Tips and Tricks for Using eDirectory™ Tools

Aditya Vikram

Senior Software Engineer

Novell, Inc.

avikram@novell.com

Contents

Novell eDirectory Tools Strategy

Tips and Tricks

Novell iManager

eDirectory Management Toolbox

NDS® iMonitor

ICE

DSRepair

Backup and Restore

Novell eDirectory Utilities Strategy…
Past

Separate utilities…

DSRepair

DSBrowse

DSMerge

Backup/Restore

…

Novell

eDirectory

A Smattering of Functionality

DS Repair

DS Merge

DS Diag

Backup/

Restore

DS Browse

Novell eDirectory Tools Strategy…
Today

A set of tools with a common point of access that supports the maintenance of eDirectory

Reuse of existing utility code

Command-line accessible (scriptable)

Web accessible

Cross-platform

eDirectory Management Toolbox

So What's What?

Manage and Maintain via Novell iManager

DSRepair

DSMerge

Backup/Restore

NDSCons

LDAP Server Configuration

Index Management

Novell Import Convert Export (ICE) utility

Monitor and Diagnose via NDS iMonitor

DSBrowse

DSDiag

Lots more

eMBox

LDAP

Novell iManager Architecture

iManager

(eMFrame)

DHost Process

Web Server

HTTP Stack

SOAP Service

Service Manager

Merge eMTool

Repair eMTool

Backup/Restore eMTool

LDAP Plug-in

Schema Manager Plug-in

ICE Plug-in

DSMerge Plug-in

DSRepair Plug-in

Backup/Restore Plug-in

eDir SDK

eMB x SDK

....

DSRepair Plug-in

Server

eDirectory

Browser

iManager Tips

You need to configure Role Based Services (RBS) before you can use iManager or eMBox functionality

iManager 2.0.x, non-NetWare®: You must configure Novell Portal Services (NPS) via link to wizard on final page of iManager install before configuring Role Based Services

If you install a second iManager 1.5.x, it may not autodetect that RBS is already installed. If this happens, do the following:

Locate the file

…\Tomcat\webapps\eMFrame\WEB-INF\misc\firstTime.properties

Add a line with the fully distinguished name of your tree (remember leading and trailing dots)

Example: .MY_TREE.

Make sure the file ends with a blank line

eDirectory Management Toolbox

iManager

eDirectory Maintenance Role

Command line utility

Doesn't require iManager

Use to script multi-step or repetitive tasks

Tool is called “edirutil”

Advanced Options

Advanced options are marked by red-within-yellow diamond icon in iManager

Think of this as the marker for the “deep end” of the pool

iManager Demo

eMBox Command Line Client

Run via edirutil command

Modes

Interactive – edirutil -i

Single command edirutil -t

Batch – edirutil -b

GUI – edirutil -g

unsupported, but useful

eMBox Command Line Client

Command examples

login -s 137.65.123.255 -p 8008

-u admin.mycompany -w mypassword -n

backup.getconfig

backup.backup -b -f mybackup.bak

-l backup.log -t -e -w

# repair local database

dsrepair.rld

NDS iMonitor

Purpose

Provides web-based monitoring and diagnostic capabilities to all servers in your NDS tree

Automatically installed with eDirectory 8.5 and higher

Just point your web browser at http://<server>/nds

iMonitor Features

Check eDirectory server health

Check Tree-wide health

View partition synchronization status

Troubleshoot obituary processing

Compare schema between servers

Control and configure the DS Agent activity

Intiate and control scheduling of background processes

Memory usage and cache settings

Trace server activity

View verb statistics

More!

iMonitor Tips and Tricks

Use iMonitor as your primary diagnostic tool

Many features specifically address diagnosing and resolving situations frequently encountered by customers and Novell support

Other features were added for engineering use in debugging and assisting support

You can check the version of iMonitor you’re using by clicking the iMonitor logo in the upper left corner

iMonitor Health Check Report

Gives you the ability to automatically assess the status of your entire tree

Lists the status of each server

Let’s you “drill” down to see the details

iMonitor Health Check Report

iMonitor Health Check Report

iMonitor Health Check Report

Scheduled Reports run as .[Public].

iMonitor Health Check Report

iMonitor Health Check Report

iMonitor Demo

Import Convert Export (ICE) Utility

Import and export eDirectory data

LDIF

Delimited (CSV)

Schema definitions

Can convert data via DirXML® rules

ICE

ICE Tips and Tricks

Ships with eDirectory 8.5 and later

Command line

iManager Plug-in

ConsoleOne Snap-in

Ships with LDAP Libraries for C SDK

Command line only

May include new updates since last eDirectory shipment

ICE

ICE Architecture

Source Handler

Destination Handler

ICE

ICE Engine

LDIF File

Source Handler

LDAP Server

Destination Handler

ICE

ICE Engine

ICE Architecture
LDIF Import

ICE Tips and Tricks

You can import data from delimited text files using the Delimited Data Handler

Handler identifier is DELIM

CSV, tab-separated data, etc.

