Chapter 6. Verifying the optimal number of KDC worker processes using IdM Healthcheck
Chapter 6. Verifying the optimal number of KDC worker processes using IdM Healthcheck You can use the Healthcheck tool in Identity Management (IdM) to verify that the Kerberos Key Distribution Center (KDC) is configured to use the optimal number of krb5kdc worker processes, which should be equal to the number of CPU cores on the host. You can find the test for the correct number of KDC worker processes under the ipahealthcheck.ipa.kdc source. As the Healthcheck tool includes many tests, you can narrow down the results by including only the KDC worker tests by adding the --source ipahealthcheck.ipa.kdc option. Prerequisites The KDC worker process Healthcheck tool is only available on RHEL 8.7 or newer. You must perform Healthcheck tests as the root user. Procedure To run the check for KDC worker processes, enter: If the number of KDC worker processes matches the number of CPU cores, the test returns SUCCESS as a result: The test returns a WARNING if the number of worker processes does not match the number of CPU cores. In the following example, a host with 2 cores is configured to have only one KDC worker process: The test also outputs a WARNING if there are no configured workers. In the following example, the KRB5KDC_ARGS variable is missing from the /etc/sysconfig/krb5kdc configuration file: Additional resources man ipa-healthcheck
ipa-healthcheck --source ipahealthcheck.ipa.kdc { "source": "ipahealthcheck.ipa.kdc", "check": "KDCWorkersCheck", "result": " SUCCESS ", "uuid": "68f6e20a-0aa9-427d-8fdc-fbb8196d56cd", "when": "20230105162211Z", "duration": "0.000157", "kw": { "key": "workers" } } { "source": "ipahealthcheck.ipa.kdc", "check": "KDCWorkersCheck", "result": " WARNING ", "uuid": "972b7782-1616-48e0-bd5c-49a80c257895", "when": "20230105122236Z", "duration": "0.203049", "kw": { "key": 'workers', "cpus": 2, "workers": 1, "expected": " The number of CPUs {cpus} does not match the number of workers {workers} in {sysconfig} " } } { "source": "ipahealthcheck.ipa.kdc", "check": "KDCWorkersCheck", "result": " WARNING ", "uuid": "5d63ea86-67b9-4638-a41e-b71f4 56efed7", "when": "20230105162526Z", "duration": "0.000135", "kw": { "key": "workers", "sysconfig": "/etc/sysconfig/krb5kdc", "msg": " KRB5KDC_ARGS is not set in {sysconfig} " } }