Question: Why are these healthcheck issues present? IPA03 can run a trust show and the Domain Security Identifier matches the kw key. Should the uuid be the same or different between IPA02 and IPA03? Scenario: 3 IPA servers Replication pattern: 1 -> 2 & 3 2 -> 1 & 3 3 -> 1 & 2 All servers are: AD trust agent AD trust controller CA server DNS server health check on IPA01 is completely healthy [root@gsil-ipa03 ~]# ipa-healthcheck --failures-only CN=GSIL-CA,DC=gsil,DC=smil not found, assuming 3rd party [ { "source": "ipahealthcheck.ipa.trust", "check": "IPATrustDomainsCheck", "result": "WARNING", "uuid": "82ff4156-efd4-4bab-a092-ce5d5736c7e8", "when": "20230324133158Z", "duration": "0.235919", "kw": { "key": "domain-status", "domain": "gsil.x", "msg": "Domain {domain} is not online" } }, { "source": "ipahealthcheck.ipa.trust", "check": "IPATrustCatalogCheck", "result": "WARNING", "uuid": "c8a1bebe-fd44-4ea6-8d98-f20ad6726d00", "when": "20230324133158Z",Domain Security Identifier "duration": "0.008165", "kw": { "key": "S-1-5-21-3568498085-2952124370-1649233135", "error": "returned nothing", "msg": "Look up of {key} {error}" } }, { "source": "ipahealthcheck.ipa.trust", "check": "IPATrustCatalogCheck", "result": "ERROR", "uuid": "c0aed85c-9c0a-42df-83ab-d69b4bc054a5", "when": "20230324133158Z", "duration": "0.114333", "kw": { "key": "AD Global Catalog", "output": "Active servers:\nIPA: gsil-ipa03.idm.x.x", "sssctl": "/usr/sbin/sssctl", "domain": "gsil.x", "msg": "{key} not found in {sssctl} 'domain-status' output: {output}" } }, { "source": "ipahealthcheck.ipa.trust", "check": "IPATrustCatalogCheck", "result": "ERROR", "uuid": "6542b352-88ae-4524-ba76-94960adfe9a7", "when": "20230324133158Z", "duration": "0.114378", "kw": { "key": "AD Domain Controller", "output": "Active servers:\nIPA: gsil-ipa03.idm.x.x", "sssctl": "/usr/sbin/sssctl", "domain": "gsil.x", "msg": "{key} not found in {sssctl} 'domain-status' output: {output}" } } ] [root@gsil-ipa03 ~]# ipa trust-show Realm name: gsil.x Realm name: gsil.x Domain NetBIOS name: GSIL Domain Security Identifier: S-1-5-21-3568498085-2952124370-1649233135 Trust direction: Trusting forest Trust type: Active Directory domain [root@gsil-ipa02 ~]# ipa-healthcheck --failures-only caSigningCert External CA not found, assuming 3rd party [ { "source": "ipahealthcheck.ipa.trust", "check": "IPATrustDomainsCheck", "result": "WARNING", "uuid": "319ec55d-6d71-48fa-bb80-4ab5acb9a62b", "when": "20230324133810Z", "duration": "0.281341", "kw": { "key": "domain-status", "domain": "gsil.x", "msg": "Domain {domain} is not online" } } ]