Currently only available from the command line

ICE

DELIM File

Source Handler

LDAP Server

Destination Handler

ICE

ICE Engine

ICE Architecture
CSV Import

ICE Tips and Tricks

You can use File System Factory to set automatically create home directories for users imported via ICE.

You can do interesting things by combining handlers in different combinations

DELIM to LDIF

LDAP to DELIM

LDIF to LDIF (with XML rules)

Or by just being creative

Real world example: find and fix 10,000 rogue ACLs

ICE Demo

DSRepair Purpose

Provides low-level maintenance capabilities to address a wide range of problems that may arise in eDirectory

These problems may be originated by

Users

Third-party products

DIB (Data Information Base) inconsistencies

Hardware failure

Many are historical in nature

Updates are made regularly to resolve problems found in the field

What DSRepair IS

Checks integrity of information stored in NDS and eDirectory databases (DIBs)

Physical level

Logical level

Detects and fixes the majority of integrity problems that have been identified to occur in NDS and eDirectory DIBs

Provides time synchronization diagnosis information for NDS and eDirectory

What DSRepair IS NOT

It is not magic

It cannot re-create lost data, however it can initiate synchronization of lost data from a remote replica

For security reasons, it does not re-create admin or supervisor objects

It is not a day-to-day management tool

It is not a partition or replica manager

Repair functions are not meant for health checking

Especially Important: only use advanced maintenance features to repair the tree

Use DSRepair Appropriately

Most DSRepair options are used to fix problems, not to perform routine management operations

It’s not uncommon for Novell support to have to clean up problems made far worse by well-intentioned misuse of DSRepair

Run DSRepair when you see specific problems

We do not recommend running repair options every day or every week to check tree health

Use iMonitor for health check and diagnostics

Use DSRepair Appropriately (cont.)

Options similar to those found in management utilities should be used only as a last resort

Some DSRepair options are destructive (by necessity)

Example: Removal of a replica from a server should be done via iManager or ConsoleOne®. DSRepair allows you to forcibly remove a replica, but this is not the same thing

Use DSRepair Appropriately (cont.)

Use care with rebuild operational schema

Use it only to fix schema problems so severe that nothing else will get the schema back to a usable, known state

Misuse can cause the operational schema on older servers in your tree to be different from what they had at installation time and may lead to schema conflicts on older versions of eDirectory or NDS

Misuse could undo schema modifications made by administrators or applications and may break the application or cause a security hole

Common example: PUBLIC flag is removed from an attribute for security reasons then gets added back by rebuild operational schema

Use DSRepair Appropriately (cont.)

Don’t use an advanced (-a or –x switch) DSRepair option unless you

Understand what it does

Know the ramifications of using it

Are sure you’re doing it at the right time

Are sure you’re doing it for the right reason

Also, be sure time is in sync before using advanced options

More DSRepair Tips and Tricks

Use DSRepair functions from iMonitor

Paradigm: fix the problem when you see it

Limit the scope of your DSRepair operation

Deselect unneeded options

Only repair a single object or a single partition

Speeds up the operation

DSRepair in iMonitor

Initial DSRepair menu

DSRepair in iMonitor

If you select a specific object

then click on the repair icon…

DSRepair in iMonitor

… notice that repair single object has been automatically selected.

DSRepair in iMonitor

If you’re looking at a list of replicas

and want to repair one of them, click

on it and then click on the repair icon…

DSRepair in iMonitor

… iMonitor automatically selects the option to repair the entire replica.

DSRepair in iMonitor

If you wanted to just check the partition root object and its replica ring instead, you would select repair single object.

