Update DEBUG* invocations to use new levels

Use a script to update DEBUG* macro invocations, which use literal
numbers for levels, to use bitmask macros instead:

grep -rl --include '*.[hc]' DEBUG . |
    while read f; do
        mv "$f"{,.orig}
        perl -e 'use strict;
                 use File::Slurp;
                 my @map=qw"
                    SSSDBG_FATAL_FAILURE
                    SSSDBG_CRIT_FAILURE
                    SSSDBG_OP_FAILURE
                    SSSDBG_MINOR_FAILURE
                    SSSDBG_CONF_SETTINGS
                    SSSDBG_FUNC_DATA
                    SSSDBG_TRACE_FUNC
                    SSSDBG_TRACE_LIBS
                    SSSDBG_TRACE_INTERNAL
                    SSSDBG_TRACE_ALL
                 ";
                 my $text=read_file(\*STDIN);
                 my $repl;
                 $text=~s/
                            ^
                            (
                                .*
                                \b
                                (DEBUG|DEBUG_PAM_DATA|DEBUG_GR_MEM)
                                \s*
                                \(\s*
                            )(
                                [0-9]
                            )(
                                \s*,
                            )
                            (
                                \s*
                            )
                            (
                                .*
                            )
                            $
                         /
                            $repl = $1.$map[$3].$4.$5.$6,
                            length($repl) <= 80
                                ? $repl
                                : $1.$map[$3].$4."\n".(" " x length($1)).$6
                         /xmge;
                 print $text;
        ' < "$f.orig" > "$f"
        rm "$f.orig"
    done

Reviewed-by: Jakub Hrozek <jhrozek@redhat.com>
Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>
Reviewed-by: Simo Sorce <simo@redhat.com>

13 files changed, 209 insertions, 148 deletions

diff --git a/src/util/check_and_open.c b/src/util/check_and_open.c
index 50eee6b2c..7bf7805dd 100644
--- a/src/util/check_and_open.c
+++ b/src/util/check_and_open.c
@@ -74,7 +74,8 @@ errno_t check_fd(int fd, const int uid, const int gid,
 
     ret = fstat(fd, stat_buf);
     if (ret == -1) {
-        DEBUG(1, "fstat for [%d] failed: [%d][%s].\n", fd, errno,
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "fstat for [%d] failed: [%d][%s].\n", fd, errno,
                                                         strerror(errno));
         return errno;
     }
@@ -114,28 +115,29 @@ static errno_t perform_checks(struct stat *stat_buf,
             type_check = S_ISSOCK(stat_buf->st_mode);
             break;
         default:
-            DEBUG(1, "Unsupported file type.\n");
+            DEBUG(SSSDBG_CRIT_FAILURE, "Unsupported file type.\n");
             return EINVAL;
     }
 
     if (!type_check) {
-        DEBUG(1, "File is not the right type.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "File is not the right type.\n");
         return EINVAL;
     }
 
     if (mode >= 0 && (stat_buf->st_mode & ~S_IFMT) != mode) {
-        DEBUG(1, "File has the wrong mode [%.7o], expected [%.7o].\n",
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "File has the wrong mode [%.7o], expected [%.7o].\n",
                   (stat_buf->st_mode & ~S_IFMT), mode);
         return EINVAL;
     }
 
     if (uid >= 0 && stat_buf->st_uid != uid) {
-        DEBUG(1, "File must be owned by uid [%d].\n", uid);
+        DEBUG(SSSDBG_CRIT_FAILURE, "File must be owned by uid [%d].\n", uid);
         return EINVAL;
     }
 
     if (gid >= 0 && stat_buf->st_gid != gid) {
-        DEBUG(1, "File must be owned by gid [%d].\n", gid);
+        DEBUG(SSSDBG_CRIT_FAILURE, "File must be owned by gid [%d].\n", gid);
         return EINVAL;
     }
 
@@ -151,7 +153,8 @@ errno_t check_and_open_readonly(const char *filename, int *fd, const uid_t uid,
 
     *fd = open(filename, O_RDONLY);
     if (*fd == -1) {
-        DEBUG(1, "open [%s] failed: [%d][%s].\n", filename, errno,
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "open [%s] failed: [%d][%s].\n", filename, errno,
                   strerror(errno));
         return errno;
     }
@@ -160,7 +163,7 @@ errno_t check_and_open_readonly(const char *filename, int *fd, const uid_t uid,
     if (ret != EOK) {
         close(*fd);
         *fd = -1;
-        DEBUG(1, "check_fd failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "check_fd failed.\n");
         return ret;
     }
 
diff --git a/src/util/child_common.c b/src/util/child_common.c
index 285eadbcf..08aac1143 100644
--- a/src/util/child_common.c
+++ b/src/util/child_common.c
@@ -56,7 +56,8 @@ errno_t sss_sigchld_init(TALLOC_CTX *mem_ctx,
 
     sigchld_ctx = talloc_zero(mem_ctx, struct sss_sigchild_ctx);
     if (!sigchld_ctx) {
-        DEBUG(0, "fatal error initializing sss_sigchild_ctx\n");
+        DEBUG(SSSDBG_FATAL_FAILURE,
+              "fatal error initializing sss_sigchild_ctx\n");
         return ENOMEM;
     }
     sigchld_ctx->ev = ev;
@@ -267,7 +268,8 @@ int child_handler_setup(struct tevent_context *ev, int pid,
 {
     struct sss_child_ctx_old *child_ctx;
 
-    DEBUG(8, "Setting up signal handler up for pid [%d]\n", pid);
+    DEBUG(SSSDBG_TRACE_INTERNAL,
+          "Setting up signal handler up for pid [%d]\n", pid);
 
     child_ctx = talloc_zero(ev, struct sss_child_ctx_old);
     if (child_ctx == NULL) {
@@ -286,7 +288,7 @@ int child_handler_setup(struct tevent_context *ev, int pid,
     child_ctx->cb = cb;
     child_ctx->pvt = pvt;
 
-    DEBUG(8, "Signal handler set up for pid [%d]\n", pid);
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Signal handler set up for pid [%d]\n", pid);
 
     if (_child_ctx != NULL) {
         *_child_ctx = child_ctx;
@@ -343,7 +345,7 @@ struct tevent_req *write_pipe_send(TALLOC_CTX *mem_ctx,
     fde = tevent_add_fd(ev, state, fd, TEVENT_FD_WRITE,
                         write_pipe_handler, req);
     if (fde == NULL) {
-        DEBUG(1, "tevent_add_fd failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "tevent_add_fd failed.\n");
         goto fail;
     }
 
@@ -427,7 +429,7 @@ struct tevent_req *read_pipe_send(TALLOC_CTX *mem_ctx,
     fde = tevent_add_fd(ev, state, fd, TEVENT_FD_READ,
                         read_pipe_handler, req);
     if (fde == NULL) {
-        DEBUG(1, "tevent_add_fd failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "tevent_add_fd failed.\n");
         goto fail;
     }
 
@@ -450,7 +452,7 @@ static void read_pipe_handler(struct tevent_context *ev,
     uint8_t buf[CHILD_MSG_CHUNK];
 
     if (flags & TEVENT_FD_WRITE) {
-        DEBUG(1, "read_pipe_done called with TEVENT_FD_WRITE,"
+        DEBUG(SSSDBG_CRIT_FAILURE, "read_pipe_done called with TEVENT_FD_WRITE,"
                   " this should not happen.\n");
         tevent_req_error(req, EINVAL);
         return;
@@ -479,7 +481,7 @@ static void read_pipe_handler(struct tevent_context *ev,
         return;
 
