Update DEBUG* invocations to use new levels

Use a script to update DEBUG* macro invocations, which use literal
numbers for levels, to use bitmask macros instead:

grep -rl --include '*.[hc]' DEBUG . |
    while read f; do
        mv "$f"{,.orig}
        perl -e 'use strict;
                 use File::Slurp;
                 my @map=qw"
                    SSSDBG_FATAL_FAILURE
                    SSSDBG_CRIT_FAILURE
                    SSSDBG_OP_FAILURE
                    SSSDBG_MINOR_FAILURE
                    SSSDBG_CONF_SETTINGS
                    SSSDBG_FUNC_DATA
                    SSSDBG_TRACE_FUNC
                    SSSDBG_TRACE_LIBS
                    SSSDBG_TRACE_INTERNAL
                    SSSDBG_TRACE_ALL
                 ";
                 my $text=read_file(\*STDIN);
                 my $repl;
                 $text=~s/
                            ^
                            (
                                .*
                                \b
                                (DEBUG|DEBUG_PAM_DATA|DEBUG_GR_MEM)
                                \s*
                                \(\s*
                            )(
                                [0-9]
                            )(
                                \s*,
                            )
                            (
                                \s*
                            )
                            (
                                .*
                            )
                            $
                         /
                            $repl = $1.$map[$3].$4.$5.$6,
                            length($repl) <= 80
                                ? $repl
                                : $1.$map[$3].$4."\n".(" " x length($1)).$6
                         /xmge;
                 print $text;
        ' < "$f.orig" > "$f"
        rm "$f.orig"
    done

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>

12 files changed, 203 insertions, 131 deletions

diff --git a/src/tools/selinux.c b/src/tools/selinux.c
index a5943c9f1..e10f806bb 100644
--- a/src/tools/selinux.c
+++ b/src/tools/selinux.c
@@ -133,7 +133,7 @@ static semanage_handle_t *sss_semanage_init(void)
 
     handle = semanage_handle_create();
     if (!handle) {
-        DEBUG(1, "Cannot create SELinux management handle\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot create SELinux management handle\n");
         return NULL;
     }
 
@@ -143,25 +143,26 @@ static semanage_handle_t *sss_semanage_init(void)
 
     ret = semanage_is_managed(handle);
     if (ret != 1) {
-        DEBUG(1, "SELinux policy not managed\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "SELinux policy not managed\n");
         goto fail;
     }
 
     ret = semanage_access_check(handle);
     if (ret < SEMANAGE_CAN_READ) {
-        DEBUG(1, "Cannot read SELinux policy store\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot read SELinux policy store\n");
         goto fail;
     }
 
     ret = semanage_connect(handle);
     if (ret != 0) {
-        DEBUG(1, "Cannot estabilish SELinux management connection\n");
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Cannot estabilish SELinux management connection\n");
         goto fail;
     }
 
     ret = semanage_begin_transaction(handle);
     if (ret != 0) {
-        DEBUG(1, "Cannot begin SELinux transaction\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot begin SELinux transaction\n");
         goto fail;
     }
 
@@ -181,35 +182,39 @@ static int sss_semanage_user_add(semanage_handle_t *handle,
 
     ret = semanage_seuser_create(handle, &seuser);
     if (ret != 0) {
-        DEBUG(1, "Cannot create SELinux login mapping for %s\n", login_name);
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Cannot create SELinux login mapping for %s\n", login_name);
         ret = EIO;
         goto done;
     }
 
     ret = semanage_seuser_set_name(handle, seuser, login_name);
     if (ret != 0) {
-        DEBUG(1, "Could not set name for %s\n", login_name);
+        DEBUG(SSSDBG_CRIT_FAILURE, "Could not set name for %s\n", login_name);
         ret = EIO;
         goto done;
     }
 
     ret = semanage_seuser_set_mlsrange(handle, seuser, DEFAULT_SERANGE);
     if (ret != 0) {
-        DEBUG(1, "Could not set serange for %s\n", login_name);
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Could not set serange for %s\n", login_name);
         ret = EIO;
         goto done;
     }
 
     ret = semanage_seuser_set_sename(handle, seuser, seuser_name);
     if (ret != 0) {
-        DEBUG(1, "Could not set SELinux user for %s\n", login_name);
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Could not set SELinux user for %s\n", login_name);
         ret = EIO;
         goto done;
     }
 
     ret = semanage_seuser_modify_local(handle, key, seuser);
     if (ret != 0) {
-        DEBUG(1, "Could not add login mapping for %s\n", login_name);
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Could not add login mapping for %s\n", login_name);
         ret = EIO;
         goto done;
     }
@@ -230,28 +235,31 @@ static int sss_semanage_user_mod(semanage_handle_t *handle,
 
     semanage_seuser_query(handle, key, &seuser);
     if (seuser == NULL) {
-        DEBUG(1, "Could not query seuser for %s\n", login_name);
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Could not query seuser for %s\n", login_name);
         ret = EIO;
         goto done;
     }
 
     ret = semanage_seuser_set_mlsrange(handle, seuser, DEFAULT_SERANGE);
     if (ret != 0) {
-        DEBUG(1, "Could not set serange for %s\n", login_name);
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Could not set serange for %s\n", login_name);
         ret = EIO;
         goto done;
     }
 
     ret = semanage_seuser_set_sename(handle, seuser, seuser_name);
     if (ret != 0) {
-        DEBUG(1, "Could not set sename for %s\n", login_name);
+        DEBUG(SSSDBG_CRIT_FAILURE, "Could not set sename for %s\n", login_name);
         ret = EIO;
         goto done;
     }
 
     ret = semanage_seuser_modify_local(handle, key, seuser);
     if (ret != 0) {
-        DEBUG(1, ("Could not modify login mapping for %s\n"), login_name);
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              ("Could not modify login mapping for %s\n"), login_name);
         ret = EIO;
         goto done;
     }
@@ -276,21 +284,21 @@ int set_seuser(const char *login_name, const char *seuser_name)
 
     handle = sss_semanage_init();
     if (!handle) {
-        DEBUG(1, "Cannot init SELinux management\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot init SELinux management\n");
         ret = EIO;
         goto done;
     }
 
     ret = semanage_seuser_key_create(handle, login_name, &key);
     if (ret != 0) {
-        DEBUG(1, "Cannot create SELinux user key\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot create SELinux user key\n");
         ret = EIO;
         goto done;
     }
 
