Guidelines for Specific Components

This chapter describes where to find valuable information for important DirX Identity components (for example, log files) and where to set important switches to influence the logging process. It also provides hints about typical problems.

Be aware that you can use the Windows Event Viewer on Windows to view logging information. The information depth can be configured with the logging configuration files or the filters provided with the Event Viewer.

For the Java-based Server, logging can be configured for syslog.

You can find information for the following components:

Installation and Configuration
Manager
Object Descriptions
Web Center
Policies
Services
C++-based Server
Java-based Server
Java-based Workflows
Tcl-based Workflows
Request Workflows

Analyzing Global Aspects

This section explains issues related to many components and provides hints on how to analyze and solve these issues.It is divided into three parts:

Did you follow the design guidelines?
Perform link checking regularly
Analyze and solve performance problems

Did you follow the Design Guidelines?

You can avoid problems if you try to follow these guidelines:

From the very beginning, design your system having performance aspects in mind. Be aware of possible bottlenecks and collect requirements on system load.
Select built-in features instead of building your own special solutions. This avoids unnecessary effort and eases migration.
Use only the features that you really need. Disable the rest. Especially important are
- Domain object: Inherit role parameters: delays privilege resolution
- Domain object: Offline resolution (also available as separate flag in Web Center)
- Target System object: Reference group from account (avoids huge groups)
- Target System object: Ignore nested groups (avoids checking complex group structures)
Use the latest versions and service packs (which typically have higher performance).
Use cluster workflows if you want to provision sets of similar target systems.
Follow the guidelines for access policy filters.
Test your system with realistic load early.

Performing Regular Link Checking

An Identity management system is a dynamic system. Even if you have well-designed processes and check procedures, data quality is never 100%. One problem is broken links.

Use the link checker regularly to analyze the situation and to optimize your system. Read more about the link checker and its operation in the DirX Identity User Interface Guide.

Be aware that the link checker comes with a default configuration file. Keep this file up to date with the configured links in your Identity system.

Analyzing Performance Problems

If you run into performance problems, try to identify the component and the problem cause and then try to solve it.The following hints can help to manage performance:

Missing indexes in the directory database can lower performance enormously.To find these problems, enable auditing at the directory server.Run the relevant use cases and then check the operations with the highest duration.Evaluate especially the LDAP filter conditions of these operations.If missing indexes are the cause, add these indexes and run your use cases again to verify that the problem is gone.
Read the section "Tuning the Provisioning System" in the DirX Identity Provisioning Administration Guide and follow these guidelines to optimize Manager and Web Center operation.
Use the performance relevant switches in the dxi.cfg file to optimize Manager operation.For details see the section "Customizing the Property File (dxi.cfg)" in the DirX Identity User Interface Guide. Use especially monitorview.refresh, processtable.refresh and resolution.mode.
Be aware that the use of the Segregation of Duties flag at the domain object in combination with policy execution lowers performance significantly.

Analyzing Installation and Configuration Problems

This section explains where to find information to analyze installation and configuration-related problems and provides hints on how to analyze and solve these issues.

Where to find information?

These two files in the folder install_path are relevant for installation and configuration:

install_history.txt - this file contains global information about installed versions, service packs and hot-fixes.It is written and maintained by the product installer, the service pack installer and the hot-fix installer.

configuration.ini - this file is instantiated by the installer (see the Installed.Components.component lines). It is the interface to the configuration tool that extends the file according to the user input (see the *Configured.Components.*component lines as well as the related parameters). The silent installation uses the *option.*component lines.

basic.input.tcl - this file is used as a parameter source for various scripts (for example, schema extensions). Parameters are set via the configurator.

component.input.tcl - this file is used as a parameter source for extension of C++-based Server objects regarding agent information. Parameters are set via the configurator.

For more information about installation and configuration, see the DirX Identity Installation Guide.

The install_path directory contains this set of log files that is relevant for the installer:

Atos_DirX_Identity_V*x.x_Install_timestamp.log* - this file contains the installer logging and timestamp represents date and time of the related installation launch. Check this file for error messages if you run into problems.