     } else if (size == 0) {
-        DEBUG(6, "EOF received, client finished\n");
+        DEBUG(SSSDBG_TRACE_FUNC, "EOF received, client finished\n");
         tevent_req_done(req);
         return;
 
@@ -514,13 +516,15 @@ void fd_nonblocking(int fd)
     flags = fcntl(fd, F_GETFL, 0);
     if (flags == -1) {
         ret = errno;
-        DEBUG(1, "F_GETFL failed [%d][%s].\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "F_GETFL failed [%d][%s].\n", ret, strerror(ret));
         return;
     }
 
     if (fcntl(fd, F_SETFL, flags | O_NONBLOCK) == -1) {
         ret = errno;
-        DEBUG(1, "F_SETFL failed [%d][%s].\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "F_SETFL failed [%d][%s].\n", ret, strerror(ret));
     }
 
     return;
@@ -538,39 +542,47 @@ void child_sig_handler(struct tevent_context *ev,
     struct tevent_immediate *imm;
 
     if (count <= 0) {
-        DEBUG(0, "SIGCHLD handler called with invalid child count\n");
+        DEBUG(SSSDBG_FATAL_FAILURE,
+              "SIGCHLD handler called with invalid child count\n");
         return;
     }
 
     child_ctx = talloc_get_type(pvt, struct sss_child_ctx_old);
-    DEBUG(7, "Waiting for child [%d].\n", child_ctx->pid);
+    DEBUG(SSSDBG_TRACE_LIBS, "Waiting for child [%d].\n", child_ctx->pid);
 
     errno = 0;
     ret = waitpid(child_ctx->pid, &child_ctx->child_status, WNOHANG);
 
     if (ret == -1) {
         err = errno;
-        DEBUG(1, "waitpid failed [%d][%s].\n", err, strerror(err));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "waitpid failed [%d][%s].\n", err, strerror(err));
     } else if (ret == 0) {
-        DEBUG(1, "waitpid did not found a child with changed status.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "waitpid did not found a child with changed status.\n");
     } else {
         if (WIFEXITED(child_ctx->child_status)) {
             if (WEXITSTATUS(child_ctx->child_status) != 0) {
-                DEBUG(1, "child [%d] failed with status [%d].\n", ret,
+                DEBUG(SSSDBG_CRIT_FAILURE,
+                      "child [%d] failed with status [%d].\n", ret,
                           WEXITSTATUS(child_ctx->child_status));
             } else {
-                DEBUG(4, "child [%d] finished successfully.\n", ret);
+                DEBUG(SSSDBG_CONF_SETTINGS,
+                      "child [%d] finished successfully.\n", ret);
             }
         } else if (WIFSIGNALED(child_ctx->child_status)) {
-            DEBUG(1, "child [%d] was terminated by signal [%d].\n", ret,
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "child [%d] was terminated by signal [%d].\n", ret,
                       WTERMSIG(child_ctx->child_status));
         } else {
             if (WIFSTOPPED(child_ctx->child_status)) {
-                DEBUG(7, "child [%d] was stopped by signal [%d].\n", ret,
+                DEBUG(SSSDBG_TRACE_LIBS,
+                      "child [%d] was stopped by signal [%d].\n", ret,
                           WSTOPSIG(child_ctx->child_status));
             }
             if (WIFCONTINUED(child_ctx->child_status)) {
-                DEBUG(7, "child [%d] was resumed by delivery of SIGCONT.\n",
+                DEBUG(SSSDBG_TRACE_LIBS,
+                      "child [%d] was resumed by delivery of SIGCONT.\n",
                           ret);
             }
 
@@ -582,7 +594,8 @@ void child_sig_handler(struct tevent_context *ev,
          */
         imm = tevent_create_immediate(child_ctx);
         if (imm == NULL) {
-            DEBUG(0, "Out of memory invoking sig handler callback\n");
+            DEBUG(SSSDBG_FATAL_FAILURE,
+                  "Out of memory invoking sig handler callback\n");
             return;
         }
 
@@ -633,7 +646,7 @@ static errno_t prepare_child_argv(TALLOC_CTX *mem_ctx,
      */
     argv  = talloc_array(mem_ctx, char *, argc);
     if (argv == NULL) {
-        DEBUG(1, "talloc_array failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "talloc_array failed.\n");
         return ENOMEM;
     }
 
@@ -701,7 +714,8 @@ errno_t exec_child(TALLOC_CTX *mem_ctx,
     ret = dup2(pipefd_to_child[0], STDIN_FILENO);
     if (ret == -1) {
         err = errno;
-        DEBUG(1, "dup2 failed [%d][%s].\n", err, strerror(err));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "dup2 failed [%d][%s].\n", err, strerror(err));
         return err;
     }
 
@@ -709,14 +723,15 @@ errno_t exec_child(TALLOC_CTX *mem_ctx,
     ret = dup2(pipefd_from_child[1], STDOUT_FILENO);
     if (ret == -1) {
         err = errno;
-        DEBUG(1, "dup2 failed [%d][%s].\n", err, strerror(err));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "dup2 failed [%d][%s].\n", err, strerror(err));
         return err;
     }
 
     ret = prepare_child_argv(mem_ctx, debug_fd,
                              binary, &argv);
     if (ret != EOK) {
-        DEBUG(1, "prepare_child_argv.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "prepare_child_argv.\n");
         return ret;
     }
 
@@ -734,14 +749,16 @@ void child_cleanup(int readfd, int writefd)
         ret = close(readfd);
         if (ret != EOK) {
             ret = errno;
-            DEBUG(1, "close failed [%d][%s].\n", ret, strerror(ret));
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "close failed [%d][%s].\n", ret, strerror(ret));
         }
     }
     if (writefd != -1) {
         ret = close(writefd);
         if (ret != EOK) {
             ret = errno;
-            DEBUG(1, "close failed [%d][%s].\n", ret, strerror(ret));
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "close failed [%d][%s].\n", ret, strerror(ret));
         }
     }
 }
diff --git a/src/util/crypto/nss/nss_obfuscate.c b/src/util/crypto/nss/nss_obfuscate.c
index ebe87be4c..fc052ec97 100644
--- a/src/util/crypto/nss/nss_obfuscate.c
+++ b/src/util/crypto/nss/nss_obfuscate.c
@@ -77,7 +77,7 @@ static struct crypto_mech_data cmdata[] = {
 static struct crypto_mech_data *get_crypto_mech_data(enum obfmethod meth)
 {
     if (meth >= NUM_OBFMETHODS) {
-        DEBUG(1, "Unsupported cipher type\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Unsupported cipher type\n");
         return NULL;
     }
     return &cmdata[meth];
@@ -97,7 +97,7 @@ static int generate_random_key(TALLOC_CTX *mem_ctx,
     randkey = PK11_KeyGen(slot, mech_props->cipher,
                           NULL, mech_props->keylen, NULL);
     if (randkey == NULL) {
-        DEBUG(1, "Failure to generate key (err %d)\n",
+        DEBUG(SSSDBG_CRIT_FAILURE, "Failure to generate key (err %d)\n",
                   PR_GetError());
         ret = EIO;
         goto done;
@@ -105,7 +105,7 @@ static int generate_random_key(TALLOC_CTX *mem_ctx,
 
