Red Hat Enterprise Linux Diagnostics and Troubleshooting

Red Hat Enterprise Linux systems must be entitled to receive software packages. The Red Hat Subscription Manager (RHSM) service manages software entitlements and tracks subscription status with X.509 certificates. The system entitlement process consists of the following steps.

The subscription-manager tool and rhsmcertd service are both integral to the preceding process. The subscription-manager tool registers systems to the RHSM service and can attach subscriptions to a system. The rhsmcertd service periodically validates current certificates and identifies which certificates require renewal.

RHSM client systems must be able to reach the Red Hat subscription management service and Content Delivery Network (CDN). The default RHSM and CDN servers are subscription.rhsm.redhat.com and cdn.redhat.com, at port 443.

On systems where a GUI is installed, the Red Hat Subscription Manager application is available to configure and manage Red Hat subscriptions. Alternatively, the application is accessible from the web console in the Subscriptions menu.

When the Red Hat Subscription Manager application first launches, a window displays the system's RHSM status, purpose, and any installed products.

Figure 6.1: Red Hat Subscription Manager main menu

Click Register to start the RHSM registration process and display the Register System screen.

Figure 6.2: Red Hat Subscription Manager Register System screen

On the Register System screen, the URL field sets the RHSM server. Selecting Default uses subscription.rhsm.redhat.com. If your organization uses Red Hat Satellite, then provide your Satellite server location instead. If a proxy is required to reach the service, then select Use proxy server and enter the connection information in the additional fields.

With the Method option, systems can register with a Red Hat account or an Activation key. For the Account option, enter your Red Hat Customer Portal user name, password, and organization. Alternatively, for the Activation key option, create a key on the Red Hat Customer Portal, and copy it here.

The screen provides options to automatically attach subscriptions and to subscribe the system to Red Hat Insights. Finish the system registration by clicking Register. The system is now subscribed and ready to install Red Hat software and receive updates.

The subscription-manager command provides the same functionality as the GUI application, and command-line options can override default values. For example, the --serverurl option can specify an RHSM or Satellite server other than subscription.rhsm.redhat.com.

The subscription-manager register command registers a system with the RHSM service. Like the GUI application, use either Red Hat Customer Portal credentials or an activation key to register. Specify usernames and passwords with the --username and --password options, or an activation key with the --activation-key option. By default, subscription-manager prompts for a username and password. You can also use options to specify proxy host and authentication credentials.

[root@host ~]# subscription-manager register
Registering to: subscription.rhsm.redhat.com:443/subscription
Username: redhat-account-username
Password: SecretPassw0rd!
The system has been registered with ID: 30675802-cb74-45b8-a5d6-620f195a031a
The registered system name is: host.lab.example.com

After a system is registered, its installed products must become entitled by attaching subscriptions to them.

The --auto-attach option attaches subscriptions during system registration, but might create unintended results by consuming high support service-level subscriptions on a non-production machine. To mitigate this behavior, use the subscription-manager service-level command to set a preferred service level for installed products on this system. For example, subscription-manager service-level --set=Self-Support selects only "Self-Support" subscriptions when using --auto-attach.

The subscription-manager list --installed command displays a list of installed products and their current status.

[root@host ~]# subscription-manager list --installed
-------------------------------------------
    Installed Product Status
-------------------------------------------
Product Name:   Red Hat Enterprise Linux for x86_64
Product ID:     479
Version:        8.4
Arch:           x86_64
Status:         Not Subscribed
Status Details:
Starts:
Ends:

The subscription-manager list --available command lists the subscriptions that are available to attach to a system. The Provides entries show the supported products for this subscription.

[root@host ~]# subscription-manager list --available
-------------------------------------------
    Available Subscriptions
-------------------------------------------
Subscription Name:   Red Hat Developer Subscription for Individuals
Provides:            Red Hat Developer Tools (for RHEL Server for ARM)
                     Red Hat Enterprise Linux for x86_64
                     ...output omitted...
SKU:                 RH00798
Contract:
Pool ID:             2c9280817671500s0176dffde5147c39
Provides Management: No
Available:           3
Suggested:           1
Service Type:
Roles:               Red Hat Enterprise Linux Server
                     Red Hat Enterprise Linux Workstation
                     Red Hat Enterprise Linux Compute Node
Service Level:       Self-Support
Usage:               Development/Test
Add-ons:
Subscription Type:   Standard
Starts:              01/07/2021
Ends:                01/06/2022
Entitlement Type:    Virtual
...output omitted...

The subscription-manager attach command attaches subscriptions to products. Use the --pool option to specify subscriptions via their Pool ID.

[root@host ~]# subscription-manager attach --pool 2c9280817671500s0176dffde5147c39
Successfully attached a subscription for: Red Hat Developer Subscription for Individuals

The subscription-manager repos command manages software repositories. The --list option displays the available software repositories for this product and their enabled state. Alternatively, use --list-enabled and --list-disabled to restrict the list. Use the --enable and --disable options to include or exclude specified repositories. Wildcards can specify multiple repository IDs, and enable or disable more than one ID at a time. Disabling a repository disallows rpm or yum to locate software from those repositories.