More DSRepair Tips and Tricks

Partition operations are not allowed while repairing

Repairing network address only works where SAP, SLP, or DNS are properly configured

Use Hot Continous Backup instead of DSRepair for disaster recovery

Hot Continuous Backup/Restore

New in eDirectory 8.7

Integrated with iManager

Highly-scalable—handles trees with millions of entries

Highly-available—works on live eDirectory server

Maintains references between entries after recovery

DIB oriented

Hot Continuous Backup Demo

Server 3

Server 1

Server 2

Enable roll-forward logging on Server 2 and take a backup.

Hot Continuous Backup Demo

Server 3

Server 1

Server 2

Add users into Server 2.

Hot Continuous Backup Demo

Server 3

Server 1

Server 2

“Crash” Server 2

Hot Continuous Backup Demo

Server 3

Server 1

Server 2

Add users to

Server 1

Updates

Updates

Hot Continuous Backup Demo

Server 3

Server 1

“New Server”

Recover Server 2.

Server 2

Roll-Forward Logs

Full Backup

Verify sync status

Rest of updates now sync to Server 2

Hot Continuous Backup Demo

Server 3

Server 1

Server 2

Updates

Disaster Recovery Complete

Hot Continuous Backup Demo

Related BrainShare® Sessions

iMonitor

TUT351—Automated Novell eDirectory Health Checks and Troubleshooting

TUT355—Deploying, Profiling and Tuning Novell eDirectory for Performance and Scalability

General Administration

TUT157—Using LDAP to Accomplish Directory Administration Tasks

TUT357—Using LDAP to Performed Detailed Administration Tasks

TUT356—Discovering Advanced Features of Novell eDirectory

Related BrainShare® Sessions

File System Factory

TUT188—File System Factory for NetWare: Installation and Configuration

Deploying/Upgrading eDirectory

TUT254—Integrating and Supporting Novell eDirectory on Linux

TUT255—Migration Strategies for Novell eDirectory

TUT256—Deploying Novell eDirectory on Linux in Test Labs

Related BrainShare® Sessions

Backup/Restore

TUT253—Disaster Recovery Planning for Novell eDirectory 8.7 Using Hot Continuous Backup

iManager

TUT250—Novell iManager Introduction and Configuration

TUT353—Novell iManager Advanced Configuration

TUT354—Deploying Novell iManager: Best Practices

Getting More Information

Novell eDirectory 8.7.3 Administration Guide

Sources

On eDirectory CD

http://www.novell.com/documentation

Chapter 6: ICE

Chapter 7: iMonitor (including DIB clone)

Chapter 8: DSMerge

Chapter 9: DSRepair

Chapter 12: Configuring LDAP Services

Chapter 14: Backup/Restore

Chapter 17: Using eMBox and the eMBox Command Client

Getting More Information

Novell LDAP Developer’s Guide

Info on configuring, administrating, and troubleshooting LDAP and using LDAP utilities

Chapter 11: Import Convert Export (ICE)

ISBN: 0-7645-4720-8

LDAP Tools section of the LDAP Libraries for
C SDK documentation

Import Convert Export (ICE)

Novell Education Courses

Course 991: Advanced eDirectory Tools and Diagnostics

Summary

Comprehensive toolbox strategy for eDirectory tools

iManager to Manage and Maintain

eMBox via eDirectory Maintenance role or edirutil command client

iMonitor to Monitor and Diagnose

ICE

Flexible import/export tool

DSRepair

Powerful and useful but potentially destructive

Hot Continuous Backup

Unprecedented disaster recovery capability

General Disclaimer

This document is not to be construed as a promise by any participating company to develop, deliver, or market a product. Novell, Inc., makes no representations or warranties with respect to the contents of this document, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc., reserves the right to revise this document and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. All Novell marks referenced in this presentation are trademarks or registered trademarks of Novell, Inc. in the United States and other countries. All third-party trademarks are the property of their respective owners.

No part of this work may be practiced, performed, copied, distributed, revised, modified, translated, abridged, condensed, expanded, collected, or adapted without the prior written consent of Novell, Inc. Any use or exploitation of this work without authorization could subject the perpetrator to criminal and civil liability.

This means that no work is lost with either the Novell Nsure UDDI corporate or testing solution.

Enterprises that build their UDDI solutions with Novell Nsure UDDI Server, are not only leveraging the deep experience Novell Identity Management foundation brings to the standard, they are securing their own future by building on an open standard implementation that will grow and scale with their corporate needs.

2005-02-01T19:19:00