The install_path*\logs* directory contains this set of log files that is relevant for the installer:

dirxidty_debug.txt - contains additional information together with the following file.

dirxidty-installer_debug.txt - contains additional information.

The install_path*\logs* directory contains this set of log files that is relevant for the configurator:

configurator.log - contains the input parameters and other valuable information of the last configuration run.

silent.log - contains the complete log information of the last run of the configurator.

InitialConfiguration.date.log - in contrast to the previous file, this file is written for each configuration run (it contains the date and time in the file name).

Analysis-relevant switches and options

There are no specific switches available for debugging the installation or configuration.

Procedures and hints

Be aware that you cannot install the directory schema remotely.Perform this step for Connectivity and Provisioning directly on the corresponding machine.

Analyzing Manager Problems

This section explains where to find information to analyze DirX Identity Manager-related problems and provides hints on how to analyze and solve these issues.

Where to find information?

Find the relevant log files in the folder install_path\GUI\logs

system.nnn.log - this file contains all messages the DirX Identity Manager produces.Standard behavior is that the file is deleted during start of the Manager.

dximanager.nnn.log - this file is normally empty. It contains only messages if errors and warning occur.

ldap.DirXmetaRole.nnn.log - this file contains all LDAP requests and responses for the Provisioning view.

ldap.DirXmetahub.nnn.log - this file contains all LDAP requests and responses for the Connectivity view.

in contrast to the LDAP audit information of the DirX Directory server, both LDAP files contain the complete response of the request. Because this can be a huge amount of information, switch on LDAP logging only if it’s really required.

Analysis-relevant switches and options

The following switches are helpful for problem analysis and logging. For a complete description of the switches see the chapter "Customizing the Property File (dxi.cfg)" in the DirX Identity User Interface Guide.

assign.InitialSearch
ldap.trace
trace.level
trace.maxline
trace.timestamp.format

The following switches influence performance:

aclmgr.refresh.interval
assign.InitialSearch
ldap.switch2offline
monitorview.refresh
processtable.refresh
report.sizelimit
resolution.mode

Procedures and hints

Use the log files to check correct operation of the DirX Identity Manager:

Search the system.nnn.log files for the strings ERR( and WAR( especially before you start production.There should not be any errors or warnings.
Depending on the log level, you can find additional information in the dximanager.nnn.log files.
Do not forget to switch off all analysis switches before you start in a production system because they could lower performance in the DirX Identity Manager.

If these procedures aren’t sufficient to identify the problem and your DirX Identity installation uses the DirX Directory server, you can use LDAP session tracking as an additional method to identify the problem.See the section "Using LDAP Session Tracking to Analyze Component Problems" for details.

Analyzing Object Description Problems

This section explains where to find information to analyze object description related problems and provides hints how to analyze and solve these issues.

Where to find information?

Find the relevant log files in the folder install_path\GUI\logs

system.nnn.log - contains all messages the DirX Identity Manager produces.Problems in object or component descriptions are visible in these log files (startup phase of the Manager).

Analysis-relevant switches and options

No specific switches are necessary

Procedures and hints

Perform this basic procedure

Create and change object descriptions incrementally.
Test from time to time whether errors or warnings show up in the log files:
Start the Manager
Check the log files for "ERR(" and "WAR(" strings to be sure that everything is correctly defined.
If messages occur, analyze them and correct the problem cause.

Analyzing Web Center Problems

This section explains where to find information to analyze Web Center related problems and provides hints on how to analyze and solve these issues.

Where to find information?

Web Center runs on Tomcat, which means that you can find all relevant log information in the Tomcat installation area.

Find all log files in the Tomcat log folder (for example: tomcat_install_path\Apache Software Foundation\Tomcat 6.0\logs).Check these files in case of problems:

localhost.date.log - Tomcat and Web Center startup log information

stdout_date.log - log files with relevant runtime information

Analysis-relevant switches and options

Find Web Center configuration files in the DirX Identity installation in the folder install_path\web\webCenter-domain\WEB-INF

web.xml - general Web Center properties

config\webCenter.properties - application specific properties for Web Center

Procedures and hints

Use the Web Center logViewer to analyze Web Center log files. Perform these steps:

Unpack the tool to the Tomcat log directory.
Copy a log file to the logViewer\log folder
Rename it to log.txt
Run the logViewer\run.bat file. After a view seconds the result is created in the log folder
Start the summary.html page

The tool displays all requests (struts actions) in a list (use the tool tips to understand the columns and items).

