%' will
                        be add to this attribute and remove after. The user
                        use to connect to the LDAP directory must have write
                        permission on this attribute on each object.
  --replace-touch       In touch mode, replace value instead of adding.
  --remove-touch-value  In touch mode, remove touch value if present.
  --page-size PAGE_SIZE
                        Page size: if defined, paging control using LDAP v3
                        extended control will be enabled.

Author: Benjamin Renard <brenard@easter-eggs.com>, Source:
https://gogs.zionetrix.net/bn8/check_syncrepl_extended

Copyright

License

This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License version 3 as published by the Free Software Foundation.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program; if not, write to the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.