     sret = PK11_ExtractKeyValue(randkey);
     if (sret != SECSuccess) {
-        DEBUG(1, "Failure to extract key value (err %d)\n",
+        DEBUG(SSSDBG_CRIT_FAILURE, "Failure to extract key value (err %d)\n",
                   PR_GetError());
         ret = EIO;
         goto done;
@@ -113,7 +113,7 @@ static int generate_random_key(TALLOC_CTX *mem_ctx,
 
     randkeydata = PK11_GetKeyData(randkey);
     if (randkeydata == NULL) {
-        DEBUG(1, "Failure to get key data (err %d)\n",
+        DEBUG(SSSDBG_CRIT_FAILURE, "Failure to get key data (err %d)\n",
                   PR_GetError());
         ret = EIO;
         goto done;
@@ -168,7 +168,7 @@ static int nss_ctx_init(TALLOC_CTX *mem_ctx,
 
     cctx->slot = PK11_GetBestSlot(mech_props->cipher, NULL);
     if (cctx->slot == NULL) {
-        DEBUG(1, "Unable to find security device (err %d)\n",
+        DEBUG(SSSDBG_CRIT_FAILURE, "Unable to find security device (err %d)\n",
                   PR_GetError());
         ret = EIO;
         goto done;
@@ -194,7 +194,7 @@ static int nss_encrypt_decrypt_init(struct crypto_mech_data *mech_props,
     cctx->keyobj = PK11_ImportSymKey(cctx->slot, mech_props->cipher,
                                      PK11_OriginUnwrap, op, cctx->key, NULL);
     if (cctx->keyobj == NULL) {
-        DEBUG(1, "Failure to import key into NSS (err %d)\n",
+        DEBUG(SSSDBG_CRIT_FAILURE, "Failure to import key into NSS (err %d)\n",
                   PR_GetError());
         ret = EIO;
         goto done;
@@ -203,7 +203,7 @@ static int nss_encrypt_decrypt_init(struct crypto_mech_data *mech_props,
     /* turn the raw IV into a initialization vector object */
     cctx->sparam = PK11_ParamFromIV(mech_props->cipher, cctx->iv);
     if (cctx->sparam == NULL) {
-        DEBUG(1, "Failure to set up PKCS11 param (err %d)\n",
+        DEBUG(SSSDBG_CRIT_FAILURE, "Failure to set up PKCS11 param (err %d)\n",
                   PR_GetError());
         ret = EIO;
         goto done;
@@ -213,7 +213,7 @@ static int nss_encrypt_decrypt_init(struct crypto_mech_data *mech_props,
     cctx->ectx = PK11_CreateContextBySymKey(mech_props->cipher, op,
                                             cctx->keyobj, cctx->sparam);
     if (cctx->ectx == NULL) {
-        DEBUG(1, "Cannot create cipher context (err %d)\n",
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot create cipher context (err %d)\n",
                   PORT_GetError());
         ret = EIO;
         goto done;
@@ -265,26 +265,28 @@ int sss_password_encrypt(TALLOC_CTX *mem_ctx, const char *password, int plen,
 
     ret = nss_ctx_init(tmp_ctx, mech_props, &cctx);
     if (ret) {
-        DEBUG(1, "Cannot initialize NSS context\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot initialize NSS context\n");
         goto done;
     }
 
     /* generate random encryption and IV key */
     ret = generate_random_key(cctx, cctx->slot, mech_props, &cctx->key);
     if (ret != EOK) {
-        DEBUG(1, "Could not generate encryption key\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Could not generate encryption key\n");
         goto done;
     }
 
     ret = generate_random_key(cctx, cctx->slot, mech_props, &cctx->iv);
     if (ret != EOK) {
-        DEBUG(1, "Could not generate initialization vector\n");
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Could not generate initialization vector\n");
         goto done;
     }
 
     ret = nss_encrypt_decrypt_init(mech_props, true, cctx);
     if (ret) {
-        DEBUG(1, "Cannot initialize NSS context properties\n");
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Cannot initialize NSS context properties\n");
         goto done;
     }
 
@@ -306,7 +308,8 @@ int sss_password_encrypt(TALLOC_CTX *mem_ctx, const char *password, int plen,
     sret = PK11_CipherOp(cctx->ectx, cryptotext, &ctlen, ct_maxsize,
                          plaintext, plen);
     if (sret != SECSuccess) {
-        DEBUG(1, "Cannot execute the encryption operation (err %d)\n",
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Cannot execute the encryption operation (err %d)\n",
                    PR_GetError());
         ret = EIO;
         goto done;
@@ -315,7 +318,8 @@ int sss_password_encrypt(TALLOC_CTX *mem_ctx, const char *password, int plen,
     sret = PK11_DigestFinal(cctx->ectx, cryptotext+ctlen, &digestlen,
                             ct_maxsize-ctlen);
     if (sret != SECSuccess) {
-        DEBUG(1, "Cannot execute the digest operation (err %d)\n",
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Cannot execute the digest operation (err %d)\n",
                     PR_GetError());
         ret = EIO;
         goto done;
@@ -340,9 +344,9 @@ int sss_password_encrypt(TALLOC_CTX *mem_ctx, const char *password, int plen,
         goto done;
     }
 
-    DEBUG(8, "Writing method: %d\n", meth);
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Writing method: %d\n", meth);
     SAFEALIGN_SET_UINT16(&obfbuf[p], meth, &p);
-    DEBUG(8, "Writing bufsize: %d\n", result_len);
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Writing bufsize: %d\n", result_len);
     SAFEALIGN_SET_UINT16(&obfbuf[p], result_len, &p);
     safealign_memcpy(&obfbuf[p], cctx->key->data, mech_props->keylen, &p);
     safealign_memcpy(&obfbuf[p], cctx->iv->data, mech_props->bsize, &p);
@@ -409,9 +413,9 @@ int sss_password_decrypt(TALLOC_CTX *mem_ctx, char *b64encoded,
 
     /* unpack obfuscation buffer */
     SAFEALIGN_COPY_UINT16_CHECK(&meth, obfbuf+p, obflen, &p);
-    DEBUG(8, "Read method: %d\n", meth);
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Read method: %d\n", meth);
     SAFEALIGN_COPY_UINT16_CHECK(&ctsize, obfbuf+p, obflen, &p);
-    DEBUG(8, "Read bufsize: %d\n", ctsize);
+    DEBUG(SSSDBG_TRACE_INTERNAL, "Read bufsize: %d\n", ctsize);
 
     mech_props = get_crypto_mech_data(meth);
     if (mech_props == NULL) {
@@ -424,7 +428,8 @@ int sss_password_decrypt(TALLOC_CTX *mem_ctx, char *b64encoded,
            obfbuf + p + mech_props->keylen + mech_props->bsize + ctsize,
            OBF_BUFFER_SENTINEL_SIZE);
     if (memcmp(sentinel_check, OBF_BUFFER_SENTINEL, OBF_BUFFER_SENTINEL_SIZE) != 0) {
-        DEBUG(0, "Obfuscation buffer seems corrupt, aborting\n");
+        DEBUG(SSSDBG_FATAL_FAILURE,
+              "Obfuscation buffer seems corrupt, aborting\n");
         ret = EFAULT;
         goto done;
     }
@@ -453,7 +458,7 @@ int sss_password_decrypt(TALLOC_CTX *mem_ctx, char *b64encoded,
 
     ret = nss_ctx_init(tmp_ctx, mech_props, &cctx);
     if (ret) {
-        DEBUG(1, "Cannot initialize NSS context\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot initialize NSS context\n");
         goto done;
     }
 
