Symantec Access Management

 View Only
  • 1.  Manual Syncing of 4 CA Directories as User Stores

    Posted Sep 16, 2020 06:17 AM
    Hi Community,

    We've 4 DSAs 2 each in 2 different data centres.
    DSA1 DSA2(Data centre1)
    DSA3 DSA4(Data centre2)

    In our case DSA3 n DSA4 are bad dsas so we need to sync them with DSA1 n DSA2 which are good dsas.
    So we want to copy the .db file of DSA2 on both bad DSAs
    While researching for this we have found below below article and a CA Directory replication document 

    Doc1:
    CA Directory DSA out of sync
    Broadcom remove preview
    CA Directory DSA out of sync
    In this document we will describe how to manually sync CA Dir DSAs, we have two DSAs, one working fine and other out of sync.
    View this on Broadcom >

    Doc2:
    CA Directory r12 Data Replication and Recovery Best Practice | Manualzz

    manualzz.com remove preview
    CA Directory r12 Data Replication and Recovery Best Practice | Manualzz
    CA Directory r12 SP1 Data Replication & Recovery Best Practice This document provides specific advice on how to configure CA Directory r12 SP1 for replication between peer data DSAs to provide High-Availability and 24x7 service. CA Directory provides three data replication methods, multiwrite, DISP and multiwriteDISP.
    View this on manualzz.com >


    Though both docs are authentic but they have contradciting statements. Doc1 mentions that we need to run dxdisp of good dsa on all the dsas, where as Doc2 says that we need to run dxdisp of bad dsa on all the DSAs. 
    Please let us know about the correct steps.

    Also, though .dp files on all the dsas is getting updated daily with the latest update timestamp, but there's some data on good  dsas which is not getting synced. So , can there be  a specific reason for it 

    Please be informed that we had tried the steps mentioned in Doc2 on lower environment and were able to see that in warn logs of CA Directory it says "DataStore created for DSA2(of which we copied the .zdb file on bad dsas)".  if possible please let us know the reasons for that too.



  • 2.  RE: Manual Syncing of 4 CA Directories as User Stores

    Broadcom Employee
    Posted Sep 17, 2020 08:39 AM
    Q) Though both docs are authentic but they have contradciting statements. Doc1 mentions that we need to run dxdisp of good dsa on all the dsas, where as Doc2 says that we need to run dxdisp of bad dsa on all the DSAs.
    Please let us know about the correct steps.
    A) Doc2 is correct. You need to run 'dxdisp' only on/for recovering DSA but need to run the same command on all hosts. Running 'dxdisp' on all hosts for all DSAs that are part of MW replication is also OK as it has no ill effect. It's just extra commands you have to execute.. so technically both - only on/for recovering OR all - will be fine. Just not ONLY for good DSA. That doesn't serve the purpose.


    Q) Also, though .dp files on all the dsas is getting updated daily with the latest update timestamp, but there's some data on good dsas which is not getting synced. So , can there be a specific reason for it.
    A) Could be and nothing can be told just from the statement above. You may want to consider to open a support case Broadcom to find out further as DSA log review will be required for this.

    Q) Please be informed that we had tried the steps mentioned in Doc2 on lower environment and were able to see that in warn logs of CA Directory it says "DataStore created for DSA2(of which we copied the .zdb file on bad dsas)". if possible please let us know the reasons for that too.
    A) That is correct and by design. The dsaname (e.g. DSA2 in your example) is hard coded within the .db (and .zdb) file when it was originally created during creation of a new dsa. This cannot be removed or changed so when you perform a manual recovery, the name comes over as part of the recovery process.

    If that is a problem, the other option you have is to:

    ** Dumpe the generated backup (e.g. DSA2.zdb) to LDIF file with dxdumpdb command line tool along with '-z' option.

    ** Shutdown the recovering DSAs (DSA3 and DSA4) and empty it out with 'dxemptydb' command line tool.

    ** Load them using the reulsting LDIF file with 'dxloaddb' command line too.

    As you are working with exisiting DSA3.db and DSA4.db, the name will be preserved (as I said, it is hardcoded within the .db file) so when you start those DSAs after recovery.. it will still show "DataStore created for DSA3" and "DataStore created for DSA4" respectively.

    ~Hitesh


  • 3.  RE: Manual Syncing of 4 CA Directories as User Stores

    Posted Sep 18, 2020 05:54 AM
    Hi Hitesh,

    Thank you for your help.
    Had a small doubt regarding the dxloaddb tool. 
    Which is a better option to run dxloaddb:-

    dxloaddb -O DSA3_name DSA2.ldif
    or 
    dxloaddb DSA3_name

    Is it suggested to run dxloaddb with a specific option or  we can do it in anyway.
    Thanks in Advance.


  • 4.  RE: Manual Syncing of 4 CA Directories as User Stores

    Broadcom Employee
    Posted Sep 18, 2020 08:33 AM
    Hi Nawal,

    Commonly no options are required so you can do it anyway.

    e.g. DSA1 is where the data (LDIF) is coming from and being loaded into DSA3 and DSA4.
    For that you would:

    * dxserver onilnebackup DSA1 (this will result into DSA1.zdb)

    * dxdumpdb -f DSA1.ldif -z DSA1 (this will dump the data to LDIF file from DSA1.zdb.. which DSA1 is still online and operational)

    * Copy DSA1.ldif to those two hosts where DSA3 and DSA4 are running... and on each host load them without any options after shutting them down.

    * On host where DSA3 is running:
    ** dxserver stop DSA3
    ** dxloaddb DSA3 DSA1.ldif (notice the order where LDIF is mentioned is different in both commands.. in dump it comes first, in load it goes at the end)
    ** dxserver start DSA3

    * On host where DSA4 is running:
    ** dxserver stop DSA4
    ** dxloaddb DSA4 DSA1.ldif
    ** dxserver start DSA4

    ~Hitesh


  • 5.  RE: Manual Syncing of 4 CA Directories as User Stores

    Posted Sep 20, 2020 08:40 AM
    Hi Hitesh,

    Thanks for your help. 
    We followed the steps shared by you . 
    • dxdisp DSA3 /dxdisp DSA4 on all the 4 servers
    • dxserver onlinebackup DSA2 
    • dxdumpdb -f DSA2.ldif -z DSA2(while the server was up)
    • Copied DSA2.ldif on DSA3 and DSA4
    • dxserver stop all on DSA3
    • dxemptydb DSA3
    • dxloaddb DSA3 DSA2.ldif
    • dxserver start all on DSA3
    • Same Steps on DSA4
    • Restarted DSA1 and DSA2 after that
    But there are around 30 user difference  which is not getting synced from DSA2 to DSA3/DSA4 . Please be informed that  traffic was enabled during this whole process. 
    If you could tell what might be the possible reason for this and how can we fix it?


  • 6.  RE: Manual Syncing of 4 CA Directories as User Stores

    Broadcom Employee
    Posted Sep 21, 2020 08:42 AM
    Hi Nawal,

    At this stage, I would recommend to open a support case with Broadcom to troubleshoot this further. When you do, make sure to provide exact version of Directory and Service Pack (if any applied) information up front in the case and whatever else is needed, an assigned technician will request further.

    Thanks,
    Hitesh