NetApp Log # 2009815530 : [ Nblade.nfsRCChecksumMismatch ] [ Actions Required ]

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

Your Storage team is getting a few "Nblade.nfsRCChecksumMismatch" alerts fom Netapp, where the Database backup and SessionRecording shares for PAM are located.

IMPORTANT: There are no alarms or errors in the PAM UI. All shares are mounted, the sessions are recorded and the session recordings can be played.

Cause

We do not think that the cause is on the PAM server.

Resolution

A NetApp document provides two possible explanations for those errors:

1. A Man-in-the-Middle may have modified the payload

2. The client OS or application may have incorrectly retransmitted a request, or reused an RPC XID.

 

Problem 1 would have corrupted the payload and either PAM would have run into an error trying to finalize a session recording, or the recording would not be viewable, if the error occurred while finalizing it. Based on the observation that session recordings are good and can be replayed successfully we don't think that is the case

Problem 2 is something we do see every once in a while when we take network traces to look into problems with communication to external servers. Sometimes there is a delay in the network and while a packet is received on the target (in this case the NFS server), PAM resends the packet because the acknowledgement is not received within the expected time. This is handled on the OS side (Debian Linux), PAM does not have specific configuration settings for this. It's a harmless problem, if observed every once in a while, but if observed very frequently it would suggest that there is a significant network latency between PAM and the NFS server.

Both problems would point to an issue along the route and would have to be investigated in the network rather than the two endpoints (PAM server and NFS server).