@@ -481,7 +486,8 @@ int sss_password_decrypt(TALLOC_CTX *mem_ctx, char *b64encoded,
     sret = PK11_CipherOp(cctx->ectx, (unsigned char *) pwdbuf, &plainlen, ctsize,
                          cryptotext, ctsize);
     if (sret != SECSuccess) {
-        DEBUG(1, "Cannot execute the encryption operation (err %d)\n",
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Cannot execute the encryption operation (err %d)\n",
                    PR_GetError());
         ret = EIO;
         goto done;
@@ -490,7 +496,8 @@ int sss_password_decrypt(TALLOC_CTX *mem_ctx, char *b64encoded,
     sret = PK11_DigestFinal(cctx->ectx, (unsigned char *) pwdbuf+plainlen, &digestlen,
                             ctsize - plainlen);
     if (sret != SECSuccess) {
-        DEBUG(1, "Cannot execute the encryption operation (err %d)\n",
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Cannot execute the encryption operation (err %d)\n",
                    PR_GetError());
         ret = EIO;
         goto done;
diff --git a/src/util/crypto/nss/nss_util.c b/src/util/crypto/nss/nss_util.c
index e93bf206d..55b81c9b1 100644
--- a/src/util/crypto/nss/nss_util.c
+++ b/src/util/crypto/nss/nss_util.c
@@ -46,7 +46,8 @@ int nspr_nss_init(void)
 
     sret = NSS_NoDB_Init(NULL);
     if (sret != SECSuccess) {
-        DEBUG(1, "Error initializing connection to NSS [%d]\n",
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Error initializing connection to NSS [%d]\n",
                   PR_GetError());
         return EIO;
     }
@@ -64,7 +65,8 @@ int nspr_nss_cleanup(void)
 
     sret = NSS_Shutdown();
     if (sret != SECSuccess) {
-        DEBUG(1, "Error shutting down connection to NSS [%d]\n",
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Error shutting down connection to NSS [%d]\n",
                   PR_GetError());
         return EIO;
     }
diff --git a/src/util/debug.c b/src/util/debug.c
index 278cd87ce..5d6132b88 100644
--- a/src/util/debug.c
+++ b/src/util/debug.c
@@ -50,7 +50,8 @@ errno_t set_debug_file_from_fd(const int fd)
     dummy = fdopen(fd, "a");
     if (dummy == NULL) {
         ret = errno;
-        DEBUG(1, "fdopen failed [%d][%s].\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "fdopen failed [%d][%s].\n", ret, strerror(ret));
         sss_log(SSS_LOG_ERR,
                 "Could not open debug file descriptor [%d]. "
                 "Debug messages will not be written to the file "
diff --git a/src/util/find_uid.c b/src/util/find_uid.c
index 919486a9d..d0f76030d 100644
--- a/src/util/find_uid.c
+++ b/src/util/find_uid.c
@@ -74,10 +74,10 @@ static errno_t get_uid_from_pid(const pid_t pid, uid_t *uid)
 
     ret = snprintf(path, PATHLEN, "/proc/%d/status", pid);
     if (ret < 0) {
-        DEBUG(1, "snprintf failed");
+        DEBUG(SSSDBG_CRIT_FAILURE, "snprintf failed");
         return EINVAL;
     } else if (ret >= PATHLEN) {
-        DEBUG(1, "path too long?!?!\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "path too long?!?!\n");
         return EINVAL;
     }
 
@@ -85,11 +85,13 @@ static errno_t get_uid_from_pid(const pid_t pid, uid_t *uid)
     if (fd == -1) {
         error = errno;
         if (error == ENOENT) {
-            DEBUG(7, "Proc file [%s] is not available anymore, continuing.\n",
+            DEBUG(SSSDBG_TRACE_LIBS,
+                  "Proc file [%s] is not available anymore, continuing.\n",
                       path);
             return EOK;
         }
-        DEBUG(1, "open failed [%d][%s].\n", error, strerror(error));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "open failed [%d][%s].\n", error, strerror(error));
         return error;
     }
 
@@ -97,17 +99,19 @@ static errno_t get_uid_from_pid(const pid_t pid, uid_t *uid)
     if (ret == -1) {
         error = errno;
         if (error == ENOENT) {
-            DEBUG(7, "Proc file [%s] is not available anymore, continuing.\n",
+            DEBUG(SSSDBG_TRACE_LIBS,
+                  "Proc file [%s] is not available anymore, continuing.\n",
                       path);
             error = EOK;
             goto fail_fd;
         }
-        DEBUG(1, "fstat failed [%d][%s].\n", error, strerror(error));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "fstat failed [%d][%s].\n", error, strerror(error));
         goto fail_fd;
     }
 
     if (!S_ISREG(stat_buf.st_mode)) {
-        DEBUG(1, "not a regular file\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "not a regular file\n");
         error = EINVAL;
         goto fail_fd;
     }
@@ -127,7 +131,8 @@ static errno_t get_uid_from_pid(const pid_t pid, uid_t *uid)
     ret = close(fd);
     if (ret == -1) {
         error = errno;
-        DEBUG(1, "close failed [%d][%s].\n", error, strerror(error));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "close failed [%d][%s].\n", error, strerror(error));
     }
 
     p = strstr(buf, "\nUid:\t");
@@ -135,7 +140,7 @@ static errno_t get_uid_from_pid(const pid_t pid, uid_t *uid)
         p += 6;
         e = strchr(p,'\t');
         if (e == NULL) {
-            DEBUG(1, "missing delimiter.\n");
+            DEBUG(SSSDBG_CRIT_FAILURE, "missing delimiter.\n");
             return EINVAL;
         } else {
             *e = '\0';
@@ -143,16 +148,17 @@ static errno_t get_uid_from_pid(const pid_t pid, uid_t *uid)
         num = (uint32_t) strtoint32(p, &endptr, 10);
         error = errno;
         if (error != 0) {
-            DEBUG(1, "strtol failed [%s].\n", strerror(error));
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "strtol failed [%s].\n", strerror(error));
             return error;
         }
         if (*endptr != '\0') {
-            DEBUG(1, "uid contains extra characters\n");
+            DEBUG(SSSDBG_CRIT_FAILURE, "uid contains extra characters\n");
             return EINVAL;
         }
 
     } else {
-        DEBUG(1, "format error\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "format error\n");
         return EINVAL;
     }
 
@@ -180,12 +186,12 @@ static errno_t name_to_pid(const char *name, pid_t *pid)
     }
 
     if (*endptr != '\0') {
-        DEBUG(1, "pid string contains extra characters.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "pid string contains extra characters.\n");
         return EINVAL;
     }
 
     if (num <= 0 || num >= INT_MAX) {
-        DEBUG(1, "pid out of range.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "pid out of range.\n");
         return ERANGE;
     }
 
@@ -214,7 +220,7 @@ static errno_t get_active_uid_linux(hash_table_t *table, uid_t search_uid)
     proc_dir = opendir("/proc");
     if (proc_dir == NULL) {
         ret = errno;
-        DEBUG(1, "Cannot open proc dir.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Cannot open proc dir.\n");
         goto done;
     };
 
@@ -223,13 +229,13 @@ static errno_t get_active_uid_linux(hash_table_t *table, uid_t search_uid)
         if (only_numbers(dirent->d_name) != 0) continue;
         ret = name_to_pid(dirent->d_name, &pid);
         if (ret != EOK) {
-            DEBUG(1, "name_to_pid failed.\n");
+            DEBUG(SSSDBG_CRIT_FAILURE, "name_to_pid failed.\n");
             goto done;
         }
 
         ret = get_uid_from_pid(pid, &uid);
         if (ret != EOK) {
-            DEBUG(1, "get_uid_from_pid failed.\n");
+            DEBUG(SSSDBG_CRIT_FAILURE, "get_uid_from_pid failed.\n");
             goto done;
         }
 
