sepmd -L DMS__ shows Pending messages

Products

• CA Privileged Access Manager (PAM)
• CA Privileged Access Manager - Cloakware Password Authority (PA)
• CA Privileged Access Manager - Server Control (PAMSC)
• CA Privileged Identity Management Endpoint (PIM)

Issue/Introduction

What is the reason for the command "sepmd -L DMS__" to show Pending messages ?

Environment

Release : 14.1

Component : PAM SERVER CONTROL ENDPOINT WINDOWS

Cause

This is the output of sepmd -L DMS__

Message queue subscriber: Topic: ac_server_to_server_broadcast (DH)
Last update time        : Thu May  7 16:59:42 2020
Daily messages sent     : 28076


Subscriber name                Pending messages       Status          Last update time
===============                ================       ======          ================
DH__@<host_01.FQDN> 14                     synced          Thu May  7 16:59:29 2020
DH__@<host_02.FQDN> 14                     synced          Thu May  7 16:59:29 2020
DH__@<host_05.FQDN> 314                    synced          Thu May  7 16:52:49 2020
DH__@<host_07.FQDN> 1313                   synced          Thu May  7 16:37:17 2020
DH__@<host_09.FQDN> 14                     synced          Thu May  7 16:59:29 2020
DH__@<host_10.FQDN> 13                     synced          Thu May  7 16:59:29 2020
DH__@<host_11.FQDN> 14                     synced          Thu May  7 16:59:29 2020

What types of messages does the Pending messages column refer to?
We see that the numbers vary after a while on the individual nodes.
Anyway we do not see any issues in policy distribution or HNODE registrations or heartbeats from these nodes to the DMS.

Resolution

The values in the sepmd -L output for "pending messages" and "last update time" is not real time data.
It is calculated upon internal counters which happens on an hourly basis after restart of the DS.
and is not reflecting the real time messages pending in the communication Q

What is relevant is the Status indicator - in this case all are "synced"          

To analyse further please enable debugging on the DMS__ and all DH__
- secons -s
- in the relevant ../pmdb/pmd.ini set debug_mode = 1
- seload
- wait a few hours
- see the DMS__ and all DH__ the generated endpoint_management.log files and the output of sepmd -L DMS__ for analysis

Additional Information

https://techdocs.broadcom.com/content/broadcom/techdocs/us/en/ca-enterprise-software/layer7-privileged-access-management/privileged-access-manager-server-control/14-1/reference/configuration-files/the-pmd-ini-file/endpoint-management.html