Reconcilation error in IDM 7.2 SP8

[Former Member]

Hello Guru!

I have IDM 7.2 SP8.

Global constant MX_RECONCILE = FALSE.

In Dispatcher log I see the following error:

procedure = "Reconcile dirty entries" with status = "Scheduled procedure record does not exist".

This error appeared every  minute.

How can I find what is wrong with data, how to correct it and what job (?) is calling this procedure?

Please help me!

Best regards,

Natalia.

[Former Member · Accepted solution]

Hi Nathalia,

I don't understand how you could be getting this error. Looks like there might be some problem with the housekeeping configurations. The housekeeping procedures are called by a separate thread in the dispatcher. If you search for "housekeeping" in the help file, you should find information about this.

Which database are you using?  (SQL/ORA/DB2)

Are you having issues with the other housekeeping procedures as well?

(Try right-click on the dispatcher-log and do "run now", and then check the dispatcher log)

Could you take a screenshot of the mc_proc table?

PS1. The MX_RECONCILE global constant is no longer in use since SP7. Reconciliation is ALWAYS done by the housekeeping. Please see the release note:
http://help.sap.com/download/releasenotes/nw/idm/SAP-NW_Idm_ReleaseNotes_7-2-SP7.pdf

PS2. I'm pretty sure this has nothing to do with MSKEY 13.

Best regards

John Erik Setsaas

Development Architect SAP NW IdM

[Former Member · Accepted solution]

Dear Gurus,

thank you for answers!

1. I use Oracle DB  (11.2.0.3).

2. I have no other issues with housekeeping (as example, dispatcher logs are cleared).

3. Unfortunatelly, I can't follow your advice "Try right-click on the dispatcher-log and do run now", because I have no any menu's item when I do right-click on dispatcher log.

4.mc_proc content:

I need to add that I have 158 entries in table idmv_entry_simple with dirty mark (select count(*) from idmv_entry_simple where mcdirty<>0).

And all of them are users of satelite SAP ABAP system from where I did last "Initial Load".

And I tried to reconcile them manually with task:

function custom_reconcile(Par){

OutString = uIS_PrivReconcile(Par.get("MSKEY"),1);

}

But after successful job run, my entry with mskey = 160001 still have dirty flag.

P.S.: Privilege  MX_PRIV:WD:MSGTEMPLATE:R has mskey=13. It's one of the members of  customer role "SAP_ADMINS". This role assigned to 5 users and one of them (me, mskey=160001) has dirty mark in idmv_entry_simple table.

Best regards,

Natalia.

[Former Member · Accepted solution]

Hi Natalia,

Can you try revoking the privilege MX_PRIV:WD:MSGTEMPLATE:R for mskey 160001(your mskey) and re-assigning it !!

I assume IDM might not be able to remove the dirty flag due to other dependencies.

Revoking & Re-assigning might work !!

Thanks,

Krishna.

[keith_zhang · Accepted solution]

Hello Natalia,

Your table mc_proc looks fine.I went through some codings and I think here error 13 should mean 'referenced value does not exist', when trying to set values to entry reference type attributes for dirty users.

Please verify if you have any such roles/privileges accidently?

BR, Keith

[Former Member · Accepted solution]

Hello Keith,

Thank a lot for your efforts to help me!

I check referenced values via query:

select * from idmv_vallink_basic where mcattrname like 'MXREF%'

and mclinkmskey not in (select mcmskey from idmv_entry_simple)

And got 0.

Is it correct check? Or maybe I need to select something other?

I tried to find the lost referencies via query:

select count(*) from idmv_link_basic_active where mcothermskey not in

(select mcmskey from idmv_entry_simple)

And I got 13337 enties!

And when I check my dirty entries (156) - in table  idmv_link_basic_active all of them has value in column  mcothermskey which mskey is unknown in table idmv_entry_simple:

select count(*) from idmv_entry_simple where mcmskey in

(select mcthismskey from idmv_link_basic_active where mcothermskey not in (select mcmskey from idmv_entry_simple)) 

and mcdirty<>0

Looks like I do wrong select.... I hope.

Could you please advise how can I find what 'referenced value does not exist'?

best regards,

Natalia.

[Former Member · Accepted solution]

Hi Krishna,

thanks for your answer!

I tried to re-assign it, but nothing changed.

I even deleted role with reference to this privilege (mskey=13). But no result.

I would be grateful for any other ideas how to solve my issue!

Best regards,

Natalia.

[Former Member · Accepted solution]

Hi Nathalia,

And thanks for the feedback.

Looks like you might have hit upon a bug, which was fixed in Patch1 of the IdM Runtime, which caused some strange results on Oracle.

Could you please install this patch, and retry the issue?

PS. The "Run..." command is in the history list, and not in the dispatcher log 🙂

Best regards

John Erik

[keith_zhang · Accepted solution]

Hello Natalia,

Thanks for the detail feedback. The query result looks strange... but since this already got our development attention here, please try to follow the suggestion and also feedback here if possible.