Clicking a row opens a separate window that displays the complete logging part for this specific request.

For a detailed description of the logViewer, see the DirX Identity User Interface Guide.

Analyzing Policy Problems

This section explains where to find information to analyze policy-related problems and provides hints on how to analyze and solve these issues.

In this section we concentrate on access policy problems.The typical question is: "Why does a user have this access right?"

The next paragraphs provide hints on how to answer this question.

Where to find information?

You set up all access policies in the DirX Identity Manager in Provisioning → Policies → Access Policies folder.

View the result of the access policies in Web Center: Delegation → Show access rights. For each operation and object type you can find a row in the table. Click the button at the end of the line to view the details; that is, the objects on which the user is allowed to perform the named operation.

Analysis-relevant switches and options

If you have problems in a test environment, use these switches at the Domain object (tab Policies) to check whether the problem comes from access policies:

Enable menu policies - disable this switch to find out whether menu policies influence the accessibility of a specific function.

Disable access policies - enable this switch to switch off access policies completely. This helps to decide if a problem comes from access policies or not.

Procedures and hints

To analyze the influence of access policies on the actions a specific user can perform on a specific set of objects, you need to understand that the access rights of a specific user are the combined result of all relevant access policies. This is the reason why it is difficult to identify the causing access policies in a complex project.

Try to follow these guidelines to solve access policy problems:

Work incrementally if you create access policies. Check intermediate results.
Try to reduce the problem.

A general approach is:

Use the queries in the DirX Identity Manager to find the relevant access policies.Find default queries in Provisioning → Policies → Access Policies → _Queries.The set-up queries work by object type or by operation.Do not hesitate to set up your specific queries.The result is a set of access policies that you should check further to see if they cause your problem.
Verify the access rights of a user with Delegation → Show Access Rights in Web Center.
Deactivate an access policy to check whether it has an influence.Be aware that there is an access policy cache that is refreshed every ten minutes by default.To make changes effective immediately, perform a log out / log in sequence in Web Center or restart the Manager.

Analyzing Services Problems

This section explains where to find information to analyze services related problems and provides hints on how to analyze and solve these issues.

Where to find information?

The DirX Identity service layer runs either standalone as a Java-based job as part of a Tcl-based workflow or it runs in any component that uses the service layer (Manager, Web Center, event-based workflows in the Java-based Server).

Find information about a problem in the relevant log files.

Analysis-relevant switches and options

If the problem is not yet obvious from the error message, enhance the trace or log levels to get more information. Repeat the test.

Procedures and hints for Privilege Resolution

1) Complex privilege resolution problems

Privilege resolution is a complex process that is not easy to manage if problems occur in a complex environment where thousands of identities are resolved via the service agent.

Try to reduce the problem while using this procedure in the DirX Identity Manager:

Find out which identity or related object causes the problem.
Set the log level to 9 (dxi.cfg file).
Start the Manager and try to reproduce the problem (for example, assign or unassign a privilege by hand).

Check the log file carefully (see the section "Analyzing Manager Problems" for more information). This should show the error cause in detail; for example, incorrect object descriptions.

2) Unwilling to perform messages

If you encounter "Unwilling to perform" from the LDAP server during Privilege Resolution, check that the Paging Policy Timeout and the Session Timeouts of the LDAP server are configured correctly.

If you don’t want to increase these values, change the configuration as described in the Application Development Guide: Using the Maintenance Workflows → Understanding the Tcl-based Maintenance Workflows → Privilege Resolution Workflow → Privilege Resolution Workflow Optimization.

Analyzing C++-based Server Problems

This section explains where to find information to analyze C++-based Server-related problems and provides hints on how to analyze and solve these issues.

Where to find information?