     ret = semanage_seuser_exists(handle, key, &seuser_exists);
     if (ret < 0) {
-        DEBUG(1, "Cannot verify the SELinux user\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot verify the SELinux user\n");
         ret = EIO;
         goto done;
     }
@@ -298,14 +306,14 @@ int set_seuser(const char *login_name, const char *seuser_name)
     if (seuser_exists) {
         ret = sss_semanage_user_mod(handle, key, login_name, seuser_name);
         if (ret != 0) {
-            DEBUG(1, "Cannot modify SELinux user mapping\n");
+            DEBUG(SSSDBG_CRIT_FAILURE, "Cannot modify SELinux user mapping\n");
             ret = EIO;
             goto done;
         }
     } else {
         ret = sss_semanage_user_add(handle, key, login_name, seuser_name);
         if (ret != 0) {
-            DEBUG(1, "Cannot add SELinux user mapping\n");
+            DEBUG(SSSDBG_CRIT_FAILURE, "Cannot add SELinux user mapping\n");
             ret = EIO;
             goto done;
         }
@@ -313,7 +321,7 @@ int set_seuser(const char *login_name, const char *seuser_name)
 
     ret = semanage_commit(handle);
     if (ret < 0) {
-        DEBUG(1, "Cannot commit SELinux transaction\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot commit SELinux transaction\n");
         ret = EIO;
         goto done;
     }
@@ -334,27 +342,28 @@ int del_seuser(const char *login_name)
 
     handle = sss_semanage_init();
     if (!handle) {
-        DEBUG(1, "Cannot init SELinux management\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot init SELinux management\n");
         ret = EIO;
         goto done;
     }
 
     ret = semanage_seuser_key_create(handle, login_name, &key);
     if (ret != 0) {
-        DEBUG(1, "Cannot create SELinux user key\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot create SELinux user key\n");
         ret = EIO;
         goto done;
     }
 
     ret = semanage_seuser_exists(handle, key, &exists);
     if (ret < 0) {
-        DEBUG(1, "Cannot verify the SELinux user\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot verify the SELinux user\n");
         ret = EIO;
         goto done;
     }
 
     if (!exists) {
-        DEBUG(5, "Login mapping for %s is not defined, OK if default mapping "
+        DEBUG(SSSDBG_FUNC_DATA,
+              "Login mapping for %s is not defined, OK if default mapping "
                   "was used\n", login_name);
         ret = EOK;  /* probably default mapping */
         goto done;
@@ -362,13 +371,13 @@ int del_seuser(const char *login_name)
 
     ret = semanage_seuser_exists_local(handle, key, &exists);
     if (ret < 0) {
-        DEBUG(1, "Cannot verify the SELinux user\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot verify the SELinux user\n");
         ret = EIO;
         goto done;
     }
 
     if (!exists) {
-        DEBUG(1, "Login mapping for %s is defined in policy, "
+        DEBUG(SSSDBG_CRIT_FAILURE, "Login mapping for %s is defined in policy, "
                   "cannot be deleted", login_name);
         ret = ENOENT;
         goto done;
@@ -376,14 +385,15 @@ int del_seuser(const char *login_name)
 
     ret = semanage_seuser_del_local(handle, key);
     if (ret != 0) {
-        DEBUG(1, "Could not delete login mapping for %s", login_name);
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Could not delete login mapping for %s", login_name);
         ret = EIO;
         goto done;
     }
 
     ret = semanage_commit(handle);
     if (ret < 0) {
-        DEBUG(1, "Cannot commit SELinux transaction\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot commit SELinux transaction\n");
         ret = EIO;
         goto done;
     }
diff --git a/src/tools/sss_cache.c b/src/tools/sss_cache.c
index 77cba4610..ffa4e35e2 100644
--- a/src/tools/sss_cache.c
+++ b/src/tools/sss_cache.c
@@ -450,14 +450,15 @@ static errno_t invalidate_entry(TALLOC_CTX *ctx,
                     return EINVAL;
             }
             if (ret != EOK) {
-                DEBUG(3, "Could not set entry attributes\n");
+                DEBUG(SSSDBG_MINOR_FAILURE, "Could not set entry attributes\n");
             }
         } else {
-            DEBUG(3, "Could not add expiration time to attributes\n");
+            DEBUG(SSSDBG_MINOR_FAILURE,
+                  "Could not add expiration time to attributes\n");
         }
         talloc_zfree(sys_attrs);
     } else {
-        DEBUG(3, "Could not create sysdb attributes\n");
+        DEBUG(SSSDBG_MINOR_FAILURE, "Could not create sysdb attributes\n");
         ret = ENOMEM;
     }
     return ret;
@@ -478,7 +479,8 @@ errno_t init_domains(struct cache_tool_ctx *ctx, const char *domain)
     ret = confdb_init(ctx, &ctx->confdb, confdb_path);
     talloc_free(confdb_path);
     if (ret != EOK) {
-        DEBUG(1, "Could not initialize connection to the confdb\n");
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Could not initialize connection to the confdb\n");
         return ret;
     }
 
@@ -487,21 +489,23 @@ errno_t init_domains(struct cache_tool_ctx *ctx, const char *domain)
                                domain, DB_PATH, &ctx->domains);
         if (ret != EOK) {
             SYSDB_VERSION_ERROR(ret);
-            DEBUG(1, "Could not initialize connection to the sysdb\n");
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Could not initialize connection to the sysdb\n");
             return ret;
         }
 
     } else {
         ret = confdb_get_domains(ctx->confdb, &ctx->domains);
         if (ret != EOK) {
-            DEBUG(1, "Could not initialize domains\n");
+            DEBUG(SSSDBG_CRIT_FAILURE, "Could not initialize domains\n");
             return ret;
         }
 
         ret = sysdb_init(ctx, ctx->domains, false);
         SYSDB_VERSION_ERROR(ret);
         if (ret != EOK) {
-            DEBUG(1, "Could not initialize connection to the sysdb\n");
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Could not initialize connection to the sysdb\n");
             return ret;
         }
     }
@@ -566,7 +570,8 @@ errno_t init_context(int argc, const char *argv[], struct cache_tool_ctx **tctx)
 
     ret = set_locale();
     if (ret != EOK) {
-        DEBUG(1, "set_locale failed (%d): %s\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "set_locale failed (%d): %s\n", ret, strerror(ret));
         ERROR("Error setting the locale\n");
         goto fini;
     }
@@ -613,7 +618,8 @@ errno_t init_context(int argc, const char *argv[], struct cache_tool_ctx **tctx)
 