Thanks a lot for the help

BR, Keith

[Former Member · Accepted solution]

John,

Could you please explain what is  "Patch1 of the IdM Runtime"?

I have SP8, it include Runtime Engine SP8.

I downloaded ICRUNTIME08_1-20005938.zip and re-install it again, but no result.

Best regards,

Natalia.

[Former Member · Accepted solution]

So you have installed SP8 patch 1, but still have the same problem?

BR

John Erik

[Former Member · Accepted solution]

John Erik,

Yes, I have installed Runtime SP8, but problem was not solved.

Best regards,

Natalia.

[former_member2987 · Accepted solution]

Natalia,

After installing, did you regenerate the dispatchers?

In any case, I would recommend doing this.  Also make sure that the Housekeeping actions are turned on (You might want a separate dispatcher for this)

Matt

[Former Member · Accepted solution]

Hello Matt,

Yes, I regenerated the dispatchers (uninstall, create new scripts, install, start).

And this not solved my problem.

Best regards,

Natalia.

[Former Member]

Hello Guru,

please help me.

I have 197 dirty-marked entries (select count( mcmskey) from idmv_entry_simple where mcdirty<>0 )

and I don't know wjat I have to do with them to stop error with Reconcilation " Scheduled procedure does not exist - 13".

Please advice how to find what entry is produce this error.

I don't want to delete all 197 users.... but I can do it with 1-2 person...

Best regards,

Natalia.

[former_member327338]

Hi Natalia,

error 13 means "entry does not exist" so please again check:

- are there privilege-entries in the link-table that do not exist (mcthismskey or mcothermskey)? - you just have to delete them

- maybe there are entries with non-existing mskeys in the mxi_structure_root? - you have to delete these rows as well

Then the dirty entries should be reconciled sucessfully again.

[Former Member]

Hi Natalia,

We had the same error message during an upgrade from 7.1 ps6 to 7.2 sp7 at a customer in the UK earlier this year. I believe the solution has been stated in this thread although different parts of the answer are in different responses .

We were also on Oracle, and some of the dirty entries were mskeys of identities which had become inactive. If you can join the contents of dirty mskeys with the contents of the MX_PERSON objects with MX_INACTIVE=1 you may find that some are inactive entries. On our system that caused a problem that gave this error message. That was our answer - we reactivated the users and the reconcile procedure was able to run again. SAP Development helped us with this, there may have been a need for restarting the procedure manually, not 100% sure.

Apologies, this is from memory, I am not near my notes right now, I will have a look at them later.

Kind regards,

Andy

[Former Member]

Tobias,

thanks for answer!

1. I have nonexistent entries in table idmv_link_basic_active, in both colums - mcthismskey and msothermskey. How to delete them correctly? May I use simple "delete from idmv_link_basic_active...." or I need to delete these entries from somewhere else?

2. I do not have table  mxi_structure_root in IDM7.2 SP8. Could you please advice what is new name for it?

Best regards,

Natalia.

[former_member327338]

I would try to set them to deleted, not to actually deletethem. So

update mxi_link set mclinkstate=2 where mcuniqueid in (...)

on the db level.

Are you sure that you don't have the mxi_structure_root table?

In my current environment (sp8 patch2) it is still used (was introduces with sp 6 or 7 I think).

(it holds whatever hierarchy you have in the system (ou,role->privilege or whatever) to make it easier walking up and down the tree. and this table is used in the reconcile procedure as well.

Actually I had the same situation (error -13) just now and was only able to solve it by removing no-more-existent childmskeys from that mxi_structure_root table.

[Former Member]

Dear Andy,

it seems to me that you are near the correct solution, could you please help me to make last step?

I see that all these dirty accounts (now 210 entries) have  mark 'Inactive' and mark 'Account disabled' in web-interface:

But when I select data for this user from table idmv_vallink_basic, I see that parameter MX_INACTIVE=0 and MX_DISABLED=0:

select * from idmv_vallink_basic where mcattrname in ('MX_INACTIVE','MX_DISABLED') and mskey in (select mcmskey from idmv_entry_simple where mcmskeyvalue='276332')

I have got 0 entries in result.

I don't know that this problem is connected with dispatcher errors and open new topic -

http://scn.sap.com/message/14693302

Could somebody help me how to find all inactive accounts and how to activate them via pass, not via web-interface?

Thanks in advance!

[Former Member]

Hello all,

I have got it again!

But now I see that first error occured at 11:25. At the same time I did Initial Load from SAP system.

This initial load was finished with several errors:

"The specified "Valid to" date is in the past:Attribute"

(I forgot to run PRGN_COMPRESS_TIMES).

