Description

JIMS establishes connections in the following combination:

  • JIMS and DC

  • ​JIMS and AD

  • JIMS and SRX

This article describes ​how to verify whether each JIMS connection is normal or not.

​Note: This verification is performed on JIMS version 1.1.5.

 

Solution

(A) JIMS and Domain Controller

  1. Select Status on the left in the Juniper Identity Management Service - Administrative Interface window and click the Event Sources tab.

  2. Click the Refresh button in the bottom-right corner to refresh the status.

When JIMS is working without any issue, the state shows as Idle .

You may see the state as Polling sometimes, but if Domain Controller is working without any issues, the state will be Idle immediately after refreshing the window.

After checking the status, check whether there is any error message in syslog.

Sample syslog on JIMS (Event Source: level detail) 

02/04/2019 15:28:18: (EventReader:Detail) Stats (summary) -- polls: 124, events: 220, rate: 0
02/04/2019 15:28:18: (EventReader:Detail) Stats (192.168.100.20) -- state: idle, polls: 124, events: 220, rate: 0
02/04/2019 15:28:19: (EventReader:Detail) polling of DC 192.168.100.20 -- elapsed: 422, events: 0 (0 events/sec), record range: 156969-156969, time range: 01/01/1601 00:00:00.000 to 01/01/1601 00:00:00.000 (delta: 0 secs)
02/04/2019 15:28:29: (EventReader:Detail) polling of DC 192.168.100.20 -- elapsed: 364, events: 0 (0 events/sec), record range: 156969-156969, time range: 01/01/1601 00:00:00.000 to 01/01/1601 00:00:00.000 (delta: 0 secs)
02/04/2019 15:28:39: (EventReader:Detail) polling of DC 192.168.100.20 -- elapsed: 359, events: 1 (2 events/sec), record range: 156969-157150, time range: 02/04/2019 06:28:37.408 to 02/04/2019 06:28:37.408 (delta: 0 secs)
02/04/2019 15:28:49: (EventReader:Detail) polling of DC 192.168.100.20 -- elapsed: 426, events: 0 (0 events/sec), record range: 157150-157150, time range: 01/01/1601 00:00:00.000 to 01/01/1601 00:00:00.000 (delta: 0 secs)
02/04/2019 15:28:59: (EventReader:Detail) polling of DC 192.168.100.20 -- elapsed: 420, events: 0 (0 events/sec), record range: 157150-157150, time range: 01/01/1601 00:00:00.000 to 01/01/1601 00:00:00.000 (delta: 0 secs)
02/04/2019 15:29:09: (EventReader:Detail) polling of DC 192.168.100.20 -- elapsed: 368, events: 0 (0 events/sec), record range: 157150-157150, time range: 01/01/1601 00:00:00.000 to 01/01/1601 00:00:00.000 (delta: 0 secs)
02/04/2019 15:29:18: (EventReader:Detail) Stats (summary) -- polls: 130, events: 221, rate: 0
02/04/2019 15:29:18: (EventReader:Detail) Stats (192.168.100.20) -- state: idle, polls: 130, events: 221, rate: 0

If you see the following state and syslog message, there might be an issue in the connection between JIMS and DC.

  • DC is down from the beginning. The state shows Reconnecting and Learning .

Sample Syslog (Event Source: level detail) 

02/04/2019 14:46:18: (EventReader:Detail) Stats (summary) -- polls: 2, events: 0, rate: 0

02/04/2019 14:46:18: (EventReader:Detail) Stats (192.168.100.20) -- state: reconnecting, polls: 2, events: 0, rate: 0
02/04/2019 14:46:40: (EventReader:Detail) reconnecting -- 192.168.100.20
02/04/2019 14:46:40: (EventReader:Standard) Connected to DC 192.168.100.20
02/04/2019 14:47:01: (EventReader:Error) Failed to open remote log. Error code is RPC_S_SERVER_UNAVAILABLE
02/04/2019 14:47:01: (EventReader:Detail) learning of DC 192.168.100.20 -- elapsed: 21028, events: 0 (0 events/sec), record range: 0-0, time range: 01/01/1601 00:00:00.000 to 01/01/1601 00:00:00.000 (delta: 0 secs)