     ctx = talloc_zero(NULL, struct cache_tool_ctx);
     if (ctx == NULL) {
-        DEBUG(1, "Could not allocate memory for tools context\n");
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Could not allocate memory for tools context\n");
         ret = ENOMEM;
         goto fini;
     }
@@ -667,7 +673,7 @@ errno_t init_context(int argc, const char *argv[], struct cache_tool_ctx **tctx)
          (user && !ctx->user_name) || (group && !ctx->group_name) ||
          (netgroup && !ctx->netgroup_name) || (map && !ctx->autofs_name) ||
          (service && !ctx->service_name)) {
-        DEBUG(1, "Construction of filters failed\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Construction of filters failed\n");
         ret = ENOMEM;
         goto fini;
     }
diff --git a/src/tools/sss_groupadd.c b/src/tools/sss_groupadd.c
index 8f5da01c0..0152aeff0 100644
--- a/src/tools/sss_groupadd.c
+++ b/src/tools/sss_groupadd.c
@@ -54,7 +54,8 @@ int main(int argc, const char **argv)
 
     ret = set_locale();
     if (ret != EOK) {
-        DEBUG(1, "set_locale failed (%d): %s\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "set_locale failed (%d): %s\n", ret, strerror(ret));
         ERROR("Error setting the locale\n");
         ret = EXIT_FAILURE;
         goto fini;
@@ -79,7 +80,8 @@ int main(int argc, const char **argv)
 
     ret = init_sss_tools(&tctx);
     if (ret != EOK) {
-        DEBUG(1, "init_sss_tools failed (%d): %s\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "init_sss_tools failed (%d): %s\n", ret, strerror(ret));
         if (ret == ENOENT) {
             ERROR("Error initializing the tools - no local domain\n");
         } else {
@@ -146,7 +148,8 @@ done:
                 break;
 
             default:
-                DEBUG(1, "sysdb operation failed (%d)[%s]\n", ret, strerror(ret));
+                DEBUG(SSSDBG_CRIT_FAILURE,
+                      "sysdb operation failed (%d)[%s]\n", ret, strerror(ret));
                 ERROR("Transaction error. Could not add group.\n");
                 break;
         }
diff --git a/src/tools/sss_groupdel.c b/src/tools/sss_groupdel.c
index df49a7563..947bb4a4d 100644
--- a/src/tools/sss_groupdel.c
+++ b/src/tools/sss_groupdel.c
@@ -49,7 +49,8 @@ int main(int argc, const char **argv)
 
     ret = set_locale();
     if (ret != EOK) {
-        DEBUG(1, "set_locale failed (%d): %s\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "set_locale failed (%d): %s\n", ret, strerror(ret));
         ERROR("Error setting the locale\n");
         ret = EXIT_FAILURE;
         goto fini;
@@ -73,7 +74,8 @@ int main(int argc, const char **argv)
 
     ret = init_sss_tools(&tctx);
     if (ret != EOK) {
-        DEBUG(1, "init_sss_tools failed (%d): %s\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "init_sss_tools failed (%d): %s\n", ret, strerror(ret));
         if (ret == ENOENT) {
             ERROR("Error initializing the tools - no local domain\n");
         } else {
@@ -123,7 +125,8 @@ int main(int argc, const char **argv)
 
 done:
     if (ret) {
-        DEBUG(1, "sysdb operation failed (%d)[%s]\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "sysdb operation failed (%d)[%s]\n", ret, strerror(ret));
         switch (ret) {
             case ENOENT:
                 ERROR("No such group in local domain. "
diff --git a/src/tools/sss_groupmod.c b/src/tools/sss_groupmod.c
index 5ee97dd5e..21d78278c 100644
--- a/src/tools/sss_groupmod.c
+++ b/src/tools/sss_groupmod.c
@@ -61,7 +61,8 @@ int main(int argc, const char **argv)
 
     ret = set_locale();
     if (ret != EOK) {
-        DEBUG(1, "set_locale failed (%d): %s\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "set_locale failed (%d): %s\n", ret, strerror(ret));
         ERROR("Error setting the locale\n");
         ret = EXIT_FAILURE;
         goto fini;
@@ -106,7 +107,8 @@ int main(int argc, const char **argv)
 
     ret = init_sss_tools(&tctx);
     if (ret != EOK) {
-        DEBUG(1, "init_sss_tools failed (%d): %s\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "init_sss_tools failed (%d): %s\n", ret, strerror(ret));
         if (ret == ENOENT) {
             ERROR("Error initializing the tools - no local domain\n");
         } else {
@@ -137,7 +139,8 @@ int main(int argc, const char **argv)
     if (addgroups) {
         ret = parse_groups(tctx, addgroups, &tctx->octx->addgroups);
         if (ret != EOK) {
-            DEBUG(1, "Cannot parse groups to add the group to\n");
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Cannot parse groups to add the group to\n");
             ERROR("Internal error while parsing parameters\n");
             ret = EXIT_FAILURE;
             goto fini;
@@ -145,7 +148,8 @@ int main(int argc, const char **argv)
 
         ret = parse_group_name_domain(tctx, tctx->octx->addgroups);
         if (ret != EOK) {
-            DEBUG(1, "Cannot parse FQDN groups to add the group to\n");
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Cannot parse FQDN groups to add the group to\n");
             ERROR("Member groups must be in the same domain as parent group\n");
             ret = EXIT_FAILURE;
             goto fini;
@@ -164,7 +168,8 @@ int main(int argc, const char **argv)
     if (rmgroups) {
         ret = parse_groups(tctx, rmgroups, &tctx->octx->rmgroups);
         if (ret != EOK) {
-            DEBUG(1, "Cannot parse groups to remove the group from\n");
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Cannot parse groups to remove the group from\n");
             ERROR("Internal error while parsing parameters\n");
             ret = EXIT_FAILURE;
             goto fini;
@@ -172,7 +177,8 @@ int main(int argc, const char **argv)
 
         ret = parse_group_name_domain(tctx, tctx->octx->rmgroups);
         if (ret != EOK) {
-            DEBUG(1, "Cannot parse FQDN groups to remove the group from\n");
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Cannot parse FQDN groups to remove the group from\n");
             ERROR("Member groups must be in the same domain as parent group\n");
             ret = EXIT_FAILURE;
             goto fini;
@@ -244,7 +250,8 @@ done:
     }
     if (tctx->error) {
         ret = tctx->error;
-        DEBUG(1, "sysdb operation failed (%d)[%s]\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "sysdb operation failed (%d)[%s]\n", ret, strerror(ret));
         switch (ret) {
             case ENOENT:
                 ERROR("Could not modify group - check if member group names are correct\n");
diff --git a/src/tools/sss_groupshow.c b/src/tools/sss_groupshow.c
index 8689760d8..f7c798df6 100644
--- a/src/tools/sss_groupshow.c
+++ b/src/tools/sss_groupshow.c
@@ -80,7 +80,7 @@ static int parse_memberofs(struct ldb_context *ldb,
         if (gi->memberofs[i] == NULL) {
             return ENOMEM;
         }
-        DEBUG(6, "memberof value: %s\n", gi->memberofs[i]);
+        DEBUG(SSSDBG_TRACE_FUNC, "memberof value: %s\n", gi->memberofs[i]);
     }
     gi->memberofs[el->num_values] = NULL;
 
