ORGANIZATION¶

The areas of the system to check are logically grouped together. This grouping is called a source. A source consists of one or more checks.

A check is as atomic as possible to limit the scope and complexity.

Each check will return a result, either a result of WARNING, ERROR, CRITICAL or SUCCESS. Returning SUCCESS tells you that the check was done and was deemed correct.

Upon failure, the output will include name of the source and name of the check that detected the failure along with a message and name/value pairs indicating the problem. If a check can't make a final determination, it throws WARNING so that it can be examined.

COMMANDS¶

--list-sources
Display a list of the available sources and the checks associated with those sources.

OPTIONAL ARGUMENTS¶

--source=SOURCE
Execute one or more checks within this given source.

--check=CHECK
Execute this particular check within a source. A source must be supplied as well with this option.

--output-type=[json|human]
Set the output type. Defaults to JSON.

--failures-only
Exclude SUCCESS results on output.

--severity=SEVERITY
Only report errors in the requested severity of SUCCESS, WARNING, ERROR or CRITICAL. This can be provided multiple times to search on multiple levels.

--debug
Generate additional debugging output.

JSON OUTPUT¶

The output is displayed as a list of result messages for each check executed in JSON format. This could be input for a monitoring system.

--output-file=FILENAME
Write the output to this filename rather than stdout.

--indent=INDENT
Pretty-print the JSON with this indention level. This can make the output more human-readable.

HUMAN-READABLE OUTPUT¶

The results are displayed in a more human-readable format.

--input-file=FILENAME
Take as input a JSON results output and convert it to a more human-readable form.

CHECKS INCLUDED¶

Certificate sync between CS.cfg and NSS database
Checks whether the system certificates in CS.cfg and NSS database are the same

System certificate expiry
Checks the expiry status of the installed system certificates

System certificate trust flags
Checks whether the installed system certificates carry the correct Trust flags

Subsystem connectivity check
Checks whether a subsystem is running and able to respond to requests