slapdcheck
CC Attribution 2.0 Belgium:
You are free to use, adapt and copy, distribute and transmit the work or content in adapted or unchanged form for any legal purpose as long as the work is attributed to the author in the manner specified by the author or licensor.
Ströder, Michael
This lightning talk highlights how to monitor OpenLDAP in detail with Python module slapdcheck. OpenLDAP servers are typically used as backed for authentication (login) and other mission-critical infrastructure components. Furthermore OpenLDAP setups can be non-trivial resulting in higher risk that something could go wrong. The talk will introduce the Python module package slapdcheck which implements monitor checks for OpenLDAP servers: * performance data * allocated back-mdb pages * need for restart * replication state slapdcheck parses cn=config to automatically adjust monitoring checks based on current running configuration.
 Okay, I'm Michael. I have almost no clue about monitoring systems except that I need them, but I'm the open LDAP. I'm setting up open LDAP servers for my customers. And so therefore they have monitoring teams. And what I wrote is a sensor for pulling out a little bit more information about an open LDAP server without having to configure so much. And I just show you the monitoring output and go through it and you will have a picture. For example, it has a check whether the certificate, the TLS service certificate is still valid, whether the RSA keys and the public key certificate and the private key is matching very detailed because many things can go wrong. The most important part is it already pulls the configuration of the running server from the so-called configuration back end from open LDAP and it derives the replication topology from this configuration. So you don't have to configure it. What's in the config is already checked. So it tries to connect to all the replicas to get some replication information. It will look which databases are configured and whether they are in a healthy state and how many entries are in there and whether you still have enough space in the memory map database. It will of course give some performance data of the various LDAP operations you can have and it will connect to all the other open LDAP provider replicas and check whether they are available. For example, here there's a warning because only three or five configured replicas are up and reachable. So, and furthermore it checks for example whether the own host name is really in DNS and stuff like this. And yeah, basically that's it. Some more traffic matrix or you can pull out from the open LDAP monitoring back end. So basically that's it. It's a Python module. You can install it with, you can find it on on PyPy. It's called Sloppy Check and currently it's just outputting Magios compatible, CheckMCar compatible output, but I plan to also support Prometheus natively. So, and yeah, you can just install it with PyPy installed into a virtual environment and play with it. Normally you would also have a small wrapper script around it with, okay. So with three parameters where to reach the, okay, where to reach the open LDAP server locally, how to reach it via TLS because the active TLS connections also checked and which identity the server itself has when it does subtle external authentication to other replicas based on his TLS server certificate used as TLS client certificate. Okay. Many open LDAP details. The nice thing is I even use it on the command line just to check whether my system is healthy even if I don't have a monitoring system around. Okay. So that's it. Any question? Time for a question? Okay. Thank you.
 Okay, I'm Michael. I have almost no clue about monitoring systems except that I need them,  but I'm the open LDAP. I'm setting up open LDAP servers for my customers. And so therefore  they have monitoring teams. And what I wrote is a sensor for pulling out a little bit more  information about an open LDAP server without having to configure so much. And I just show you  the monitoring output and go through it and you will have a picture. For example, it has a check  whether the certificate, the TLS service certificate is still valid, whether the RSA keys and the  public key certificate and the private key is matching very detailed because many things can go  wrong. The most important part is it already pulls the configuration of the running server from  the so-called configuration back end from open LDAP and it derives the replication topology  from this configuration. So you don't have to configure it. What's in the config is already  checked. So it tries to connect to all the replicas to get some replication information. It will  look which databases are configured and whether they are in a healthy state and how many entries  are in there and whether you still have enough space in the memory map database. It will of  course give some performance data of the various LDAP operations you can have and it will connect to  all the other open LDAP provider replicas and check whether they are available. For example,  here there's a warning because only three or five configured replicas are up and reachable. So,  and furthermore it checks for example whether the own host name is really in DNS and stuff like this.  And yeah, basically that's it. Some more traffic matrix or you can pull out from the open LDAP  monitoring back end. So basically that's it. It's a Python module. You can install it with,  you can find it on on PyPy. It's called Sloppy Check and currently it's just outputting  Magios compatible, CheckMCar compatible output, but I plan to also support Prometheus natively.  So, and yeah, you can just install it with PyPy installed into a virtual environment and play  with it. Normally you would also have a small wrapper script around it with,  okay. So with three parameters where to reach the, okay, where to reach the open LDAP server  locally, how to reach it via TLS because the active TLS connections also checked and which  identity the server itself has when it does subtle external authentication to other replicas  based on his TLS server certificate used as TLS client certificate. Okay. Many open LDAP  details. The nice thing is I even use it on the command line just to check whether my system is  healthy even if I don't have a monitoring system around. Okay. So that's it. Any question? Time for  a question? Okay. Thank you.
slapdcheck_Monitoring_OpenLDAP_with_Python_EmJ-n3eaQ_s_0_47.png slapdcheck_Monitoring_OpenLDAP_with_Python_EmJ-n3eaQ_s_48_143.png slapdcheck_Monitoring_OpenLDAP_with_Python_EmJ-n3eaQ_s_144_2579.png slapdcheck_Monitoring_OpenLDAP_with_Python_EmJ-n3eaQ_s_2580_4967.png slapdcheck_Monitoring_OpenLDAP_with_Python_EmJ-n3eaQ_s_4968_5891.png slapdcheck_Monitoring_OpenLDAP_with_Python_EmJ-n3eaQ_s_5892_6007.png