[root@host ~]# subscription-manager repos --list-enabled
----------------------------------------------------------
    Available Repositories in /etc/yum.repos.d/redhat.repo
----------------------------------------------------------
Repo ID:   rhel-8-for-x86_64-baseos-rpms
Repo Name: Red Hat Enterprise Linux 8 for x86_64 - BaseOS (RPMs)
Repo URL:  https://cdn.redhat.com/content/dist/rhel8/$releasever/x86_64/baseos/os
Enabled:   1

Repo ID:   rhel-8-for-x86_64-appstream-rpms
Repo Name: Red Hat Enterprise Linux 8 for x86_64 - AppStream (RPMs)
Repo URL:  https://cdn.redhat.com/content/dist/rhel8/$releasever/x86_64/appstream/os
Enabled:   1

The subscription-manager remove command removes attached subscriptions. Using --all matches all attached subscriptions, and using --serial or --pool options matches subscriptions based on their serial number or Pool ID.

View attached subscriptions with the subscription-manager list --consumed command.

[root@host ~]# subscription-manager list --consumed
-------------------------------------------
   Consumed Subscriptions
-------------------------------------------
Subscription Name:   Red Hat Developer Subscription for Individuals
Provides:            Red Hat Developer Tools (for RHEL Server for ARM)
                     Red Hat Enterprise Linux for x86_64
                     ...output omitted...
SKU:                 RH00798
Contract:
Pool ID:             2c9280817671500s0176dffde5147c39
Provides Management: No
Available:           3
Suggested:           1
Service Type:
Roles:               Red Hat Enterprise Linux Server
                     Red Hat Enterprise Linux Workstation
                     Red Hat Enterprise Linux Compute Node
Service Level:       Self-Support
Usage:               Development/Test
Add-ons:
Subscription Type:   Standard
Starts:              01/07/2021
Ends:                01/06/2022
Entitlement Type:    Virutal
...output omitted...

[root@host ~]# subscription-manager remove --pool 2c9280817671500s0176dffde5147c39
1 local certificate has been deleted.
The entitlement server successfully removed these pools:
   2c9280817671500s0176dffde5147c39
...output omitted...

The subscription-manager unregister command removes a system from the RHSM service. This command removes all attached subscriptions to this system and deletes the locally stored identity and entitlement certificates.

[root@host ~]# subscription-manager unregister
Unregistering from: subscription.rhsm.redhat.com:443/subscription
System has been unregistered.

The Red Hat Subscription Manager (RHSM) service has two primary log files in the /var/log/rhsm directory: rhsm.log and rhsmcertd.log. Log messages generated by the subscription-manager command and Red Hat Subscription Manager GUI application are written to rhsm.log. Log messages generated by rhsmcertd are written to rhsmcertd.log.

[server]
# Server hostname:
hostname = subscription.rhsm.redhat.com

# Server prefix:
prefix = /subscription

# Server port:
port = 443

...output omitted...

# an http proxy server to use
proxy_hostname =

# The scheme to use for the proxy when updating repo definitions, if needed
proxy_scheme = http

# port for http proxy server
proxy_port =

# user name for authenticating to an http proxy, if needed
proxy_user =

# password for basic http proxy auth, if needed
proxy_password =

[rhsm]
# Content base URL:
baseurl = https://cdn.redhat.com

...output omitted...

# Server CA certificate location:
ca_cert_dir = /etc/rhsm/ca/

...output omitted...

# Where the certificates should be stored
productCertDir = /etc/pki/product
entitlementCertDir = /etc/pki/entitlement
consumerCertDir = /etc/pki/consumer

...output omitted...

# Interval to run cert check (in minutes):
certCheckInterval = 240
# Interval to run auto-attach (in minutes):
autoAttachInterval = 1440

[main]
enabled=1

[root@host ~]# ls -l /etc/pki/consumer
total 8
-rw-r-----. 1 root root 2228 Oct 14 07:55 cert.pem
-rw-r-----. 1 root root 3243 Oct 14 07:55 key.pem

[root@host ~]# ls -l /etc/pki/product-default
total 4
-rw-r--r--. 1 root root 2171 Mar 31  2021 479.pem

[root@host ~]# ls /etc/pki/entitlement
total 340
-rw-r--r--. 1 root root   3243 Oct 14 07:55 7898548-key.pem
-rw-r--r--. 1 root root 343003 Oct 14 07:55 7898548.pem

[root@host ~]# rct cat-cert /etc/pki/product-default/479.pem | grep ID:
 ID: 479
[root@host ~]# rct cat-cert /etc/pki/entitlement/7898548.pem | grep 'ID: 479'
 ID: 479

[root@host ~]# curl --head --key /etc/pki/entitlement/7898548-key.pem --cert /etc/pki/entitlement/7898548.pem --cacert /etc/rhsm/ca/redhat-uep.pem https://cdn.redhat.com
HTTP/1.1 403 Forbidden
Server: AkamaiGHost
Mime-Version: 1.0
Content-Type: text/html
Content-Length: 263
Expires: Thu, 14 Oct 2021 12:23:49 GMT
Date: Thu, 14 Oct 2021 12:23:49 GMT
X-Cache: TCP_DENIED from a204-2-243-134.deploy.akamaitechnologies.com (AkamaiGHost/10.4.4-34529956) (-)
Connection: keep-alive
EJ-HOST: authorizer-prod-dc-iad2-4-9jw2j
X-Akamai-Request-ID: 3e7f845