@@ -241,7 +247,8 @@ static errno_t get_active_uid_linux(hash_table_t *table, uid_t search_uid)
 
             ret = hash_enter(table, &key, &value);
             if (ret != HASH_SUCCESS) {
-                DEBUG(1, "cannot add to table [%s]\n", hash_error_string(ret));
+                DEBUG(SSSDBG_CRIT_FAILURE,
+                      "cannot add to table [%s]\n", hash_error_string(ret));
                 ret = ENOMEM;
                 goto done;
             }
@@ -257,14 +264,14 @@ static errno_t get_active_uid_linux(hash_table_t *table, uid_t search_uid)
     }
     if (errno != 0 && dirent == NULL) {
         ret = errno;
-        DEBUG(1, "readdir failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "readdir failed.\n");
         goto done;
     }
 
     ret = closedir(proc_dir);
     proc_dir = NULL;
     if (ret == -1) {
-        DEBUG(1, "closedir failed, watch out.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "closedir failed, watch out.\n");
     }
 
     if (table != NULL) {
@@ -277,7 +284,7 @@ done:
     if (proc_dir != NULL) {
         err = closedir(proc_dir);
         if (err) {
-            DEBUG(1, "closedir failed, bad dirp?\n");
+            DEBUG(SSSDBG_CRIT_FAILURE, "closedir failed, bad dirp?\n");
         }
     }
     return ret;
@@ -292,7 +299,8 @@ errno_t get_uid_table(TALLOC_CTX *mem_ctx, hash_table_t **table)
                          hash_talloc, hash_talloc_free, mem_ctx,
                          NULL, NULL);
     if (ret != HASH_SUCCESS) {
-        DEBUG(1, "hash_create_ex failed [%s]\n", hash_error_string(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "hash_create_ex failed [%s]\n", hash_error_string(ret));
         return ENOMEM;
     }
 
@@ -324,7 +332,7 @@ errno_t check_if_uid_is_active(uid_t uid, bool *result)
 
     ret = get_active_uid_linux(NULL, uid);
     if (ret != EOK && ret != ENOENT) {
-        DEBUG(1, "get_uid_table failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "get_uid_table failed.\n");
         return ret;
     }
 
diff --git a/src/util/nscd.c b/src/util/nscd.c
index e73c3fa6c..29f48ae43 100644
--- a/src/util/nscd.c
+++ b/src/util/nscd.c
@@ -49,7 +49,7 @@ int flush_nscd_cache(enum nscd_db flush_db)
             break;
 
         default:
-            DEBUG(1, "Unknown nscd database\n");
+            DEBUG(SSSDBG_CRIT_FAILURE, "Unknown nscd database\n");
             ret = EINVAL;
             goto done;
     }
@@ -59,10 +59,11 @@ int flush_nscd_cache(enum nscd_db flush_db)
     case 0:
         execl(NSCD_PATH, "nscd", NSCD_RELOAD_ARG, service, NULL);
         /* if this returns it is an error */
-        DEBUG(1, "execl(3) failed: %d(%s)\n", errno, strerror(errno));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "execl(3) failed: %d(%s)\n", errno, strerror(errno));
         exit(errno);
     case -1:
-        DEBUG(1, "fork failed\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "fork failed\n");
         ret = EFAULT;
         break;
     default:
@@ -76,11 +77,13 @@ int flush_nscd_cache(enum nscd_db flush_db)
                 if (ret > 0) {
                     /* The flush fails if nscd is not running, so do not care
                     * about the return code */
-                    DEBUG(8, "Error flushing cache, is nscd running?\n");
+                    DEBUG(SSSDBG_TRACE_INTERNAL,
+                          "Error flushing cache, is nscd running?\n");
                 }
             }
         } else {
-            DEBUG(5, "Failed to wait for children %d\n", nscd_pid);
+            DEBUG(SSSDBG_FUNC_DATA,
+                  "Failed to wait for children %d\n", nscd_pid);
             ret = EIO;
         }
     }
diff --git a/src/util/signal.c b/src/util/signal.c
index 23bdc46b7..bb8f8bef7 100644
--- a/src/util/signal.c
+++ b/src/util/signal.c
@@ -49,7 +49,7 @@ void BlockSignals(bool block, int signum)
 	/* yikes! This platform can't block signals? */
 	static int done;
 	if (!done) {
-		DEBUG(0,"WARNING: No signal blocking available\n");
+		DEBUG(SSSDBG_FATAL_FAILURE,"WARNING: No signal blocking available\n");
 		done=1;
 	}
 #endif
diff --git a/src/util/sss_krb5.c b/src/util/sss_krb5.c
index e2efbc323..7c0c5832c 100644
--- a/src/util/sss_krb5.c
+++ b/src/util/sss_krb5.c
@@ -94,16 +94,17 @@ errno_t select_principal_from_keytab(TALLOC_CTX *mem_ctx,
     const char *realm_patterns[] =   {"%s", "%s",  "%s",      "%s", "%s",
                                       NULL,     NULL};
 
-    DEBUG(5, "trying to select the most appropriate principal from keytab\n");
+    DEBUG(SSSDBG_FUNC_DATA,
+          "trying to select the most appropriate principal from keytab\n");
     tmp_ctx = talloc_new(NULL);
     if (!tmp_ctx) {
-        DEBUG(1, "talloc_new failed\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "talloc_new failed\n");
         return ENOMEM;
     }
 
     kerr = krb5_init_context(&krb_ctx);
     if (kerr) {
-        DEBUG(2, "Failed to init kerberos context\n");
+        DEBUG(SSSDBG_OP_FAILURE, "Failed to init kerberos context\n");
         ret = EFAULT;
         goto done;
     }
@@ -167,7 +168,7 @@ errno_t select_principal_from_keytab(TALLOC_CTX *mem_ctx,
         if (_principal) {
             kerr = krb5_unparse_name(krb_ctx, client_princ, &principal_string);
             if (kerr) {
-                DEBUG(1, "krb5_unparse_name failed");
+                DEBUG(SSSDBG_CRIT_FAILURE, "krb5_unparse_name failed");
                 ret = EFAULT;
                 goto done;
             }
@@ -175,11 +176,11 @@ errno_t select_principal_from_keytab(TALLOC_CTX *mem_ctx,
             *_principal = talloc_strdup(mem_ctx, principal_string);
             free(principal_string);
             if (!*_principal) {
-                DEBUG(1, "talloc_strdup failed");
+                DEBUG(SSSDBG_CRIT_FAILURE, "talloc_strdup failed");
                 ret = ENOMEM;
                 goto done;
             }
-            DEBUG(5, "Selected principal: %s\n", *_principal);
+            DEBUG(SSSDBG_FUNC_DATA, "Selected principal: %s\n", *_principal);
         }
 
