Privilege Manager for Unix 7.2.3 - Administration Guide

pmloadcheck is both a command and a background daemon (run with the -i flag). When run as a command, it checks, updates, and reports on the status of the policy server. You can use pmloadcheck from a policy server or PM Agent.

When run as a daemon process, it keeps track of the status of the policy servers for failover and load-balancing purposes. On policy servers, pmloadcheck is responsible for keeping the production policy file up to date.

See pmloadcheck for more information about the syntax and usage of this command.

Policy servers are failing

The primary and secondary policy servers must be able to communicate with each other and the remote hosts must be able to communicate with the policy servers in the policy group.

For example, if you run the pmloadcheck command on a policy server or PM Agent to determine that it can communicate with other policy servers in the policy group, you may get output similar to the following:

++ Checking host:myhost.example.com (10.10.181.87) ... [FAIL]

There are several possible reasons for failure:

Policy server host is down
Network outage
Service not running on policy server host

These are some ways to verify that the Privilege Manager for Unix service is running properly on the policy server host:

To verify the policy server configuration, run
```
# pmsrvinfo
```
To verify that the service is running, enter
```
# ps -ef | grep pmserviced
```
To verify that the pmmasterd port is in a listening state on the primary policy server, enter
```
# netstat -na | grep 12345
```
To verify the service is enabled, look for the following in the Privilege Manager for Unix configuration file (/etc/opt/quest/qpm4u/pm.settings)
```
pmmasterdEnabled YES
```
To restart the service (on a Linux host), enter
```
# /etc/init.d/pmserviced restart
```
-Or-
```
pmserviced -s
```
Check for other communication issues, such as with your firewall, name resolution, dead network interface, and so forth.

pmgit Troubleshooting

Setting alert for syntactically incorrect policies

Since policy edits are not locally bound to the policy server when using Git policy management, syntactically incorrect policies can enter the Git repository. To address such cases, set an alert from the policy server to warn you if the policy is incorrect.

As an administrator, you can use your own alert script which pmgit tool can call if the policy syntax checking returns an error message after the synchronization between the Git policy repository and the SVN policy repository.

If an alert script is configured, the pmgit tool calls it with 2 parameters:

Email address from the last Git commit
Error message from the syntax check

Sample script

This is a sample script in bash which sends the error message to the user who initiated the last commit.

#!/bin/bash

email_address="$1"
shift
error_msg="$@"
				
/usr/sbin/sendmail -F "noreply" "${email_address}" <<EOF
subject:pmgit error
				
Syntax error occured in one of the policy files:
"${error_msg}"
EOF

To set pmgit tool to send alert messages based on your alert script, see pmgit Set.

製品を選択してください:

サービス向上のために、「Purpose of your Chat（チャットの目的）」を記入してください。

お客様の不具合に推奨されるソリューション

Privilege Manager for Unix 7.2.3 - Administration Guide

Load balancing and policy updates

Policy servers are failing

pmgit Troubleshooting

Setting alert for syntactically incorrect policies

Sample script