02/04/2019 14:47:18: (EventReader:Detail) Stats (summary) -- polls: 3, events: 0, rate: 0
02/04/2019 14:47:18: (EventReader:Detail) Stats (192.168.100.20) -- state: reconnecting, polls: 3, events: 0, rate: 0
02/04/2019 14:48:01: (EventReader:Detail) reconnecting -- 192.168.100.20
02/04/2019 14:48:01: (EventReader:Standard) Connected to DC 192.168.100.20

  • DC goes down after JIMS boots up. The state shows Reconnecting and Polling .

Sample Syslog (Event Source: level detail) 

02/04/2019 16:58:36: (EventReader:Error) EvtQuery to 192.168.100.20 failed with RPC_S_SERVER_UNAVAILABLE
02/04/2019 16:58:36: (EventReader:Detail) polling of DC 192.168.100.20 -- elapsed: 21028, events: 0 (0 events/sec), record range: 174598-174598, time range: 01/01/1601 00:00:00.000 to 01/01/1601 00:00:00.000 (delta: 0 secs)
02/04/2019 16:58:37: (EventReader:Detail) Stats (summary) -- polls: 86, events: 248, rate: 1
02/04/2019 16:58:37: (EventReader:Detail) Stats (192.168.100.20) -- state: reconnecting, polls: 86, events: 248, rate: 1
02/04/2019 16:59:36: (EventReader:Detail) reconnecting -- 192.168.100.20
02/04/2019 16:59:36: (EventReader:Standard) Connected to DC 192.168.100.20
02/04/2019 16:59:37: (EventReader:Detail) Stats (summary) -- polls: 86, events: 248, rate: 1
02/04/2019 16:59:37: (EventReader:Detail) Stats (192.168.100.20) -- state: polling, polls: 86, events: 248, rate: 1

02/04/2019 16:59:57: (EventReader:Error) EvtQuery to 192.168.100.20 failed with RPC_S_SERVER_UNAVAILABLE
02/04/2019 16:59:57: (EventReader:Detail) polling of DC 192.168.100.20 -- elapsed: 21028, events: 0 (0 events/sec), record range: 174598-174598, time range: 01/01/1601 00:00:00.000 to 01/01/1601 00:00:00.000 (delta: 0 secs)
02/04/2019 17:00:37: (EventReader:Detail) Stats (summary) -- polls: 87, events: 248, rate: 1
02/04/2019 17:00:37: (EventReader:Detail) Stats (192.168.100.20) -- state: reconnecting, polls: 87, events: 248, rate: 1
02/04/2019 17:00:57: (EventReader:Detail) reconnecting -- 192.168.100.20
02/04/2019 17:00:57: (EventReader:Standard) Connected to DC 192.168.100.20

02/04/2019 17:01:18: (EventReader:Error) EvtQuery to 192.168.100.20 failed with RPC_S_SERVER_UNAVAILABLE
02/04/2019 17:01:18: (EventReader:Detail) polling of DC 192.168.100.20 -- elapsed: 21029, events: 0 (0 events/sec), record range: 174598-174598, time range: 01/01/1601 00:00:00.000 to 01/01/1601 00:00:00.000 (delta: 0 secs)
02/04/2019 17:01:37: (EventReader:Detail) Stats (summary) -- polls: 88, events: 248, rate: 1
02/04/2019 17:01:37: (EventReader:Detail) Stats (192.168.100.20) -- state: reconnecting, polls: 88, events: 248, rate: 1
02/04/2019 17:02:18: (EventReader:Detail) reconnecting -- 192.168.100.20
02/04/2019 17:02:18: (EventReader:Standard) Connected to DC 192.168.100.20
 

(B) JIMS and Active Directory (AD)

  1. Select Status on the left in the Juniper Identity Management Service - Administrative Interface window and click the Info Sources tab.