Find the log files in the folder

install_path\server\log

Analysis-relevant switches and options

The startup of the server is controlled by the file

install_path\server\conf\dxmmsssvr.ini

You can configure the logging levels and the logging behavior in the folder

install_path\server\conf\

Use the dirxlog.cfg file to adjust the logging (see the DirX Identity Meta Controller Reference for details).

Procedures and hints

1) Startup problems

Note that the startup phase is controlled by the dxmmsssvr.ini file parameters). The server registers only if file and LDAP parameters are consistent (dnServerName and host). Correct these parameters if they are not correctly configured.

Due to the fact that the LDAP server can be installed on another machine, the server repeats LDAP binds. See the parameters repeat and timeout in the dxmmsssvr.ini file. Adjust these parameters if not sufficient!

Additionally, the watchdog repeats server starts. Configure the parameter server_restart accordingly.

2) Using logging

Use the log files as described above and configure logging in the dirxlog.cfg file as needed. (see the DirX Identity Meta Controller Reference for details).

Use the command metahubdump to convert the binary log files to readable format (see the DirX Identity Meta Controller Reference for details).

Analyzing errors and warnings:

Search for the string '-- error' to find errors in the file
Search for the string '-- warning' to find warnings in the file
Look up error numbers in the documentation. Read the provided reason and solution paragraphs carefully.

On Windows platforms, you can use the Windows Event Viewer alternatively or additionally.View the log entries in the Windows Event Viewer and use the filter function of the Event Viewer.See the Microsoft documentation for more information.

3) Using the Get Server State method

You can use the DirX Identity Manager Get Server State command to request the state of each C++-based Identity Server.See the "Get Server State" topic in the DirX Identity User Interface Guide for more information.

Analyzing Java-based Server Problems

This section explains where to find information to analyze Java-based Server-related problems and provides hints on how to analyze and solve these issues.

Where to find information?

The Java-based server provides a comprehensive set of log files in the folder

install_path\ids-j-domain-Sn\logs

You can open the log files from this directory or from the Web Admin application in the section Logging → View Log Files.

These files are available:

start.log - provides information about the server start-up phase.

classloader.txt - helps to analyze class loading problems.

stderr.*nnn.log* - delivers messages that otherwise cannot be logged (logging not yet initialized).

server-*timestamp-counter.txt* - contains all log messages ordered per timestamp. Set logging levels in Web Admin to influence the logging depth.

warnings-*timestamp-counter.txt* - contains a collection of all errors and warnings that occurred (find full information is in server-*timestamp-counter.txt* files)

serverstate.txt - provides the complete state of server is written every hour.

server.xml - contains the complete loaded server XML configuration. This is the resolved content of the corresponding Java-based Server entry in the Connectivity view (Content tab).

Analysis-relevant switches and options

Set up logging levels for the Java-based Identity Server Web Admin application in the section Logging → Set Log Levels.

For more information about the Web Admin application, see "Using Web Admin" in the DirX Identity User Interface Guide.

Procedures and hints

1) Analyzing log files

Use the logANT tool to produce log files for individual workflows. For more information see the DirX Identity User Interfaces Guide.

Analyze errors and warning by searching the string

'*** WARNING' for warnings

'*** SEVERE' for errors

2) Analyzing class loading problems

You can analyze class loading problems in the Java-based Server in two ways.

Checking whether a specific JAR-file is loaded

Check the file classloader.txt whether a specific jar file is loaded.
Check also the location of the loaded jar file and whether it is maybe loaded multiple times (maybe the wrong version is loaded?).

Checking whether a specific class is loaded

To check loading of a specific class, set for this class in the file _
install_path_\ids-j-domain-Sn\bin\clcfg.properties
the property class=true
Restart the server.
Check the classloader.txt file whether the class is correctly loaded.

3) Viewing the server status

Use the Web Admin application to verify the status of each Java-based Identity Server.For more information about the Web Admin application, see "Using Web Admin" in the DirX Identity User Interfaces Guide.

Check the server.xml file in the folder install_path\ids-j-domain-Sn\logs to find out what the actual configuration of this server is (all references are resolved in this file).

Analyzing Java-based Workflow Problems

This section explains where to find information to analyze Java-based workflow related problems and provides hints on how to analyze and solve these issues.

