Monitor LDAP server(s) availability when using keystone-ldap

Bug #1936176 reported by Jose Guedez
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
charm-openstack-service-checks
New
Undecided
Unassigned

Bug Description

When using LDAP via keystone-ldap, if the servers configured in "ldap_server" become unresponsive or cannot be consistently reached the keystone/apache workers remain blocked until they timeout (logs below).

This means that the API/CLI becomes unresponsive. This situation can be hard to troubleshoot depending on the cloud and whether the LDAP server(s) are fully unavailable or just unresponsive.

It would help to add monitoring to have a separate alert that detects this condition.

2021-07-13 21:52:01.508342 raise exc_value
2021-07-13 21:52:01.508346 File "/usr/lib/python3/dist-packages/ldap/ldapobject.py", line 313, in _ldap_call
2021-07-13 21:52:01.508348 result = func(*args,**kwargs)
2021-07-13 21:52:01.508372 ldap.TIMEOUT
2021-07-13 21:59:45.513100 Timeout when reading response headers from daemon process 'keystone-public': /usr/bin/keystone-wsgi-public
2021-07-13 22:02:06.019309 Timeout when reading response headers from daemon process 'keystone-public': /usr/bin/keystone-wsgi-public
2021-07-13 22:02:12.364508 Timeout when reading response headers from daemon process 'keystone-admin': /usr/bin/keystone-wsgi-admin
(...)
2021-07-13 23:19:13.846645 mod_wsgi (pid=1525295): Unable to connect to WSGI daemon process 'keystone-admin' on '/var/run/apache2/wsgi.1299452.6.1.sock' after multiple attempts as listener backlog limit was exceeded.
2021-07-13 23:19:15.374640 mod_wsgi (pid=1349158): Unable to connect to WSGI daemon process 'keystone-admin' on '/var/run/apache2/wsgi.1299452.6.1.sock' after multiple attempts as listener backlog limit was exceeded.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.