# Ipa-healthcheck

**URL:** <https://forums.rockylinux.org/t/ipa-healthcheck/16719>\
**Category:** Rocky Linux Help & Support\
**Created:** [December 3, 2024, 12:13pm UTC](https://forums.rockylinux.org/t/ipa-healthcheck/16719 "2024-12-03T12:13:47Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![NolteG](https://sea2.discourse-cdn.com/flex020/user_avatar/forums.rockylinux.org/nolteg/32/4062_2.png) [@NolteG](https://forums.rockylinux.org/u/NolteG)\
**Post date:** [December 3, 2024, 12:13pm UTC](https://forums.rockylinux.org/t/ipa-healthcheck/16719/1 "2024-12-03T12:13:48Z")

</div>

Hi Everyone!

I ran ipa-healthcheck on my master ipa server (ipa01) running on rocky 9.5 and it seems there is a replication issue that I am not sure how to fix on the replica (ipa02). Does anyone know how to fix these issues?

[  
{  
“source”: “ipahealthcheck.ds.replication”,  
“check”: “ReplicationCheck”,  
“result”: “WARNING”,  
“uuid”: “eba28f0a-b1e4-4433-a021-72a804224e70”,  
“when”: “20241203120748Z”,  
“duration”: “0.875160”,  
“kw”: {  
“key”: “DSREPLLE0002”,  
“items”: [  
“Replication”,  
“Conflict Entries”  
],  
“msg”: “There were 6 conflict entries found under the replication suffix "dc=example,dc=com".”  
}  
},  
{  
“source”: “ipahealthcheck.ipa.certs”,  
“check”: “IPACertTracking”,  
“result”: “ERROR”,  
“uuid”: “8db42087-eb0c-443e-8537-9780953307c7”,  
“when”: “20241203120749Z”,  
“duration”: “0.455522”,  
“kw”: {  
“key”: “cert-database=/etc/pki/pki-tomcat/alias, cert-nickname=caSigningCert cert-pki-ca, ca-name=dogtag-ipa-ca-renew-agent, cert-presave-command=/usr/libexec/ipa/certmonger/stop\_pkicad, cert-postsave-command=/usr/libexec/ipa/certmonger/renew\_ca\_cert "caSigningCert cert-pki-ca", template-profile=caCACert”,  
“msg”: “Expected certmonger tracking is missing for {key}. Automated renewal will not happen for this certificate”  
}  
},  
{  
“source”: “ipahealthcheck.ipa.certs”,  
“check”: “IPACertTracking”,  
“result”: “WARNING”,  
“uuid”: “dab64bba-049c-44f9-904e-f6ec5849ddf5”,  
“when”: “20241203120749Z”,  
“duration”: “0.546223”,  
“kw”: {  
“key”: “20240902122824”,  
“msg”: “certmonger tracking request {key} found and is not expected on an IPA master.”  
}  
},  
{  
“source”: “ipahealthcheck.ipa.certs”,  
“check”: “IPACertMatchCheck”,  
“result”: “ERROR”,  
“uuid”: “b3d34c73-5dc6-4b45-8b91-4ad3660982dc”,  
“when”: “20241203120749Z”,  
“duration”: “0.009227”,  
“kw”: {  
“key”: “[cn=EXAMPLE.COM](http://cn=EXAMPLE.COM) IPA CA,cn=certificates,cn=ipa,cn=etc,dc=example,dc=com”,  
“dn”: “[cn=EXAMPLE.COM](http://cn=EXAMPLE.COM) IPA CA,cn=certificates,cn=ipa,cn=etc,dc=example,dc=com”,  
“serial\_number”: 16,  
“msg”: “CA Certificate serial number {serial} is in LDAP ‘{dn}’ but is not in /etc/ipa/ca.crt”  
}  
},  
{  
“source”: “ipahealthcheck.ipa.idns”,  
“check”: “IPADNSSystemRecordsCheck”,  
“result”: “WARNING”,  
“uuid”: “3fb8312c-4cac-4d7b-af96-693809a7cb85”,  
“when”: “20241203120752Z”,  
“duration”: “0.032140”,  
“kw”: {  
“key”: “ipa\_ca\_missing\_ipa02.example.com”,  
“server”: “[ipa02.example.com](http://ipa02.example.com)”,  
“ipaddr”: “10.0.129.42”,  
“msg”: “expected ipa-ca to contain {ipaddr} for {server}”  
}  
}  
]

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex020/uploads/rockylinux/original/1X/91b7219eec10e30013422e4df76c1d898711a5d5.svg) [@system](https://forums.rockylinux.org/u/system)\
**Post date:** [February 1, 2025, 12:14pm UTC](https://forums.rockylinux.org/t/ipa-healthcheck/16719/2 "2025-02-01T12:14:05Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.