  2. Click the Refresh button in the bottom-right corner to refresh the status.

Check whether the state shows as Idle .

You may sometimes see the state as Polling but if DC is working without any issue, the state will be Idle immediately after refreshing the window.

After checking the status, check whether there are any error messages in syslog.

Sample Syslog on JIMS (Info Source: level detail) 

02/04/2019 17:27:10: (UserDirectory:Detail) polling of AD server 192.168.100.20 -- elapsed: 5
02/04/2019 17:27:36: (UserDirectory:Detail) Stats (summary) -- polls: 79, updates: 54, avg time: 7999, success: 0, avg time: 0, no handler: 0, dropped during learn: 0
02/04/2019 17:27:36: (UserDirectory:Detail) Stats (192.168.100.20) -- state: idle, polls: 79, updates: 91, avg time: 7999, requests: 0, success: 0, avg time: 0

02/04/2019 17:27:40: (UserDirectory:Detail) polling of AD server 192.168.100.20 -- elapsed: 6
02/04/2019 17:28:10: (UserDirectory:Debug) starting search -- 192.168.100.20 -- 'AD1'

02/04/2019 17:28:36: (UserDirectory:Detail) Stats (summary) -- polls: 81, updates: 54, avg time: 7802, success: 0, avg time: 0, no handler: 0, dropped during learn: 0
02/04/2019 17:28:36: (UserDirectory:Detail) Stats (192.168.100.20) -- state: idle, polls: 81, updates: 91, avg time: 7802, requests: 0, success: 0, avg time: 0

02/04/2019 17:28:40: (UserDirectory:Debug) reading search results -- 192.168.100.20 -- 'AD1'
02/04/2019 17:28:40: (UserDirectory:Debug) starting search -- 192.168.100.20 -- 'AD1' for deleted records
02/04/2019 17:28:40: (UserDirectory:Detail) polling of AD server 192.168.100.20 -- elapsed: 6
 

If you see the following state and syslog message, there might be an issue in the connection between JIMS and AD.

  • AD is down from the beginning. The state is showing Init .

Sample Syslog (Info Source: level detail) 

02/04/2019 12:23:33: (UserDirectory:Detail) Stats (summary) -- polls: 0, updates: 0, avg time: 0, success: 0, avg time: 0, no handler: 0, dropped during learn: 0
02/04/2019 12:23:33: (UserDirectory:Detail) Stats (192.168.100.20) -- state: init, polls: 0, updates: 0, avg time: 0, requests: 0, success: 0, avg time: 0
02/04/2019 12:23:35: (EventReader:Error) Failed to open remote log. Error code is RPC_S_SERVER_UNAVAILABLE
02/04/2019 12:23:36: (UserDirectory:Warning) Unable to connect to ldap://192.168.100.20/RootDSE: (0x8007203A) The server is not operational.
02/04/2019 12:23:36: (UserDirectory:Warning) Unable to retrieve naming contexts -- 192.168.100.20 (0x8007203A) The server is not operational.
02/04/2019 12:24:27: (UserDirectory:Warning) Unable to connect to ldap://192.168.100.20/RootDSE: (0x8007203A) The server is not operational.
02/04/2019 12:24:27: (UserDirectory:Warning) Unable to retrieve naming contexts -- 192.168.100.20 (0x8007203A) The server is not operational.

02/04/2019 12:24:33: (UserDirectory:Detail) Stats (summary) -- polls: 0, updates: 0, avg time: 0, success: 0, avg time: 0, no handler: 0, dropped during learn: 0
02/04/2019 12:24:33: (UserDirectory:Detail) Stats (192.168.100.20) -- state: init, polls: 0, updates: 0, avg time: 0, requests: 0, success: 0, avg time: 0
02/04/2019 12:24:56: (EventReader:Error) Failed to open remote log. Error code is RPC_S_SERVER_UNAVAILABLE
02/04/2019 12:25:18: (UserDirectory:Warning) Unable to connect to ldap://192.168.100.20/RootDSE: (0x8007203A) The server is not operational.
02/04/2019 12:25:18: (UserDirectory:Warning) Unable to retrieve naming contexts -- 192.168.100.20 (0x8007203A) The server is not operational.

