How to recover from seosdb database corruption, UNIX/Linux endpoint

Products

• CA Virtual Privilege Manager
• CA Privileged Identity Management Endpoint (PIM)
• CA Privileged Access Manager (PAM)

Issue/Introduction

On any PIM endpoint, the seosdb might get corrupt due to various factors. One of the following error message might be registered in the log file depending upon the operating system. Below are only a few of the captured messages.

1.   seoswd: [ID 973226 auth.error] Communication time out to seosd. Executing seosd

2.   FATAL
! Inseosrt_InitDatabase (0x270)

3.   WARNING: /Path of Access Control/seosdb/seos_cdf.dat was corrupted.

Environment

PIM 12.8.x / PAMSC 14.x endpoints

Cause

One of the major cause for seosdb corruption is abrupt shutdown of the host system.

The file system on which the endpoint is installed running out of disk space.

Unexpected behavior or response form the PIM endpoint also points towards the corruption of seosdb.

Resolution

This article applies only the UNIX/Linux endpoint deployments.

The resolution to this situation is to rebuild the seosdb, after exporting the data from the current seosdb and importing the data after rebuilding the new seosdb. Seosdd would be rebuild using the utility ‘dbmgr’

dbmgr
Creates, manages, and maintains the eTrust AC database.

Note: This utility replaces the following utilities from previous versions:
dbdump, rdbdump, dbutil, secredb, sedb2scr, and semigrate.

The dbmgr utility handles several tasks, each described separately in this section:

·        Creating a new database

·        Generating reports on database records

·        Creating a script that defines a database

·        Copying data from a database to a flat file

·        Managing and maintaining a database

The above tasks with options will be used for fixing the commonly seen database corruption problems.

Step 1:
Stop Access Control using secons -s if running (if it is not running, skip this step)

Step 2:
Backup /eACinstalldir/seosdb directory using copy to any other location than the seosdb, this can be done using the ‘cp’ command.

Step 3:
Close any open connections to the database and check for index consistency

cd /eACinstalldir/seosdb
dbmgr -u -close. This will close the database
dbmgr -u -check. This will check the database

Step 4:
Build the database files using the following commands:

dbmgr -u -build seos_cdf.dat
dbmgr -u -build seos_pdf.dat
dbmgr -u -build seos_pvf.dat
dbmgr -u -build seos_odf.dat

OR

dbmgr -u -build all (Preferred)

Step 5:
If everything goes fine without any error messages, pls. start Access Control / PIM endpoint, or even after the above steps are executed and still there are problems encountered, execute the following steps as well.

If the dbmgr -u -check (step 5) gives an error, then do the following instead of step 6.

Step 6:
Create a backup of the old database by copying it to a different location (as per Step2). We will refer to it as /tmp/old_db, (the backup location can be any other location of your choice)

Step 7:
Create a script that will duplicate / extract the old database contents by running the dbmgr utility on the old database, this has to be performed as root user or as a user who has Admin privileges in Access Control / PIM endpoint.

# cd /tmp/old_db
# /eACinstalldir/bin/dbmgr -export -l > lang_script

Step 8:
Execute the dbmgr utility to create a flat file containing data from the old database:

# cd /tmp/old_db
# /eACinstalldir/bin/dbmgr -migrate -r /tmp/old_db/flat_file

Step 9:
Create a new database.

#cd /eACinstalldir/seosdb
# /eACinstalldir/bin/dbmgr -c -cq

Step 10:
Execute the script generated in the step 7 and populate the new database (importing the contents in the new seosdbd created)

# cd /eACinstalldir/seosdb
# /eACinstalldir/bin/selang -l < /tmp/old_db/lang_script

Step 11:
Load the data from the flat file into the new Access Control database:

# cd /eACinstalldir/seosdb
# /eACinstalldir/bin/dbmgr -migrate -w /tmp/old_db/flat_file

 

Load access control daemons using seload.

Note: “eACinstalldir” is the path where Access Control / PIM endpoint is installed.

Additional Information

For more options with respect to dbmgr refer to the product documentation.

dbmgr Utility

R12.8 SPxx : https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/privileged-identity-manager/12-8-01/reference/utilities/dbmgr-utility.html
PAMSC 14.x : https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/privileged-access-manager-server-control/14-1/reference/utilities/dbmgr-utility.html