@@ -140,7 +140,7 @@ static int parse_members(TALLOC_CTX *mem_ctx,
                 ret = ENOMEM;
                 goto fail;
             }
-            DEBUG(6, "User member %s\n", um[um_index]);
+            DEBUG(SSSDBG_TRACE_FUNC, "User member %s\n", um[um_index]);
             um_index++;
         } else if (ldb_dn_compare_base(parent_dn, group_basedn) == 0) {
             gm[gm_index] = rdn_as_string(mem_ctx, dn);
@@ -149,14 +149,15 @@ static int parse_members(TALLOC_CTX *mem_ctx,
                 goto fail;
             }
             if (parent_name && strcmp(gm[gm_index], parent_name) == 0) {
-                DEBUG(6, "Skipping circular nesting for group %s\n",
+                DEBUG(SSSDBG_TRACE_FUNC,
+                      "Skipping circular nesting for group %s\n",
                           gm[gm_index]);
                 continue;
             }
-            DEBUG(6, "Group member %s\n", gm[gm_index]);
+            DEBUG(SSSDBG_TRACE_FUNC, "Group member %s\n", gm[gm_index]);
             gm_index++;
         } else {
-            DEBUG(2, "Group member not a user nor group: %s\n",
+            DEBUG(SSSDBG_OP_FAILURE, "Group member not a user nor group: %s\n",
                         ldb_dn_get_linearized(dn));
             ret = EIO;
             goto fail;
@@ -216,7 +217,8 @@ static int process_group(TALLOC_CTX *mem_ctx,
     struct group_info *gi = NULL;
     const char **user_members;
 
-    DEBUG(6, "Found entry %s\n", ldb_dn_get_linearized(msg->dn));
+    DEBUG(SSSDBG_TRACE_FUNC,
+          "Found entry %s\n", ldb_dn_get_linearized(msg->dn));
 
     gi = talloc_zero(mem_ctx, struct group_info);
     if (!gi) {
@@ -232,7 +234,7 @@ static int process_group(TALLOC_CTX *mem_ctx,
     gi->gid = ldb_msg_find_attr_as_uint64(msg,
                                           SYSDB_GIDNUM, 0);
     if (gi->gid == 0 || gi->name == NULL) {
-        DEBUG(3, "No name or no GID?\n");
+        DEBUG(SSSDBG_MINOR_FAILURE, "No name or no GID?\n");
         ret = EIO;
         goto done;
     }
@@ -334,7 +336,8 @@ int group_show(TALLOC_CTX *mem_ctx,
     /* First, search for the root group */
     ret = sysdb_search_group_by_name(mem_ctx, domain, name, attrs, &msg);
     if (ret) {
-        DEBUG(2, "Search failed: %s (%d)\n", strerror(ret), ret);
+        DEBUG(SSSDBG_OP_FAILURE,
+              "Search failed: %s (%d)\n", strerror(ret), ret);
         goto done;
     }
 
@@ -342,7 +345,7 @@ int group_show(TALLOC_CTX *mem_ctx,
                         msg, domain, NULL, &root,
                         &group_members, &nmembers);
     if (ret != EOK) {
-        DEBUG(2, "Group processing failed: %s (%d)\n",
+        DEBUG(SSSDBG_OP_FAILURE, "Group processing failed: %s (%d)\n",
                    strerror(ret), ret);
         goto done;
     }
@@ -392,7 +395,8 @@ int group_show(TALLOC_CTX *mem_ctx,
                              group_members, nmembers,
                              &root->group_members);
     if (ret) {
-        DEBUG(2, "Recursive search failed: %s (%d)\n", strerror(ret), ret);
+        DEBUG(SSSDBG_OP_FAILURE,
+              "Recursive search failed: %s (%d)\n", strerror(ret), ret);
         goto done;
     }
 
@@ -446,7 +450,7 @@ static int group_show_trim_memberof(TALLOC_CTX *mem_ctx,
             name = ldb_msg_find_attr_as_string(msgs[0],
                                                SYSDB_NAME, NULL);
             if (!name) {
-                DEBUG(2, "Entry %s has no Name Attribute ?!?\n",
+                DEBUG(SSSDBG_OP_FAILURE, "Entry %s has no Name Attribute ?!?\n",
                       ldb_dn_get_linearized(msgs[0]->dn));
                 return EFAULT;
             }
@@ -507,7 +511,8 @@ int group_show_recurse(TALLOC_CTX *mem_ctx,
         ret = sysdb_search_group_by_name(mem_ctx, domain, group_members[i],
                                          attrs, &msg);
         if (ret) {
-            DEBUG(2, "Search failed: %s (%d)\n", strerror(ret), ret);
+            DEBUG(SSSDBG_OP_FAILURE,
+                  "Search failed: %s (%d)\n", strerror(ret), ret);
             return EIO;
         }
 
@@ -515,7 +520,7 @@ int group_show_recurse(TALLOC_CTX *mem_ctx,
                             msg, domain, parent->name,
                             &groups[i], &new_group_members, &new_nmembers);
         if (ret != EOK) {
-            DEBUG(2, "Group processing failed: %s (%d)\n",
+            DEBUG(SSSDBG_OP_FAILURE, "Group processing failed: %s (%d)\n",
                       strerror(ret), ret);
             return ret;
         }
@@ -527,7 +532,7 @@ int group_show_recurse(TALLOC_CTX *mem_ctx,
                                      new_group_members, new_nmembers,
                                      &parent->group_members);
             if (ret != EOK) {
-                DEBUG(2, "Recursive search failed: %s (%d)\n",
+                DEBUG(SSSDBG_OP_FAILURE, "Recursive search failed: %s (%d)\n",
                           strerror(ret), ret);
                 return ret;
             }
@@ -559,7 +564,8 @@ static int group_show_mpg(TALLOC_CTX *mem_ctx,
 
     ret = sysdb_search_user_by_name(info, domain, name, attrs, &msg);
     if (ret) {
-        DEBUG(2, "Search failed: %s (%d)\n", strerror(ret), ret);
+        DEBUG(SSSDBG_OP_FAILURE,
+              "Search failed: %s (%d)\n", strerror(ret), ret);
         goto fail;
     }
 
