[Freeipa-devel] user-friendly 'IPA internal error' message

[Martin Kosek]

On 04/22/2015 04:47 PM, Simo Sorce wrote:
> On Wed, 2015-04-22 at 17:16 +0300, Alexander Bokovoy wrote:
>> On Wed, 22 Apr 2015, Rob Crittenden wrote:
>>> Jan Cholasta wrote:
>>>> Dne 22.4.2015 v 09:05 Petr Spacek napsal(a):
>>>>> Hello,
>>>>>
>>>>> looking at freeipa-users list, following kind of conversation is quite
>>>>> common:
>>>>>
>>>>> user: 'IPA reports an internal error, what should I do?'
>>>>> dev: 'see HTTPd error log on the IPA server'
>>>>> user: 'what server?'
>>>>> dev: 'enable debugging on client and see which server was contacted'
>>>>>
>>>>>
>>>>> Can we make InternalError more useful and eliminate this kind of
>>>>> ping-pong?
>>>>>
>>>>> Looking at sources:
>>>>> $ git grep 'class .*InternalError'
>>>>> ipalib/errors.py:class InternalError(PublicError):
>>>>> ipalib/errors.py:class ServerInternalError(PublicError):
>>>>>
>>>>> $ git grep ServerInternalError
>>>>> ipalib/errors.py:class ServerInternalError(PublicError):
>>>>> ipalib/errors.py:    >>> raise
>>>>> ServerInternalError(server='https://localhost')
>>>>> ipalib/errors.py:    ServerInternalError: an internal error has
>>>>> occurred on
>>>>> server at 'https://localhost'
>>>>>
>>>>> Apparently somebody was thinking about it in the past but
>>>>> ServerInternalError
>>>>> is not used anywhere.
>>>>>
>>>>> How hard would it be to translate InternalError on client side to
>>>>> ServerInternalError with appropriate server name?
>>>>>
>>>>> Can we extend InternalError with text like this?
>>>>> 'See httpd error log on server %s for more details.'
>>>>>
>>>>> Does it make sense? Should I open a ticket about this?
>>>>>
>>>>
>>>> It's a good idea.
>>>
>>> I don't know. How many people ask about CA install failures without
>>> looking into /var/log/*-install.log even though it states within just a
>>> few lines of output this is where all the logging goes?
>>>
>>> The terseness was done on purpose.
>>>
>>>> On a related note, I would also like the server to send tracebacks to
>>>> the client if debugging is enabled on the server.
>>>
>>> Call me conservative but this was a conscious choice originally as well.
>>> The traceback is in the logs. The admin has the logs.
>> I agree with Rob. Literally every single case when people report 'CA
>> install fails' ends up with people asking us instead of looking into
>> logs. There seems to general unwillingness to invest into understanding
>> of what is being done and why things might fail.
> 
> I have to say this is a completely incorrect way of looking at it.
> 
> People may be willing, but we are suffering of our own success.
> 
> We've made an incredibly complex system, easy enough for people that do
> not fully understand it to use, and well *that* was the intention! So
> huzzah! But ...
> 
> But it come with the pricetag that users do not understand it fully, and
> even knowing *where* logs are is not obvious, and it is not even obvious
> what component is to look at when something breaks.
> 
> so I think it is unfair to say people are unwilling to look at logs,
> some may be, but I bet most simply do not know where to start even.
> Also keep in mind you only see the percentage of users that have
> trouble, those that *so* look at the logs and figure out themselves, or
> are good at searching and fin the solution reported by a previous user
> on their own do not show up.
> 
> The long term solutions can only be:
> a) centralize logging of the various components so that there is a
> single place to go and look and correlate errors even for the untrained.

This is something I was looking as a side gig, even posted a request for ideas
or requirements on freeipa-users list:

https://www.redhat.com/archives/freeipa-users/2015-March/msg00940.html

but so far there were no responses. The centralized logging solutions like ELK
server and derivatives can reveal some stuff, but you need to tell it what
should it correlate together and maybe display. If you have any ideas how to
improve the Troubleshooting by this mean, I would be very interested in it.

> b) develop troubleshooting documentation as cases come up and are
> solved, indexed by symptom

I am encouraging everyone to keep updating the Troubleshooting page, when they
came to a case with problem root cause that is not yet present on that page. We
need to make Troubleshooting page as actual as possible, it may be already
helping a lot, by people simply googling it and not asking on freeipa-users at
all because the issue is resolved.

> c) keep helping our beloved users :-)
> 
> Simo.
>