         if (_primary) {
@@ -187,7 +188,7 @@ errno_t select_principal_from_keytab(TALLOC_CTX *mem_ctx,
                                                KRB5_PRINCIPAL_UNPARSE_NO_REALM,
                                                &principal_string);
             if (kerr) {
-                DEBUG(1, "krb5_unparse_name failed");
+                DEBUG(SSSDBG_CRIT_FAILURE, "krb5_unparse_name failed");
                 ret = EFAULT;
                 goto done;
             }
@@ -195,12 +196,12 @@ errno_t select_principal_from_keytab(TALLOC_CTX *mem_ctx,
             *_primary = talloc_strdup(mem_ctx, principal_string);
             free(principal_string);
             if (!*_primary) {
-                DEBUG(1, "talloc_strdup failed");
+                DEBUG(SSSDBG_CRIT_FAILURE, "talloc_strdup failed");
                 if (_principal) talloc_zfree(*_principal);
                 ret = ENOMEM;
                 goto done;
             }
-            DEBUG(5, "Selected primary: %s\n", *_primary);
+            DEBUG(SSSDBG_FUNC_DATA, "Selected primary: %s\n", *_primary);
         }
 
         if (_realm) {
@@ -210,18 +211,18 @@ errno_t select_principal_from_keytab(TALLOC_CTX *mem_ctx,
             *_realm = talloc_asprintf(mem_ctx, "%.*s",
                                       realm_len, realm_name);
             if (!*_realm) {
-                DEBUG(1, "talloc_asprintf failed");
+                DEBUG(SSSDBG_CRIT_FAILURE, "talloc_asprintf failed");
                 if (_principal) talloc_zfree(*_principal);
                 if (_primary) talloc_zfree(*_primary);
                 ret = ENOMEM;
                 goto done;
             }
-            DEBUG(5, "Selected realm: %s\n", *_realm);
+            DEBUG(SSSDBG_FUNC_DATA, "Selected realm: %s\n", *_realm);
         }
 
         ret = EOK;
     } else {
-        DEBUG(3, "No suitable principal found in keytab\n");
+        DEBUG(SSSDBG_MINOR_FAILURE, "No suitable principal found in keytab\n");
         ret = ENOENT;
     }
 
@@ -278,7 +279,7 @@ int sss_krb5_verify_keytab_ex(const char *principal, const char *keytab_name,
             /* This should never happen. The API docs for this function
              * specify only success for this function
              */
-            DEBUG(1,"Could not free keytab entry contents\n");
+            DEBUG(SSSDBG_CRIT_FAILURE,"Could not free keytab entry contents\n");
             /* This is non-fatal, so we'll continue here */
         }
 
@@ -289,7 +290,7 @@ int sss_krb5_verify_keytab_ex(const char *principal, const char *keytab_name,
 
     krberr = krb5_kt_end_seq_get(context, keytab, &cursor);
     if (krberr) {
-        DEBUG(0, "Could not close keytab.\n");
+        DEBUG(SSSDBG_FATAL_FAILURE, "Could not close keytab.\n");
         sss_log(SSS_LOG_ERR, "Could not close keytab file [%s].",
                              KEYTAB_CLEAN_NAME);
         return EIO;
@@ -347,7 +348,7 @@ static bool match_principal(krb5_context ctx,
 
     tmp_ctx = talloc_new(NULL);
     if (!tmp_ctx) {
-        DEBUG(1, "talloc_new failed\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "talloc_new failed\n");
         return false;
     }
 
@@ -381,7 +382,8 @@ static bool match_principal(krb5_context ctx,
 
     if (!pattern_realm || (realm_len == strlen(pattern_realm) &&
         strncmp(realm_name, pattern_realm, realm_len) == 0)) {
-        DEBUG(7, "Principal matched to the sample (%s@%s).\n", pattern_primary,
+        DEBUG(SSSDBG_TRACE_LIBS,
+              "Principal matched to the sample (%s@%s).\n", pattern_primary,
                                                                 pattern_realm);
         ret = true;
     }
@@ -408,11 +410,12 @@ krb5_error_code find_principal_in_keytab(krb5_context ctx,
     memset(&cursor, 0, sizeof(cursor));
     kerr = krb5_kt_start_seq_get(ctx, keytab, &cursor);
     if (kerr != 0) {
-        DEBUG(1, "krb5_kt_start_seq_get failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "krb5_kt_start_seq_get failed.\n");
         return kerr;
     }
 
-    DEBUG(9, "Trying to find principal %s@%s in keytab.\n", pattern_primary, pattern_realm);
+    DEBUG(SSSDBG_TRACE_ALL,
+          "Trying to find principal %s@%s in keytab.\n", pattern_primary, pattern_realm);
     memset(&entry, 0, sizeof(entry));
     while ((kt_err = krb5_kt_next_entry(ctx, keytab, &entry, &cursor)) == 0) {
         principal_found = match_principal(ctx, entry.principal, pattern_primary, pattern_realm);
@@ -422,7 +425,7 @@ krb5_error_code find_principal_in_keytab(krb5_context ctx,
 
         kerr = sss_krb5_free_keytab_entry_contents(ctx, &entry);
         if (kerr != 0) {
-            DEBUG(1, "Failed to free keytab entry.\n");
+            DEBUG(SSSDBG_CRIT_FAILURE, "Failed to free keytab entry.\n");
         }
         memset(&entry, 0, sizeof(entry));
     }
@@ -432,7 +435,7 @@ krb5_error_code find_principal_in_keytab(krb5_context ctx,
      * overwritten by other keytab calls, creating a leak. */
     kerr = krb5_kt_end_seq_get(ctx, keytab, &cursor);
     if (kerr != 0) {
-        DEBUG(1, "krb5_kt_end_seq_get failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "krb5_kt_end_seq_get failed.\n");
         goto done;
     }
 
@@ -446,13 +449,13 @@ krb5_error_code find_principal_in_keytab(krb5_context ctx,
 
     /* check if we got any errors from krb5_kt_next_entry */
     if (kt_err != 0 && kt_err != KRB5_KT_END) {
-        DEBUG(1, "Error while reading keytab.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Error while reading keytab.\n");
         goto done;
     }
 
     kerr = krb5_copy_principal(ctx, entry.principal, princ);
     if (kerr != 0) {
-        DEBUG(1, "krb5_copy_principal failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "krb5_copy_principal failed.\n");
         goto done;
     }
 
@@ -461,7 +464,7 @@ krb5_error_code find_principal_in_keytab(krb5_context ctx,
 done:
     kerr_d = sss_krb5_free_keytab_entry_contents(ctx, &entry);
     if (kerr_d != 0) {
-        DEBUG(1, "Failed to free keytab entry.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "Failed to free keytab entry.\n");
     }
 
     return kerr;
@@ -555,7 +558,8 @@ krb5_error_code KRB5_CALLCONV sss_krb5_get_init_creds_opt_set_expire_callback(
 #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_EXPIRE_CALLBACK
     return krb5_get_init_creds_opt_set_expire_callback(context, opt, cb, data);
 #else
-    DEBUG(5, "krb5_get_init_creds_opt_set_expire_callback not available.\n");
+    DEBUG(SSSDBG_FUNC_DATA,
+          "krb5_get_init_creds_opt_set_expire_callback not available.\n");
     return 0;
 #endif
 }
@@ -590,7 +594,8 @@ krb5_error_code KRB5_CALLCONV sss_krb5_get_init_creds_opt_set_fast_ccache_name(
     return krb5_get_init_creds_opt_set_fast_ccache_name(context, opt,
                                                         fast_ccache_name);
 #else
-    DEBUG(5, "krb5_get_init_creds_opt_set_fast_ccache_name not available.\n");
+    DEBUG(SSSDBG_FUNC_DATA,
+          "krb5_get_init_creds_opt_set_fast_ccache_name not available.\n");
     return 0;
 #endif
 }
@@ -603,7 +608,8 @@ krb5_error_code KRB5_CALLCONV sss_krb5_get_init_creds_opt_set_fast_flags(
 #ifdef HAVE_KRB5_GET_INIT_CREDS_OPT_SET_FAST_FLAGS
     return krb5_get_init_creds_opt_set_fast_flags(context, opt, flags);
 #else
-    DEBUG(5, "krb5_get_init_creds_opt_set_fast_flags not available.\n");
+    DEBUG(SSSDBG_FUNC_DATA,
+          "krb5_get_init_creds_opt_set_fast_flags not available.\n");
     return 0;
 #endif
 }
@@ -987,7 +993,7 @@ krb5_error_code sss_extract_pac(krb5_context ctx,
 