@@ -568,7 +574,7 @@ static int group_show_mpg(TALLOC_CTX *mem_ctx,
                                                            SYSDB_NAME, NULL));
     info->gid = ldb_msg_find_attr_as_uint64(msg, SYSDB_UIDNUM, 0);
     if (info->gid == 0 || info->name == NULL) {
-        DEBUG(3, "No name or no GID?\n");
+        DEBUG(SSSDBG_MINOR_FAILURE, "No name or no GID?\n");
         ret = EIO;
         goto fail;
     }
@@ -656,7 +662,8 @@ int main(int argc, const char **argv)
 
     ret = set_locale();
     if (ret != EOK) {
-        DEBUG(1, "set_locale failed (%d): %s\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "set_locale failed (%d): %s\n", ret, strerror(ret));
         ERROR("Error setting the locale\n");
         ret = EXIT_FAILURE;
         goto fini;
@@ -688,7 +695,8 @@ int main(int argc, const char **argv)
 
     ret = init_sss_tools(&tctx);
     if (ret != EOK) {
-        DEBUG(1, "init_sss_tools failed (%d): %s\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "init_sss_tools failed (%d): %s\n", ret, strerror(ret));
         if (ret == ENOENT) {
             ERROR("Error initializing the tools - no local domain\n");
         } else {
@@ -716,7 +724,8 @@ int main(int argc, const char **argv)
 
     /* Process result */
     if (ret) {
-        DEBUG(1, "sysdb operation failed (%d)[%s]\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "sysdb operation failed (%d)[%s]\n", ret, strerror(ret));
         switch (ret) {
             case ENOENT:
                 ERROR("No such group in local domain. "
diff --git a/src/tools/sss_sync_ops.c b/src/tools/sss_sync_ops.c
index 57334295e..b4366d7a9 100644
--- a/src/tools/sss_sync_ops.c
+++ b/src/tools/sss_sync_ops.c
@@ -38,7 +38,7 @@
 
 #define VAR_CHECK(var, val, attr, msg) do { \
         if (var != (val)) { \
-            DEBUG(1, msg" attribute: %s", attr); \
+            DEBUG(SSSDBG_CRIT_FAILURE, msg" attribute: %s", attr); \
             return val; \
         } \
 } while(0)
@@ -364,7 +364,7 @@ int useradd_defaults(TALLOC_CTX *mem_ctx,
         ret = ENOMEM;
         goto done;
     }
-    DEBUG(7, "Gecos: %s\n", data->gecos);
+    DEBUG(SSSDBG_TRACE_LIBS, "Gecos: %s\n", data->gecos);
 
     /* homedir */
     if (homedir) {
@@ -382,7 +382,7 @@ int useradd_defaults(TALLOC_CTX *mem_ctx,
         ret = ENOMEM;
         goto done;
     }
-    DEBUG(7, "Homedir: %s\n", data->home);
+    DEBUG(SSSDBG_TRACE_LIBS, "Homedir: %s\n", data->home);
 
     /* default shell */
     if (!shell) {
@@ -399,7 +399,7 @@ int useradd_defaults(TALLOC_CTX *mem_ctx,
             goto done;
         }
     }
-    DEBUG(7, "Shell: %s\n", data->shell);
+    DEBUG(SSSDBG_TRACE_LIBS, "Shell: %s\n", data->shell);
 
     /* create homedir on user creation? */
     if (!create_home) {
@@ -412,7 +412,8 @@ int useradd_defaults(TALLOC_CTX *mem_ctx,
     } else {
         data->create_homedir = (create_home == DO_CREATE_HOME);
     }
-    DEBUG(7, "Auto create homedir: %s\n", data->create_homedir?"True":"False");
+    DEBUG(SSSDBG_TRACE_LIBS,
+          "Auto create homedir: %s\n", data->create_homedir?"True":"False");
 
     /* umask to create homedirs */
     ret = confdb_get_int(confdb,
@@ -421,7 +422,7 @@ int useradd_defaults(TALLOC_CTX *mem_ctx,
     if (ret != EOK) {
         goto done;
     }
-    DEBUG(7, "Umask: %o\n", data->umask);
+    DEBUG(SSSDBG_TRACE_LIBS, "Umask: %o\n", data->umask);
 
     /* a directory to create mail spools in */
     ret = confdb_get_string(confdb, mem_ctx,
@@ -430,7 +431,7 @@ int useradd_defaults(TALLOC_CTX *mem_ctx,
     if (ret != EOK) {
         goto done;
     }
-    DEBUG(7, "Mail dir: %s\n", data->maildir);
+    DEBUG(SSSDBG_TRACE_LIBS, "Mail dir: %s\n", data->maildir);
 
     /* skeleton dir */
     if (!skeldir) {
@@ -447,7 +448,7 @@ int useradd_defaults(TALLOC_CTX *mem_ctx,
             goto done;
         }
     }
-    DEBUG(7, "Skeleton dir: %s\n", data->skeldir);
+    DEBUG(SSSDBG_TRACE_LIBS, "Skeleton dir: %s\n", data->skeldir);
 
     ret = EOK;
 done:
@@ -505,13 +506,14 @@ int userdel(TALLOC_CTX *mem_ctx,
 
     user_dn = sysdb_user_dn(mem_ctx, data->domain, data->name);
     if (!user_dn) {
-        DEBUG(1, "Could not construct a user DN\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Could not construct a user DN\n");
         return ENOMEM;
     }
 
     ret = sysdb_delete_entry(sysdb, user_dn, false);
     if (ret) {
-        DEBUG(2, "Removing user failed: %s (%d)\n", strerror(ret), ret);
+        DEBUG(SSSDBG_OP_FAILURE,
+              "Removing user failed: %s (%d)\n", strerror(ret), ret);
     }
 
     flush_nscd_cache(NSCD_DB_PASSWD);
@@ -546,13 +548,14 @@ int groupdel(TALLOC_CTX *mem_ctx,
 
     group_dn = sysdb_group_dn(mem_ctx, data->domain, data->name);
     if (group_dn == NULL) {
-        DEBUG(1, "Could not construct a group DN\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Could not construct a group DN\n");
         return ENOMEM;
     }
 
