NW Admin changes not being applied? 1

[Jontmke]

I just had something weird happen. A user called in and asked to have his Grace Logins readded. So, I went into NW Admin and gave him some more. While he was still on the phone he tried logging in and got the message that he did not have any Grace Logins. Hmm... So, I look in Admin and it says that he does.
Well, I open ConsoleOne and look and it shows he does NOT have any Grace Logins!! I give him some there and it works right away!! What gives? Why did it misreport and not make the changes I did?

Jon

There is much pleasure to be gained from useless knowledge. (Bertrand Russell)

 

[marvhuffaker]

I suspect that when you did it the first time, the changes were made on one replica, while the user was trying to login using a replica on a different server. The changes probably hadn't been propogated yet. Then when you went to Console One, it read a replica from the server that the person was also using for authentication, so when you made the change there, it was immediately seen by the user. It's not uncommon, especially in large trees, for stuff like that to happen. It will generally take a few minutes to propogate changes throughout the tree.

As a cautionary measure though, you should do a basic health check of NDS and ensure that time on all servers is synchronized and also that the "Report Synchronization Status" does not report any errors. If there is a synch problem, that could also cause what you are talking about.



Marvin Huffaker MCNE, CNE
Marvin Huffaker Consulting

http://www.redjuju.com

 

[Jontmke]

Thanks for the help Marvin.
The thing is I only have 3 Novell servers, with only one doing the Logins. That is the one with the Master replica, the other two have read\write. I am running NW Admin from the sys volume on the Master server, while ConsoleOne I installed locally. Could that be a factor?
I will check the time and replication status. Done, looks fine, one of them was about 10 minutes behind the others but it is not the primary server.

Jon

There is much pleasure to be gained from useless knowledge. (Bertrand Russell)

 

[marvhuffaker]

If one server is 10 minutes behind on synch, that is probably why you saw what you did. Users don't just authenticate to the Master replica. They can authenticate to Read/Write's too. So they could be hitting any of the three, and it won't necessarily be the same all the time. Depending on your configuration, it's possible that one of the Read/Write replica servers responded first to the query and so that is where you authenticate to.

Same holds true for working with ConsoleOne and/or NWadmin. Just because you load from one server, doesn't necessarily mean you're reading the replica from the same server.

I can demonstrate this to you, if you go into NDS Manager. When you click on a partition, it will go out to the tree and gather info about that partition, state of replicas, etc. You'll notice there is a line (upper right side of the window) there that tells you which server the information came from. If you click back and forth to different places in the tree repeatedly, you'll notice that it doesn't always read the partition information from the same server.

If you do a packet trace from a workstation during the login process, or even while running Console One, NWAdmin, or NDS Adminsitrator, you will see that first a request goes out to the network, then several servers reply. But the first one that replies is the one that will handle the rest of the requests.

I wish I could show you an actual trace, but don't have the means to do so right now. If you get a chance, you should set something up and just observe what is going on. It's very beneficial to understanding the client/server communication process.

Sorry for the dissertation, but I hope that helps. Did you say that the actual time is 10 minutes behind, or just the replication synchronization? If the time is off, you need to troubleshoot that.

Marvin

Marvin Huffaker MCNE, CNE
Marvin Huffaker Consulting

http://www.redjuju.com

 

[Jontmke]

The time was fine, it was the replication that was a little behind.
I only have the "primary server" set to respond to "get nearest server" requests. Does this setting only affect the log in process?
I went in to NDS Manager and did not notice what you refered to. But, like I said we only have three servers.

Jon

There is much pleasure to be gained from useless knowledge. (Bertrand Russell)