     ret = unsetenv("_SSS_LOOPS");
     if (ret != EOK) {
-        DEBUG(1, "Failed to unset _SSS_LOOPS, "
+        DEBUG(SSSDBG_CRIT_FAILURE, "Failed to unset _SSS_LOOPS, "
                   "sss_pac_make_request will most certainly fail.\n");
     }
 
diff --git a/src/util/sss_ldap.c b/src/util/sss_ldap.c
index 7c13f4371..a2101ecde 100644
--- a/src/util/sss_ldap.c
+++ b/src/util/sss_ldap.c
@@ -129,14 +129,14 @@ static struct tevent_req *sdap_async_sys_connect_send(TALLOC_CTX *mem_ctx,
 
     flags = fcntl(fd, F_GETFL, 0);
     if (flags == -1) {
-        DEBUG(1, "fcntl F_GETFL failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "fcntl F_GETFL failed.\n");
         return NULL;
     }
 
     req = tevent_req_create(mem_ctx, &state,
                             struct sdap_async_sys_connect_state);
     if (req == NULL) {
-        DEBUG(1, "tevent_req_create failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "tevent_req_create failed.\n");
         return NULL;
     }
 
@@ -147,7 +147,7 @@ static struct tevent_req *sdap_async_sys_connect_send(TALLOC_CTX *mem_ctx,
 
     ret = fcntl(fd, F_SETFL, flags | O_NONBLOCK);
     if (ret != EOK) {
-        DEBUG(1, "fcntl F_SETFL failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "fcntl F_SETFL failed.\n");
         goto done;
     }
 
@@ -164,7 +164,7 @@ static struct tevent_req *sdap_async_sys_connect_send(TALLOC_CTX *mem_ctx,
                                        TEVENT_FD_READ | TEVENT_FD_WRITE,
                                        sdap_async_sys_connect_done, req);
             if (state->fde == NULL) {
-                DEBUG(1, "tevent_add_fd failed.\n");
+                DEBUG(SSSDBG_CRIT_FAILURE, "tevent_add_fd failed.\n");
                 ret = ENOMEM;
                 goto done;
             }
@@ -173,13 +173,14 @@ static struct tevent_req *sdap_async_sys_connect_send(TALLOC_CTX *mem_ctx,
 
             break;
         default:
-            DEBUG(1, "connect failed [%d][%s].\n", ret, strerror(ret));
+            DEBUG(SSSDBG_CRIT_FAILURE,
+                  "connect failed [%d][%s].\n", ret, strerror(ret));
     }
 
 done:
     fret = fcntl(fd, F_SETFL, flags);
     if (fret != EOK) {
-        DEBUG(1, "fcntl F_SETFL failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "fcntl F_SETFL failed.\n");
     }
 
     if (ret == EOK) {
@@ -210,14 +211,15 @@ static void sdap_async_sys_connect_done(struct tevent_context *ev,
         if (ret == EINPROGRESS || ret == EINTR) {
             return; /* Try again later */
         }
-        DEBUG(1, "connect failed [%d][%s].\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "connect failed [%d][%s].\n", ret, strerror(ret));
     }
 
     talloc_zfree(fde);
 
     fret = fcntl(state->fd, F_SETFL, state->old_flags);
     if (fret != EOK) {
-        DEBUG(1, "fcntl F_SETFL failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "fcntl F_SETFL failed.\n");
     }
 
     if (ret == EOK) {
@@ -245,14 +247,16 @@ static errno_t set_fd_flags_and_opts(int fd)
     flags = fcntl(fd, F_GETFD, 0);
     if (flags == -1) {
         ret = errno;
-        DEBUG(1, "fcntl F_GETFD failed [%d][%s].\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "fcntl F_GETFD failed [%d][%s].\n", ret, strerror(ret));
         return ret;
     }
 
     flags = fcntl(fd, F_SETFD, flags| FD_CLOEXEC);
     if (flags == -1) {
         ret = errno;
-        DEBUG(1, "fcntl F_SETFD failed [%d][%s].\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "fcntl F_SETFD failed [%d][%s].\n", ret, strerror(ret));
         return ret;
     }
 
@@ -261,14 +265,16 @@ static errno_t set_fd_flags_and_opts(int fd)
     ret = setsockopt(fd, SOL_SOCKET, SO_KEEPALIVE, &dummy, sizeof(dummy));
     if (ret != 0) {
         ret = errno;
-        DEBUG(5, "setsockopt SO_KEEPALIVE failed.[%d][%s].\n", ret,
+        DEBUG(SSSDBG_FUNC_DATA,
+              "setsockopt SO_KEEPALIVE failed.[%d][%s].\n", ret,
                   strerror(ret));
     }
 
     ret = setsockopt(fd, SOL_TCP, TCP_NODELAY, &dummy, sizeof(dummy));
     if (ret != 0) {
         ret = errno;
-        DEBUG(5, "setsockopt TCP_NODELAY failed.[%d][%s].\n", ret,
+        DEBUG(SSSDBG_FUNC_DATA,
+              "setsockopt TCP_NODELAY failed.[%d][%s].\n", ret,
                   strerror(ret));
     }
 
@@ -311,7 +317,7 @@ struct tevent_req *sss_ldap_init_send(TALLOC_CTX *mem_ctx,
 
     req = tevent_req_create(mem_ctx, &state, struct sss_ldap_init_state);
     if (req == NULL) {
-        DEBUG(1, "tevent_req_create failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "tevent_req_create failed.\n");
         return NULL;
     }
 
@@ -325,34 +331,37 @@ struct tevent_req *sss_ldap_init_send(TALLOC_CTX *mem_ctx,
     state->sd = socket(addr->ss_family, SOCK_STREAM, 0);
     if (state->sd == -1) {
         ret = errno;
-        DEBUG(1, "socket failed [%d][%s].\n", ret, strerror(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "socket failed [%d][%s].\n", ret, strerror(ret));
         goto fail;
     }
 
     ret = set_fd_flags_and_opts(state->sd);
     if (ret != EOK) {
-        DEBUG(1, "set_fd_flags_and_opts failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "set_fd_flags_and_opts failed.\n");
         goto fail;
     }
 
-    DEBUG(9, "Using file descriptor [%d] for LDAP connection.\n", state->sd);
+    DEBUG(SSSDBG_TRACE_ALL,
+          "Using file descriptor [%d] for LDAP connection.\n", state->sd);
 
     subreq = sdap_async_sys_connect_send(state, ev, state->sd,
                                          (struct sockaddr *) addr, addr_len);
     if (subreq == NULL) {
         ret = ENOMEM;
-        DEBUG(1, "sdap_async_sys_connect_send failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "sdap_async_sys_connect_send failed.\n");
         goto fail;
     }
 