     ret = sysdb_delete_entry(sysdb, group_dn, false);
     if (ret) {
-        DEBUG(2, "Removing group failed: %s (%d)\n", strerror(ret), ret);
+        DEBUG(SSSDBG_OP_FAILURE,
+              "Removing group failed: %s (%d)\n", strerror(ret), ret);
     }
 
     flush_nscd_cache(NSCD_DB_GROUP);
@@ -578,7 +581,7 @@ int sysdb_getpwnam_sync(TALLOC_CTX *mem_ctx,
 
     switch (res->count) {
     case 0:
-        DEBUG(1, "No result for sysdb_getpwnam call\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "No result for sysdb_getpwnam call\n");
         return ENOENT;
 
     case 1:
@@ -620,7 +623,7 @@ int sysdb_getpwnam_sync(TALLOC_CTX *mem_ctx,
             } else if (strcasecmp(str, "false") == 0) {
                 out->lock = DO_UNLOCK;
             } else { /* Invalid value */
-                DEBUG(2, "Invalid value for %s attribute: %s\n",
+                DEBUG(SSSDBG_OP_FAILURE, "Invalid value for %s attribute: %s\n",
                           SYSDB_DISABLED, str ? str : "NULL");
                 return EIO;
             }
@@ -628,7 +631,8 @@ int sysdb_getpwnam_sync(TALLOC_CTX *mem_ctx,
         break;
 
     default:
-        DEBUG(1, "More than one result for sysdb_getpwnam call\n");
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "More than one result for sysdb_getpwnam call\n");
         return EIO;
     }
 
@@ -650,7 +654,7 @@ int sysdb_getgrnam_sync(TALLOC_CTX *mem_ctx,
 
     switch (res->count) {
     case 0:
-        DEBUG(1, "No result for sysdb_getgrnam call\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "No result for sysdb_getgrnam call\n");
         return ENOENT;
 
     case 1:
@@ -664,7 +668,8 @@ int sysdb_getgrnam_sync(TALLOC_CTX *mem_ctx,
         break;
 
     default:
-        DEBUG(1, "More than one result for sysdb_getgrnam call\n");
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "More than one result for sysdb_getgrnam call\n");
         return EIO;
     }
 
diff --git a/src/tools/sss_useradd.c b/src/tools/sss_useradd.c
index 764c2a42e..cab69e46d 100644
--- a/src/tools/sss_useradd.c
+++ b/src/tools/sss_useradd.c
@@ -69,7 +69,8 @@ int main(int argc, const char **argv)
 
     ret = set_locale();
     if (ret != EOK) {
-        DEBUG(1, "set_locale failed (%d): %s\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "set_locale failed (%d): %s\n", ret, strerror(ret));
         ERROR("Error setting the locale\n");
         ret = EXIT_FAILURE;
         goto fini;
@@ -114,7 +115,8 @@ int main(int argc, const char **argv)
 
     ret = init_sss_tools(&tctx);
     if (ret != EOK) {
-        DEBUG(1, "init_sss_tools failed (%d): %s\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "init_sss_tools failed (%d): %s\n", ret, strerror(ret));
         if (ret == ENOENT) {
             ERROR("Error initializing the tools - no local domain\n");
         } else {
@@ -135,7 +137,8 @@ int main(int argc, const char **argv)
     if (groups) {
         ret = parse_groups(tctx, groups, &tctx->octx->addgroups);
         if (ret != EOK) {
-            DEBUG(1, "Cannot parse groups to add the user to\n");
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Cannot parse groups to add the user to\n");
             ERROR("Internal error while parsing parameters\n");
             ret = EXIT_FAILURE;
             goto fini;
@@ -143,7 +146,8 @@ int main(int argc, const char **argv)
 
         ret = parse_group_name_domain(tctx, tctx->octx->addgroups);
         if (ret != EOK) {
-            DEBUG(1, "Cannot parse FQDN groups to add the user to\n");
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Cannot parse FQDN groups to add the user to\n");
             ERROR("Groups must be in the same domain as user\n");
             ret = EXIT_FAILURE;
             goto fini;
@@ -244,7 +248,8 @@ int main(int argc, const char **argv)
                                 tctx->octx->gid);
         if (ret != EOK) {
             ERROR("Cannot create user's mail spool: %1$s\n", strerror(ret));
-            DEBUG(1, "Cannot create user's mail spool: [%d][%s].\n",
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Cannot create user's mail spool: [%d][%s].\n",
                         ret, strerror(ret));
             ret = EXIT_FAILURE;
             goto fini;
@@ -270,7 +275,7 @@ done:
                 break;
 
             default:
-                DEBUG(1, "sysdb operation failed (%d)[%s]\n",
+                DEBUG(SSSDBG_CRIT_FAILURE, "sysdb operation failed (%d)[%s]\n",
                           tctx->error, strerror(tctx->error));
                 ERROR("Transaction error. Could not add user.\n");
                 break;
diff --git a/src/tools/sss_userdel.c b/src/tools/sss_userdel.c
index c695bf837..e19143604 100644
--- a/src/tools/sss_userdel.c
+++ b/src/tools/sss_userdel.c
@@ -59,7 +59,7 @@ static int is_logged_in(TALLOC_CTX *mem_ctx, uid_t uid)
     ret = get_uid_table(mem_ctx, &uid_table);
     if (ret == ENOSYS) return ret;
     if (ret != EOK) {
-        DEBUG(1, "Cannot initialize hash table.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot initialize hash table.\n");
         return ret;
     }
 