Where to find information?

You can view the complete logging information for these workflows in each Java-based Server instance in the folder

install_path\ids-j-domain-Snumber\logs

The files of interest are:

server-timestamp-counter.txt - all log messages ordered per timestamp. Set logging levels in Web Admin to influence the logging depth.

warnings-timestamp-counter.txt - a collection of all errors and warnings that occurred (find full information is in server-timestamp-counter.txt files)

Analysis-relevant switches and options

Set up logging levels for the Java-based Identity Server Web Admin application in the section Logging → Set Log Levels.

For more information about the Web Admin application, see "Using Web Admin" in the DirX Identity User Interface Guide.

Procedures and hints

These hints can help to isolate and reduce problems in complex environments:

1) Use extended Join logging

Analyze problems in real-time workflows while you set the Join logging (class com.siemens.dxm.join) via Web Admin to 'Finest' or 'All'. This action reveals a lot of details and helps to understand what is really going on.

2) Perform stand-alone tests

To isolate complex problems, perform stand-alone real-time workflow tests that run outside the Java-based Server. Use this method also during creation of new workflows and connectors.

3) Monitoring Provisioning Workflows

The Monitor View presents a lot of information about running or completed provisioning workflow runs. See the "Monitor View" and "Using the Monitor View" topics in the DirX Identity User Interfaces Guide for basic information.

There are several ways to use the Monitor View:

Open the folder in the tree pane with the name of the desired workflow. Click the status entry from the workflow that you’d like to explore (hint: the last entry in the list is the newest one). To view a status entry with a specific date and time, click on the entries and view the Start Time field, which displays the local time (you can use the cursor keys to move between the entries in the tree).
Use the predefined filters or (set up your own) to view specific status entries. See the 'Query Folder' topic in the DirX Identity User Interfaces Guide for information on how to set up filters. For example, you can use the Result=Not OK filter to get all workflow status entries that did not run correctly. Use relative and absolute time variables to refine your filter definitions, for example display the workflows of the last 3 hours.

To analyze a status entry:

View the workflow status entry.Look at the Result field to check for the status of the entry.
If the status is not closed.completed.ok, the Remark field should display additional messages.If the remark field is empty, view the corresponding activity status entries (remark field and statistics).The remark field contains a line for each performed action with all necessary information about the result.It displays also error and warning information.If you need more information, look up the Java-based Server log files.
You can use the additionally provided information in the DirX Identity Trouble Shooting Guide to analyze the messages displayed here.If the messages are not completely displayed, use the button at the bottom on the left side of the field to read the messages in your preferred text editor.

Note that for real-time workflows including password changes, no files are stored in the status area.All available information is present in the status entries.If this is not enough information, you need to check the Java-based Server log files.

Analyzing Tcl-based Workflow Problems

This section explains where to find information to analyze Tcl-based workflow related problems and provides hints on how to analyze and solve these issues.

Where to find information?

The central point at which to find information is the Connectivity → Monitor area.Here you can find status entries that contain all information about a specific workflow run.

These status entries can relate to files stored in the status area of the C++-based Server.

Note also that in some cases the log files of the C++-based Server can reveal additional problems. See the corresponding section.

Analysis-relevant switches and options

You can control the log levels for the meta controller (metacp) in the subdirectory

install_path\client\conf

See the description of the dirxdumplog command in the DirX Identity Meta Controller Reference for further details.

Procedures and hints

The Monitor View presents a lot of information about running or completed provisioning workflow runs. See the "Monitor View" and "Using the Monitor View" topics in the DirX Identity Manager help for basic information.

There are several ways to use the Monitor View:

Open the folder in the tree pane with the name of the desired workflow. Click the status entry from the workflow that you’d like to explore (hint: the last entry in the list is the newest one). To view a status entry with a specific date and time, click on the entries and view the Start Time field, which displays the local time (you can use the cursor keys to move between the entries in the tree).
Use the predefined filters or (set up your own) to view specific status entries. (See the 'Query Folder' topic in the DirX Identity Manager help for information on how to set up filters). For example, you can use the Result=Not OK filter to get all workflow status entries that did not run correctly. Use relative and absolute time variables to refine your filter definitions, for example display the workflows of the last 3 hours.