02/04/2019 12:25:33: (UserDirectory:Detail) Stats (summary) -- polls: 0, updates: 0, avg time: 0, success: 0, avg time: 0, no handler: 0, dropped during learn: 0
02/04/2019 12:25:33: (UserDirectory:Detail) Stats (192.168.100.20) -- state: init, polls: 0, updates: 0, avg time: 0, requests: 0, success: 0, avg time: 0
02/04/2019 12:26:09: (UserDirectory:Warning) Unable to connect to ldap://192.168.100.20/RootDSE: (0x8007203A) The server is not operational.
02/04/2019 12:26:09: (UserDirectory:Warning) Unable to retrieve naming contexts -- 192.168.100.20 (0x8007203A) The server is not operational.
02/04/2019 12:26:17: (EventReader:Error) Failed to open remote log. Error code is RPC_S_SERVER_UNAVAILABLE
 

  • AD goes down after JIMS boots up. The state shows Idle and Polling .

Sample Syslog (Info Source: level detail) 

02/03/2019 19:11:07: (UserDirectory:Warning) unable to get first row, (0x8007203A) The server is not operational. -- 192.168.100.20 (0x8007203A) The server is not operational.
02/03/2019 19:11:07: (UserDirectory:Detail) polling of AD server 192.168.100.20 -- elapsed: 21013
02/03/2019 19:11:13: (UserDirectory:Detail) Stats (summary) -- polls: 23, updates: 54, avg time: 12724, success: 0, avg time: 0, no handler: 0, dropped during learn: 0
02/03/2019 19:11:13: (UserDirectory:Detail) Stats (192.168.100.20) -- state: idle, polls: 23, updates: 91, avg time: 12724, requests: 0, success: 0, avg time: 0
02/03/2019 19:11:48: (EventReader:Error) EvtQuery to 192.168.100.20 failed with RPC_S_SERVER_UNAVAILABLE

02/03/2019 19:11:58: (UserDirectory:Warning) unable to get first row, (0x8007203A) The server is not operational. -- 192.168.100.20 (0x8007203A) The server is not operational.
02/03/2019 19:11:58: (UserDirectory:Detail) polling of AD server 192.168.100.20 -- elapsed: 21029
02/03/2019 19:12:13: (UserDirectory:Detail) Stats (summary) -- polls: 24, updates: 54, avg time: 13070, success: 0, avg time: 0, no handler: 0, dropped during learn: 0
02/03/2019 19:12:13: (UserDirectory:Detail) Stats (192.168.100.20) -- state: idle, polls: 24, updates: 91, avg time: 13070, requests: 0, success: 0, avg time: 0
02/03/2019 19:12:49: (UserDirectory:Warning) unable to get first row, (0x8007203A) The server is not operational. -- 192.168.100.20 (0x8007203A) The server is not operational.
02/03/2019 19:12:49: (UserDirectory:Detail) polling of AD server 192.168.100.20 -- elapsed: 21013
02/03/2019 19:13:09: (EventReader:Error) EvtQuery to 192.168.100.20 failed with RPC_S_SERVER_UNAVAILABLE
 

(C) JIMS and SRX

  1. Click the SRX Clients tab in the Juniper Identity Management Service - Administrative Interface window and click the Refresh button in the bottom-right corner.

The state shows Batch Active when JIMS is properly receiving queries from the SRX device.

When JIMS has lost connection with the SRX device, two states may be displayed:

  • Inactive: This state indicates that JIMS has never received polling from the SRX device.

  • Batch Inactive: This state indicates that JIMS has lost polling from the SRX device. Based on lab investigation, the timeout was set to 10 minutes. When JIMS loses connection with the SRX device, the state changes from Batch Active to Batch Inactive in 10 minutes.

 

JIMS syslog configuration

Syslog messages are logged in the following directory by default: C:\Program Files (x86)\Juniper Networks\Juniper Identity Management Service\logs . For more information, refer to System Logging .