@@ -147,7 +147,8 @@ int main(int argc, const char **argv)
 
     ret = set_locale();
     if (ret != EOK) {
-        DEBUG(1, "set_locale failed (%d): %s\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "set_locale failed (%d): %s\n", ret, strerror(ret));
         ERROR("Error setting the locale\n");
         ret = EXIT_FAILURE;
         goto fini;
@@ -191,7 +192,8 @@ int main(int argc, const char **argv)
 
     ret = init_sss_tools(&tctx);
     if (ret != EOK) {
-        DEBUG(1, "init_sss_tools failed (%d): %s\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "init_sss_tools failed (%d): %s\n", ret, strerror(ret));
         if (ret == ENOENT) {
             ERROR("Error initializing the tools - no local domain\n");
         } else {
@@ -315,7 +317,8 @@ int main(int argc, const char **argv)
 
 done:
     if (ret) {
-        DEBUG(1, "sysdb operation failed (%d)[%s]\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "sysdb operation failed (%d)[%s]\n", ret, strerror(ret));
         switch (ret) {
             case ENOENT:
                 ERROR("No such user in local domain. "
diff --git a/src/tools/sss_usermod.c b/src/tools/sss_usermod.c
index f3c2e1d63..11369b7e6 100644
--- a/src/tools/sss_usermod.c
+++ b/src/tools/sss_usermod.c
@@ -70,7 +70,8 @@ int main(int argc, const char **argv)
 
     ret = set_locale();
     if (ret != EOK) {
-        DEBUG(1, "set_locale failed (%d): %s\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "set_locale failed (%d): %s\n", ret, strerror(ret));
         ERROR("Error setting the locale\n");
         ret = EXIT_FAILURE;
         goto fini;
@@ -123,7 +124,8 @@ int main(int argc, const char **argv)
 
     ret = init_sss_tools(&tctx);
     if (ret != EOK) {
-        DEBUG(1, "init_sss_tools failed (%d): %s\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "init_sss_tools failed (%d): %s\n", ret, strerror(ret));
         if (ret == ENOENT) {
             ERROR("Error initializing the tools - no local domain\n");
         } else {
@@ -158,7 +160,8 @@ int main(int argc, const char **argv)
     if (addgroups) {
         ret = parse_groups(tctx, addgroups, &tctx->octx->addgroups);
         if (ret != EOK) {
-            DEBUG(1, "Cannot parse groups to add the user to\n");
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Cannot parse groups to add the user to\n");
             ERROR("Internal error while parsing parameters\n");
             ret = EXIT_FAILURE;
             goto fini;
@@ -166,7 +169,8 @@ int main(int argc, const char **argv)
 
         ret = parse_group_name_domain(tctx, tctx->octx->addgroups);
         if (ret != EOK) {
-            DEBUG(1, "Cannot parse FQDN groups to add the user to\n");
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Cannot parse FQDN groups to add the user to\n");
             ERROR("Groups must be in the same domain as user\n");
             ret = EXIT_FAILURE;
             goto fini;
@@ -185,7 +189,8 @@ int main(int argc, const char **argv)
     if (rmgroups) {
         ret = parse_groups(tctx, rmgroups, &tctx->octx->rmgroups);
         if (ret != EOK) {
-            DEBUG(1, "Cannot parse groups to remove the user from\n");
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Cannot parse groups to remove the user from\n");
             ERROR("Internal error while parsing parameters\n");
             ret = EXIT_FAILURE;
             goto fini;
@@ -193,7 +198,8 @@ int main(int argc, const char **argv)
 
         ret = parse_group_name_domain(tctx, tctx->octx->rmgroups);
         if (ret != EOK) {
-            DEBUG(1, "Cannot parse FQDN groups to remove the user from\n");
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Cannot parse FQDN groups to remove the user from\n");
             ERROR("Groups must be in the same domain as user\n");
             ret = EXIT_FAILURE;
             goto fini;
diff --git a/src/tools/tools_util.c b/src/tools/tools_util.c
index 42563dad4..68f6588ea 100644
--- a/src/tools/tools_util.c
+++ b/src/tools/tools_util.c
@@ -49,14 +49,16 @@ static int setup_db(struct tools_ctx *ctx)
     /* Connect to the conf db */
     ret = confdb_init(ctx, &ctx->confdb, confdb_path);
     if (ret != EOK) {
-        DEBUG(1, "Could not initialize connection to the confdb\n");
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Could not initialize connection to the confdb\n");
         return ret;
     }
 
     ret = sssd_domain_init(ctx, ctx->confdb, "local", DB_PATH, &ctx->local);
     if (ret != EOK) {
         SYSDB_VERSION_ERROR(ret);
-        DEBUG(1, "Could not initialize connection to the sysdb\n");
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Could not initialize connection to the sysdb\n");
         return ret;
     }
     ctx->sysdb = ctx->local->sysdb;
@@ -144,7 +146,8 @@ int parse_group_name_domain(struct tools_ctx *tctx,
     for (i = 0; groups[i]; ++i) {
         ret = sss_parse_name(tctx, tctx->snctx, groups[i], &domain, &name);
         if (ret != EOK) {
-            DEBUG(1, "Invalid name in group list, skipping: [%s] (%d)\n",
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Invalid name in group list, skipping: [%s] (%d)\n",
                        groups[i], ret);
             continue;
         }
@@ -180,16 +183,17 @@ int parse_name_domain(struct tools_ctx *tctx,
 
     ret = sss_parse_name(tctx, tctx->snctx, fullname, &domain, &tctx->octx->name);
     if (ret != EOK) {
-        DEBUG(0, "Cannot parse full name\n");
+        DEBUG(SSSDBG_FATAL_FAILURE, "Cannot parse full name\n");
         return ret;
     }
-    DEBUG(5, "Parsed username: %s\n", tctx->octx->name);
+    DEBUG(SSSDBG_FUNC_DATA, "Parsed username: %s\n", tctx->octx->name);
 
     if (domain) {
-        DEBUG(5, "Parsed domain: %s\n", domain);
+        DEBUG(SSSDBG_FUNC_DATA, "Parsed domain: %s\n", domain);
         /* only the local domain, whatever named is allowed in tools */
         if (strcasecmp(domain, tctx->local->name) != 0) {
-            DEBUG(1, "Invalid domain %s specified in FQDN\n", domain);
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Invalid domain %s specified in FQDN\n", domain);
             return EINVAL;
         }
     } else {
@@ -226,7 +230,8 @@ int check_group_names(struct tools_ctx *tctx,
                                   grouplist[i],
                                   groupinfo);
         if (ret) {
-            DEBUG(6, "Cannot find group %s, ret: %d\n", grouplist[i], ret);
+            DEBUG(SSSDBG_TRACE_FUNC,
+                  "Cannot find group %s, ret: %d\n", grouplist[i], ret);
             break;
         }
     }
@@ -279,26 +284,28 @@ int init_sss_tools(struct tools_ctx **_tctx)
 
     tctx = talloc_zero(NULL, struct tools_ctx);
     if (tctx == NULL) {
-        DEBUG(1, "Could not allocate memory for tools context\n");
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Could not allocate memory for tools context\n");
         return ENOMEM;
     }
 