-    DEBUG(6, "Setting %d seconds timeout for connecting\n", timeout);
+    DEBUG(SSSDBG_TRACE_FUNC,
+          "Setting %d seconds timeout for connecting\n", timeout);
     tv = tevent_timeval_current_ofs(timeout, 0);
 
     state->connect_timeout = tevent_add_timer(ev, subreq, tv,
                                               sdap_async_sys_connect_timeout,
                                               subreq);
     if (state->connect_timeout == NULL) {
-        DEBUG(1, "tevent_add_timer failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "tevent_add_timer failed.\n");
         ret = ENOMEM;
         goto fail;
     }
@@ -366,14 +375,15 @@ fail:
     }
     tevent_req_error(req, ret);
 #else
-    DEBUG(3, "ldap_init_fd not available, "
+    DEBUG(SSSDBG_MINOR_FAILURE, "ldap_init_fd not available, "
               "will use ldap_initialize with uri [%s].\n", uri);
     state->sd = -1;
     ret = ldap_initialize(&state->ldap, uri);
     if (ret == LDAP_SUCCESS) {
         tevent_req_done(req);
     } else {
-        DEBUG(1, "ldap_initialize failed [%s].\n", sss_ldap_err2string(ret));
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "ldap_initialize failed [%s].\n", sss_ldap_err2string(ret));
         if (ret == LDAP_SERVER_DOWN) {
             tevent_req_error(req, ETIMEDOUT);
         } else {
@@ -393,7 +403,7 @@ static void sdap_async_sys_connect_timeout(struct tevent_context *ev,
 {
     struct tevent_req *connection_request;
 
-    DEBUG(4, "The LDAP connection timed out\n");
+    DEBUG(SSSDBG_CONF_SETTINGS, "The LDAP connection timed out\n");
 
     connection_request = talloc_get_type(pvt, struct tevent_req);
     tevent_req_error(connection_request, ETIMEDOUT);
@@ -413,7 +423,7 @@ static void sss_ldap_init_sys_connect_done(struct tevent_req *subreq)
     ret = sdap_async_sys_connect_recv(subreq);
     talloc_zfree(subreq);
     if (ret != EOK) {
-        DEBUG(1, "sdap_async_sys_connect request failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "sdap_async_sys_connect request failed.\n");
         goto fail;
     }
     /* Initialize LDAP handler */
@@ -431,9 +441,9 @@ static void sss_ldap_init_sys_connect_done(struct tevent_req *subreq)
         lret = ldap_install_tls(state->ldap);
         if (lret != LDAP_SUCCESS) {
             if (lret == LDAP_LOCAL_ERROR) {
-                DEBUG(5, "TLS/SSL already in place.\n");
+                DEBUG(SSSDBG_FUNC_DATA, "TLS/SSL already in place.\n");
             } else {
-                DEBUG(1, "ldap_install_tls failed: %s\n",
+                DEBUG(SSSDBG_CRIT_FAILURE, "ldap_install_tls failed: %s\n",
                           sss_ldap_err2string(lret));
                 ret = EIO;
                 goto fail;
diff --git a/src/util/user_info_msg.c b/src/util/user_info_msg.c
index 89d7456e5..1399544c5 100644
--- a/src/util/user_info_msg.c
+++ b/src/util/user_info_msg.c
@@ -40,7 +40,7 @@ errno_t pack_user_info_chpass_error(TALLOC_CTX *mem_ctx,
     *resp_len = 2 * sizeof(uint32_t) + err_len;
     resp = talloc_size(mem_ctx, *resp_len);
     if (resp == NULL) {
-        DEBUG(1, "talloc_size failed.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE, "talloc_size failed.\n");
         return ENOMEM;
     }
 
@@ -49,7 +49,7 @@ errno_t pack_user_info_chpass_error(TALLOC_CTX *mem_ctx,
     SAFEALIGN_SET_UINT32(&resp[p], err_len, &p);
     safealign_memcpy(&resp[p], user_error_message, err_len, &p);
     if (p != *resp_len) {
-        DEBUG(0, "Size mismatch\n");
+        DEBUG(SSSDBG_FATAL_FAILURE, "Size mismatch\n");
     }
 
     *_resp = resp;
diff --git a/src/util/usertools.c b/src/util/usertools.c
index b7f7593e1..51927393d 100644
--- a/src/util/usertools.c
+++ b/src/util/usertools.c
@@ -197,7 +197,8 @@ int sss_names_init_from_args(TALLOC_CTX *mem_ctx, const char *re_pattern,
                             NAME_DOMAIN_PATTERN_OPTIONS,
                             &errval, &errstr, &errpos, NULL);
     if (!ctx->re) {
-        DEBUG(1, "Invalid Regular Expression pattern at position %d."
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Invalid Regular Expression pattern at position %d."
                   " (Error: %d [%s])\n", errpos, errval, errstr);
         ret = EFAULT;
         goto done;
@@ -265,9 +266,11 @@ int sss_names_init(TALLOC_CTX *mem_ctx, struct confdb_ctx *cdb,
         }
 #ifdef HAVE_LIBPCRE_LESSER_THAN_7
     } else {
-        DEBUG(2, "This binary was build with a version of libpcre that does "
+        DEBUG(SSSDBG_OP_FAILURE,
+              "This binary was build with a version of libpcre that does "
                   "not support non-unique named subpatterns.\n");
-        DEBUG(2, "Please make sure that your pattern [%s] only contains "
+        DEBUG(SSSDBG_OP_FAILURE,
+              "Please make sure that your pattern [%s] only contains "
                   "subpatterns with a unique name and uses "
                   "the Python syntax (?P<name>).\n", re_pattern);
 #endif
@@ -322,7 +325,8 @@ int sss_parse_name(TALLOC_CTX *memctx,
     }
 
     if (ret == 0) {
-        DEBUG(1, "Too many matches, the pattern is invalid.\n");
+        DEBUG(SSSDBG_CRIT_FAILURE,
+              "Too many matches, the pattern is invalid.\n");
     }
 
     strnum = ret;
@@ -331,7 +335,7 @@ int sss_parse_name(TALLOC_CTX *memctx,
         result = NULL;
         ret = pcre_get_named_substring(re, orig, ovec, strnum, "name", &result);
         if (ret < 0  || !result) {
-            DEBUG(2, "Name not found!\n");
+            DEBUG(SSSDBG_OP_FAILURE, "Name not found!\n");
             return EINVAL;
         }
         *_name = talloc_strdup(memctx, result);
@@ -344,7 +348,7 @@ int sss_parse_name(TALLOC_CTX *memctx,
         ret = pcre_get_named_substring(re, orig, ovec, strnum, "domain",
                                        &result);
         if (ret < 0  || !result) {
-            DEBUG(4, "Domain not provided!\n");
+            DEBUG(SSSDBG_CONF_SETTINGS, "Domain not provided!\n");
             *_domain = NULL;
         } else {
             /* ignore "" string */
diff --git a/src/util/util.c b/src/util/util.c
index f6f8e19c6..81ff3df92 100644
--- a/src/util/util.c
+++ b/src/util/util.c
@@ -509,7 +509,7 @@ errno_t sss_hash_create_ex(TALLOC_CTX *mem_ctx,
         ret = EIO;
     }
 
-    DEBUG(0, "Could not create hash table: [%d][%s]\n",
+    DEBUG(SSSDBG_FATAL_FAILURE, "Could not create hash table: [%d][%s]\n",
               hret, hash_error_string(hret));
 
     talloc_free(internal_ctx);