To analyze a status entry:

View the workflow status entry. Look at the Result field to check for the status of the entry.
If the status is not closed.completed.ok, the Remark field should display additional messages. You can use DirX Identity Manager help to analyze the error messages displayed here. If the messages are not completely displayed, use the button at the bottom on the left side of the field to read the messages in your preferred text editor.

The information provided for C++-based status entries in the Remark field is usually not very detailed.Consequently, you should look at the activity or the activities that failed:

When there are several activities, click the workflow entry in the tree pane.In the list pane (top pane at the right side), you can then view the activities that have a result that is not closed.completed.ok.
Click these activities and view the Remark field.This field should contain more detailed information about the specific problem that occurred with this activity.You can use DirX Identity Manager help to analyze the error messages displayed here.
In many cases, you will find a text message like "See process info file for more information" or "See report or trace file for more information".The message indicates that the File tab should contain additional information about the error.
Click the File tab.Then view the Process Info file.It can contain the stdout and stderr information which should give you a more detailed view of the problem.Please note that this information is highly dependent on the information the agent provides.
If the information in the Process Info does not help, you can try to view trace or report files to find out more.

Analyzing Request Workflow Problems

This section explains where to find information to analyze request workflow-related problems and provides hints on how to analyze and solve these issues.

Where to find information?

You can view the complete logging information for these workflows in each Java-based Server instance in the folder

install_path\ids-j-domain-Sn\logs

The files of interest are:

server-timestamp-counter.txt - all log messages ordered per timestamp. Set logging levels in Web Admin to influence the logging depth.

warnings-timestamp-counter.txt - a collection of all errors and warnings that occurred (find full information is in server-timestamp-counter.txt files)

Analysis-relevant switches and options

Set up logging levels for the Java-based Identity Server Web Admin application in the section Logging → Set Log Levels.

For more information about the Web Admin application, see "Using Web Admin" in the DirX Identity User Interfaces Guide.

Procedures and hints

These hints can help to isolate and reduce problems in complex environments:

1) Perform stand-alone tests

To isolate complex problems, perform stand-alone real-time workflow tests that run outside the Java-based Server. Use this method also during creation of new workflows and connectors.

2) Monitoring Request Workflows

Open Provisioning → Request Workflows → Workflows → Monitor to view the instances of request workflows. Here you can find all information about running or completed workflows.

To analyze the status entries:

Open the folder structure and navigate to the folder for the day where you expect the workflow instance.Alternatively you can use the predefined queries or you can define your own queries.
Check first the workflow entry.The Status Information tab presents all important information.Especially the Error Messages field presents all related error messages.Analyze these messages to find out the problem cause.
If you want to view the activity entries, check in the General tab in the graphical view which activities failed or where the workflow is waiting for further processing.
Open the workflow instance entry to display the list of activities.Click the activities and then the Status Information tab to view more status information.
If this is not enough information, check the log files in the Java-based server log folder.You can access these files either in the file system (install_path*\ids-j-domain-S*n*\logs*) or via the Web Admin application in the logging section.
If you still do not have enough information and your problem is reproducible, change the log levels via the Web Admin and start another request workflow of the same type.

Using LDAP Session Tracking to Analyze Component Problems

If you find that the component-specific logging described in the previous sections does not provide you with a clear picture of the problem you are experiencing and your DirX Identity installation uses the DirX Directory server, you can use LDAP session tracking as an additional way to identify the problem.

This section describes where to find LDAP session tracking information and provides hints on how to use it to analyze and solve component problems.

Where to find information?

If your DirX LDAP server’s audit configuration enables LDAP session tracking, all DirX Identity components that access LDAP - DirX Identity Manager, Web Center, Policy Agent, Provisioning and Request workflows and other Connectivity and Provisioning components - augment the DirX LDAP server’s audit records with session-tracking related information that allows you to identify, for an LDAP operation:

The DirX Identity component that invoked the operation
The user bound to the invoking component
The computer on which the operation was invoked

You use the DirX Directory commands dirxauddecode and dirxaudstatistics to evaluate the LDAP audit records and obtain this information.