     /* Connect to the database */
     ret = setup_db(tctx);
     if (ret != EOK) {
-        DEBUG(1, "Could not set up database\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Could not set up database\n");
         goto fini;
     }
 
     ret = sss_names_init(tctx, tctx->confdb, tctx->local->name, &tctx->snctx);
     if (ret != EOK) {
-        DEBUG(1, "Could not set up parsing\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Could not set up parsing\n");
         goto fini;
     }
 
     tctx->octx = talloc_zero(tctx, struct ops_ctx);
     if (!tctx->octx) {
-        DEBUG(1, "Could not allocate memory for data context\n");
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Could not allocate memory for data context\n");
         ERROR("Out of memory\n");
         ret = ENOMEM;
         goto fini;
@@ -327,7 +334,8 @@ static int is_owner(uid_t uid, const char *path)
     ret = stat(path, &statres);
     if (ret != 0) {
         ret = errno;
-        DEBUG(1, "Cannot stat %s: [%d][%s]\n", path, ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Cannot stat %s: [%d][%s]\n", path, ret, strerror(ret));
         return ret;
     }
 
@@ -372,7 +380,8 @@ static int remove_mail_spool(TALLOC_CTX *mem_ctx,
     ret = unlink(spool_file);
     if (ret != 0) {
         ret = errno;
-        DEBUG(1, "Cannot remove() the spool file %s: [%d][%s]\n",
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Cannot remove() the spool file %s: [%d][%s]\n",
                    spool_file, ret, strerror(ret));
         goto fail;
     }
@@ -392,19 +401,20 @@ int remove_homedir(TALLOC_CTX *mem_ctx,
 
     ret = remove_mail_spool(mem_ctx, maildir, username, uid, force);
     if (ret != EOK) {
-        DEBUG(1, "Cannot remove user's mail spool\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot remove user's mail spool\n");
         /* Should this be fatal? I don't think so. Maybe convert to ERROR? */
     }
 
     if (force == false && is_owner(uid, homedir) == -1) {
-        DEBUG(1, "Not removing home dir - not owned by user\n");
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Not removing home dir - not owned by user\n");
         return EPERM;
     }
 
     /* Remove the tree */
     ret = remove_tree(homedir);
     if (ret != EOK) {
-        DEBUG(1, "Cannot remove homedir %s: %d\n",
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot remove homedir %s: %d\n",
                   homedir, ret);
         return ret;
     }
@@ -436,7 +446,7 @@ int create_mail_spool(TALLOC_CTX *mem_ctx,
     fd = open(spool_file, O_CREAT | O_WRONLY | O_EXCL, 0);
     if (fd < 0) {
         ret = errno;
-        DEBUG(1, "Cannot open() the spool file: [%d][%s]\n",
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot open() the spool file: [%d][%s]\n",
                   ret, strerror(ret));
         goto fail;
     }
@@ -444,7 +454,7 @@ int create_mail_spool(TALLOC_CTX *mem_ctx,
     ret = fchmod(fd, 0600);
     if (ret != 0) {
         ret = errno;
-        DEBUG(1, "Cannot fchmod() the spool file: [%d][%s]\n",
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot fchmod() the spool file: [%d][%s]\n",
                   ret, strerror(ret));
         goto fail;
     }
@@ -452,7 +462,7 @@ int create_mail_spool(TALLOC_CTX *mem_ctx,
     ret = fchown(fd, uid, gid);
     if (ret != 0) {
         ret = errno;
-        DEBUG(1, "Cannot fchown() the spool file: [%d][%s]\n",
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot fchown() the spool file: [%d][%s]\n",
                   ret, strerror(ret));
         goto fail;
     }
@@ -460,7 +470,7 @@ int create_mail_spool(TALLOC_CTX *mem_ctx,
     ret = fsync(fd);
     if (ret != 0) {
         ret = errno;
-        DEBUG(1, "Cannot fsync() the spool file: [%d][%s]\n",
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot fsync() the spool file: [%d][%s]\n",
                   ret, strerror(ret));
     }
 
@@ -469,7 +479,8 @@ fail:
         ret = close(fd);
         if (ret != 0) {
             ret = errno;
-            DEBUG(1, "Cannot close() the spool file: [%d][%s]\n",
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "Cannot close() the spool file: [%d][%s]\n",
                       ret, strerror(ret));
         }
     }
@@ -491,7 +502,8 @@ int create_homedir(const char *skeldir,
 
     ret = copy_tree(skeldir, homedir, 0777 & ~default_umask, uid, gid);
     if (ret != EOK) {
-        DEBUG(1, "Cannot populate user's home directory: [%d][%s].\n",
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Cannot populate user's home directory: [%d][%s].\n",
                   ret, strerror(ret));
         goto done;
     }
@@ -542,22 +554,25 @@ int run_userdel_cmd(struct tools_ctx *tctx)
             if (WIFEXITED(status)) {
                 ret = WEXITSTATUS(status);
                 if (ret != 0) {
-                    DEBUG(5, "command [%s] returned nonzero status %d.\n",
+                    DEBUG(SSSDBG_FUNC_DATA,
+                          "command [%s] returned nonzero status %d.\n",
                               userdel_cmd, ret);
                     ret = EOK;  /* Ignore return code of the command */
                     goto done;
                 }
             } else if (WIFSIGNALED(status)) {
-                DEBUG(5, "command [%s] was terminated by signal %d.\n",
+                DEBUG(SSSDBG_FUNC_DATA,
+                      "command [%s] was terminated by signal %d.\n",
                           userdel_cmd, WTERMSIG(status));
                 ret = EIO;
                 goto done;
             } else if (WIFSTOPPED(status)) {
-                DEBUG(5, "command [%s] was stopped by signal %d.\n",
+                DEBUG(SSSDBG_FUNC_DATA,
+                      "command [%s] was stopped by signal %d.\n",
                           userdel_cmd, WSTOPSIG(status));
                 continue;
             } else {
-                DEBUG(1, "Unknown status from WAITPID\n");
+                DEBUG(SSSDBG_CRIT_FAILURE, "Unknown status from WAITPID\n");
                 ret = EIO;
                 goto done;
             }
diff --git a/src/tools/tools_util.h b/src/tools/tools_util.h
index c0a1fa290..87fe752ea 100644
--- a/src/tools/tools_util.h
+++ b/src/tools/tools_util.h
@@ -39,7 +39,7 @@
 #define CHECK_ROOT(val, prg_name) do { \
     val = getuid(); \
     if (val != 0) { \
-        DEBUG(1, "Running under %d, must be root\n", val); \
+        DEBUG(SSSDBG_CRIT_FAILURE, "Running under %d, must be root\n", val); \
         ERROR("%1$s must be run as root\n", prg_name); \
         val = EXIT_FAILURE; \
         goto fini; \