Monitor LDAP server(s) availability when using keystone-ldap
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
charm-openstack-service-checks |
New
|
Undecided
|
Unassigned |
Bug Description
When using LDAP via keystone-ldap, if the servers configured in "ldap_server" become unresponsive or cannot be consistently reached the keystone/apache workers remain blocked until they timeout (logs below).
This means that the API/CLI becomes unresponsive. This situation can be hard to troubleshoot depending on the cloud and whether the LDAP server(s) are fully unavailable or just unresponsive.
It would help to add monitoring to have a separate alert that detects this condition.
2021-07-13 21:52:01.508342 raise exc_value
2021-07-13 21:52:01.508346 File "/usr/lib/
2021-07-13 21:52:01.508348 result = func(*args,
2021-07-13 21:52:01.508372 ldap.TIMEOUT
2021-07-13 21:59:45.513100 Timeout when reading response headers from daemon process 'keystone-public': /usr/bin/
2021-07-13 22:02:06.019309 Timeout when reading response headers from daemon process 'keystone-public': /usr/bin/
2021-07-13 22:02:12.364508 Timeout when reading response headers from daemon process 'keystone-admin': /usr/bin/
(...)
2021-07-13 23:19:13.846645 mod_wsgi (pid=1525295): Unable to connect to WSGI daemon process 'keystone-admin' on '/var/run/
2021-07-13 23:19:15.374640 mod_wsgi (pid=1349158): Unable to connect to WSGI daemon process 'keystone-admin' on '/var/run/