Analysis-relevant switches and options

If LDAP auditing is not yet enabled in your DirX Directory server environment, use the dirxcp command to run the script ldap_auditcfg.cp, as described in the DirX Administration Guide → "Using LDAP Auditing" → "Enabling LDAP Auditing". This script creates a default LDAP audit configuration subentry for the DirX LDAP server that enables session tracking for LDAP audit records, among other default values. See the section "Attributes for LDAP Server Audit Configuration" in the chapter "DirX Attributes" in the DirX Administration Reference for a description of the attributes related to LDAP server audit configuration. See the description of the dirxcp command in the DirX Administration Reference for usage information on the command.

Procedures and hints

Use the DirX Directory commands dirxauddecode and dirxaudstatistics to evaluate the DirX Identity component session tracking information in the LDAP audit records to analyze DirX Identity component operations. The most important items in the evaluated LDAP audit records are:

SID-Name - the name of the invoking component
SID-Info - the DN of the bind user
SID-IP - the IP address of the machine on which the component runs

These items are analogous to the sessionSourceName, sessionTrackingIdentifier and sessionSourceIP items described in the section "Using Session Tracking" in the DirX Administration Guide and the Internet draft "LDAP Session Tracking Control" (draft-wahl-ldap-session-03.txt).

DirX Identity prefixes every SID-Name with DXI. The next part of the SID-Name identifies the component. When possible, the "Application Name" of the LDAP audit record is used. If available, an identifier like the workflow instance ID is appended. The following table describes the SID-Names for DirX Identity components and provides examples of their use:

Component	SID Name	Example
Identity Manager	DXI Manager ([Connectivity\|Provisioning])	DXI Manager(Connectivity)
Identity Web Center	DXI WebCenter session_ID	DXI WebCenter DirXmetaRole-591814-2
Policy Agent	DXI PolicyEngine workflow_instance_ID	DXI PolicyEngine a5d19c2—12828251-1490dc3300a—7fec#20141014090742Z
MetaRole Service Agent	DXI ConsistencyAgent workflow_instance_ID	DXI ConsistencyAgent a5d19c2—669bb17d-14aecca6e00—7fe8#2015011
Web Services	DXI ProvisioningService ProvisioningWebServices-session_ID	DXI ProvisioningService ProvisioningWebServices-209319-1
Java-based Provisioning Workflows	DXI [JoinFromDXI \| JoinToDXI] workflowID workflow_name	DXI JoinFromDXI 1495c804a6e$-724d Validate_JDBC_RealtimeOra
Entry Change Workflows	DXI EventBasedResolution workflow_instance_ID	DXI EventBasedResolution 149f06b6032$-7987
Ticket Workflows	DXI ProcessTickets workflow_instance_ID	DXI ProcessTickets 149f06b6032$-7988
Request Workflows	DXI ApplyChange workflow_instance_ID activity_name	DXI ApplyChange 1495c804a6e$-724d Apply Changes
Campaign Controller	DXI CampaignControl workflow_instance_ID	DXI CampaignControl 155057c69a9$-7ea1
Read Configuration	DXI Read[Provisioning\|Connectivity]Configuration-Sn	DXI ReadProvisioningConfiguration-S1
Request Workflow Service (including bulk approval)	DXI WorkflowService-Sn session_ID	DXI WorkflowService-S1 DirXmetaRole
Various Java-based Server components, like Request Workflow Engine	DXIJavaServerInternal-Sn	DXI JavaServerInternal-S1
Full-Check Java Server	DXI FullCheck-Sn	DXI FullCheck-S1
WFStatusLogHandler (RT Monitor)	DXI WfStatusLogHandler-Sn	DXI WfStatusLogHandler-S1
Ldapreader Java Server	DXI LdapReader-Sn	DXI AbstractLdapResourceManager-S1
Approval REST Services	DXI ApprovalRestService-sessionID	DXI ApprovalRestService ApprovalRestService-560312-1
JobSessionFactory Java Server	DXI JavaServer JobSessionFactory-Sn	DXI JavaServer JobSessionFactory-S1
domcfg/Loader Java Server	DXI JavaServer DomcfgLoader-Sn	DXI JavaServer DomcfgLoader-S1
domcfg/DomainSessionAccessor Java Server	DXI JavaServer DomainSession-Sn	DXI JavaServer DomainSession-S1