So I found after what situation error in Reconcilation is occured:

In "Initial Load" I have pass which change ROLE:POSITION:XXXX and add MXMEMBER_MX_PRIVILEGE:

If user had a role (ROLE:POSITION:XXXX) with privileges (PRIV:ROLE:<SID>:Z:MY_ROLE)

and this Privilege has outdated in SAP system, I've got errors in job "Initial Load":

putNextEntry failed storingROLE:POSITION:xxxxx

Exception from Modify operation:com.sap.idm.ic.ToPassException:
ToIDStore.modEntry failed modifying entry 'ROLE:POSITION:xxxxx'. IDStore
returned error message: " The specified "Valid to" date is in the
past:Attribute: MXMEMBER_MX_PRIVILEGE" when storing attribute
'MXMEMBER_MX_PRIVILEGE={ValidFrom=2013-11-01!!ValidTo=2013-11-01}<PRIV:ROLE:sid:Z:xxxxx_role>'

After this error Dispatcher don't know what it has to do with reconcilation.

Best regards,

Natalia.

[keith_zhang]

Hello Natalia,

So it seems after this error, only the link table added non-exist mskeys...

Did you also have a test system and try to make this error directly(use a job to change a role directly with this past validity update to MXMEMBER_MX_PRIVILEGE) to see if the non-exist mskeys issue indeed could be reproduced then?

What is the exact DB version you are using? I tested in my SP8 patch2 Oracle DB(schema 1100), and made the same error to one role, but afterwards there is no problem with my link table.

BR, Keith

[Former Member]

Hi Keith,

I have reproduced this situation in test system and my assumption was wrong. In ABAP system I set "Valid to" date for role equals to sysday-1 and run my job "Initial Load", and I have got error in "Initial load" - "The specified "Valid to" date is in the past", but no errors in System log about problems with reconcilation.

But in my Production system today I 've got this error again - Scheduled procedure does not exist - 13 and now I have no ideas what is the reason of it.

Best regards,

Natalia.

[Former Member]

Hello all,

I have the same error again.

"Reconcile dirty entries ---> Scheduled procedure record does not exist"

But now when I run query:

select distinct mcothermskey from idmv_link_basic_active

where mcthismskey in (select mcmskey from idmv_entry_simple where mcdirty<>0)

and

mcothermskey not in (select mcmskey from idmv_entry_simple)

I got result:

149333

149334

So 2 REF's records have bo entry in idmv_entry_simple.

How it can be? And what I need to do now (I don't want to delete all dirty accounts again).

Please help me!

Best regards,

Natalia.

[keith_zhang]

Hello Natalia,

It is still error 13, right?

Have you also checked from eg: idmv_value_basic_all, to see the details about these two mskey entries? Then from their mskeyvalue, can you identify from where they came from according to your system configurations?

BR, Keith

[Former Member]

Hello Keith,

Yes, it's error - 13.

I do not have entries in idmv_value_basic_all with mskey=149334:

(select * from idmv_value_basic_all where mskey='149334')

I repeated my first workaround - deleted all users with dirty flag, because I can't wait so much to solve problem (nothing can be changed when this error occured).

Now I have no this erro in Dispatcher log, and Reconcilation procedure works correct now.

But I still have in table idmv_link_basic_active these 2 entries with nonexistent mskey:

149333

149334

Best regards,

Natalia.

[Former Member]

Dear all,

thank you a lot for provided information and help!

I have deleted all users with dirty flag (select mcmskey from idmv_entry_simple where mcdirty<>0)

using call mc_reset_ids_mskey(%MSKEY%):

After that I reload them from HCM and repeat Initial Load from SAP.

And now I have no errors in Dispatcher log.

Best regards,

Natalia.

[keith_zhang]

Hi Natalia,

Thanks for sharing again. Btw, the reason for different query result in your previous post I think may be that, view idmv_vallink_basic already takes into account table mxi_entry, while this is not the case for view idmv_link_basic_active. Anyway, great that the problem is resolved now.

BR, Keith

[Former Member]

Hi Natalia,

The global constant MX_RECONCILE is used to decide whether  Reconcile of role hierarchy for users should happen immediately (TRUE) or to be  mark users as dirty (FALSE). By default the value of this global constant is FALSE, so as in your case.

For example, you have tried to do changes to the role hierarchy with a large number of roles and thousands of users, which all are assigned with  inherited roles, there is a possibility of the role assignments get affected. The assignments which are affected will be marked with a dirty flag.

Reconciliation of "dirty" entries is done regularly with as part of scheduled procedure for ousekeeping executed by the dispatcher, as below.

In your case, there is an entry marked with dirty flag for the mskey 13, but which might be knocked off/deleted/made inactive, which must be causing this issue. Please query up the assignments for the MSKEY=13 and debug it from there.

Also, you can initiate manual reconciliation using the internal function uIS_PrivReconcile. For more information on this, please see the help section of management console.

All the best.

Thanks,
Krishna.

[ChrisPS]

Hello Natalia,

                    check if there are any inactive users as this can cause errors with the reconcilliation.

Thanks,

Chris

[Steffi_Warnecke]

Hello Natalia,

you should also see error logs for this in the job log and system log. Could you check please?

Via that you can jump to the involved task.

Also check the Status overview for jobs with the status "Error".

Regards,

Steffi.

[Former Member]

Hi Steffi,

"Reconcile dirty entries" is not separate job and I can't check logs for it via "Status".

Best regards,

Natalia.