Component

SID Name

Example

Identity Manager

DXI Manager ([Connectivity|Provisioning])

DXI Manager(Connectivity)

Identity Web Center

DXI WebCenter session_ID

DXI WebCenter DirXmetaRole-591814-2

Policy Agent

DXI PolicyEngine workflow_instance_ID

DXI PolicyEngine a5d19c2—12828251-1490dc3300a—7fec#20141014090742Z

MetaRole Service Agent

DXI ConsistencyAgent workflow_instance_ID

DXI ConsistencyAgent a5d19c2—669bb17d-14aecca6e00—7fe8#2015011

Web Services

DXI ProvisioningService ProvisioningWebServices-session_ID

DXI ProvisioningService ProvisioningWebServices-209319-1

Java-based Provisioning Workflows

DXI [JoinFromDXI | JoinToDXI] workflowID workflow_name

DXI JoinFromDXI 1495c804a6e$-724d Validate_JDBC_RealtimeOra

Entry Change Workflows

DXI EventBasedResolution workflow_instance_ID

DXI EventBasedResolution 149f06b6032$-7987

Ticket Workflows

DXI ProcessTickets workflow_instance_ID

DXI ProcessTickets 149f06b6032$-7988

Request Workflows

DXI ApplyChange workflow_instance_ID activity_name

DXI ApplyChange 1495c804a6e$-724d Apply Changes

Campaign Controller

DXI CampaignControl workflow_instance_ID

DXI CampaignControl 155057c69a9$-7ea1

Read Configuration

DXI Read[Provisioning|Connectivity]Configuration-Sn

DXI ReadProvisioningConfiguration-S1

Request Workflow Service (including bulk approval)

DXI WorkflowService-Sn session_ID

DXI WorkflowService-S1 DirXmetaRole

Various Java-based Server components, like Request Workflow Engine

DXIJavaServerInternal-Sn

DXI JavaServerInternal-S1

Full-Check Java Server

DXI FullCheck-Sn

DXI FullCheck-S1

WFStatusLogHandler (RT Monitor)

DXI WfStatusLogHandler-Sn

DXI WfStatusLogHandler-S1

Ldapreader Java Server

DXI LdapReader-Sn

DXI AbstractLdapResourceManager-S1

Approval REST Services

DXI ApprovalRestService-sessionID

DXI ApprovalRestService ApprovalRestService-560312-1

JobSessionFactory Java Server

DXI JavaServer JobSessionFactory-Sn

DXI JavaServer JobSessionFactory-S1

domcfg/Loader Java Server

DXI JavaServer DomcfgLoader-Sn

DXI JavaServer DomcfgLoader-S1

domcfg/DomainSessionAccessor Java Server

DXI JavaServer DomainSession-Sn

DXI JavaServer DomainSession-S1

Use the -C option to the dirxauddecode and dirxaudstatistics commands to specify a SID-Name as a string. For example, specifying the string DXI WfStatusLogHandler-S1 to the -C option directs the commands to generate an output file that contains only those operations issued by an LDAP client whose session-tracking control has the SID-Name WfStatusLogHandler-S1. See the descriptions of these commands in the DirX Administration Reference for detailed information about their use.

You can use DirX Identity tools to obtain the desired SID-Name string input depending on the component you’re trying to track. For example, you can use the Monitor View to obtain a real-time workflow’s name and instance ID for input to dirxauddecode/dirxaudstatistics. You can also use the Monitor View to obtain the name of the Java-based Server on which a real-time workflow ran (for example, My-Company-S1-MyHostName); this information is contained in the entry for the real-time workflow in the Monitor View. For other components, you can examine the logs described in "Analyzing Java-based Server Problems" to determine on which Java-based server they’re running. You can obtain the session ID for a component by examining the informal messages provided in the component logs for the component; for example, Web Services, REST Approval Service, and so on.