EEM Safex application policy export returns Sponsor Error: [ISE

Products

Autosys Workload Automation

Issue/Introduction

Export of Autosys EEM policies via safex gives an error

Safe Error: [EE_POZERROR Repository Error]
Sponsor Error: [ISE_SESSIONTIMEOUT session timed out]

safex -h EEMhost.example.com -u EiamAdmin -p Password -f autosys-config.xml

autosys-config.xml
<Safex>
<Attach label="WorkloadAutomationAE"/>
<Export file="/tmp/autosys-export.xml" globalfolders="n" globalusergroups="n" globalusers="n" globalsettings="n" folders="y" usergroups="y" users="y" calendars="n" policies="n" appobjects="n" maxsearchsize="90000000"/>
<Detach/>
</Safex>

Adding trace via sdk-config file and referring to it in safex gives additional info regarding what component is timing out.

safex -h EEMhost.example.com -u EiamAdmin -p Password -f autosys-config.xml -sdkconfig /tmp/eiam.server.config

/tmp/eiam.server.config
## in this file, increased sockettimeout

<Network sockettimeout = "9999999" retrycount="1" maxconnections="100"/>

## and enabled trace
<Debug>

<logLevel>TRACE</logLevel>

<logToFile>true</logToFile>

<logFile>/opt/autosys/eiam.trace.log</logFile>

TRACE: [0xf6725740] ispUtil::_initialize : IGWPort tag not found. Adding and setting it to 5250
TRACE: [0xf6725740] ispUtil::setIGWPort : iGateway Port value within range. setting to 5250
TRACE: [0xf6725740] ispUtil::_initialize : keyLength tag not found. setting to default 1024
TRACE: [0xf6725740] ispUtil::setCryptoKeySize : crypto key length set to 1024 TRACE: [0xf6725740] ispUtil::_initialize : default ssl certificate will be generated and used
TRACE: [0xf6725740] ispUtil::_initialize : etpki_lib_get_mode returned [ETPKI_MODE_UNINITIALIZED]
TRACE: [0xf6725740] ispUtil::_initialize : initialised etpki in non FIPS mode
TRACE: [0xf6725740] GenCertificate::generateCert :Using digest algorithm as [ITECH_DIGEST_SHA256]
TRACE: [0xf6725740] GenCertificate::generateCert : not setting serial information for certificate
TRACE: [0xf6725740] GenCertificate::generateCert : not setting email information for certificate
TRACE: [0xf6725740] GenCertificate::generateCert : setting certificate expiry to 3650 days
TRACE: [0xf6725740] GenCertificate::generateCert : creating a self-signed certificate
TRACE: [0xf6725740] GenCertificate::generateCert : certificate generated successfully [subject : CN=eemhost.example.com]
TRACE: [0xf6725740] ispUtil::_initialize: certificate created successfullyTRACE: [0xf6725740] ispUtil::itech_lib_init : itech SDK initialised successfully
TRACE: [0xf6725740] iClient::setSOTimeout : socket timeout set to [120]
TRACE: [0xf6725740] iClient::setSOTimeout : socket timeout set to [120]
Setting back end to "eemhost.example.com"
TRACE: [0xf6725740] iClient::setSOTimeout : socket timeout set to [1800]
TRACE: [0xf6725740] iClient::setSOTimeout : socket timeout set to [1800]
TRACE: [0xf6725740] ABC123 TCPCONNECT1 PORT ADDRESS [5250]
TRACE: [0xf6725740] ispUtil::TcpConnect: EINPROGRESS in connect() - selecting with a timeout(30)
TRACE: [0xf6725740] iClient::setSOTimeout : socket timeout set to [1800]
TRACE: [0xf6725740] iClient::setSOTimeout : socket timeout set to [1800]
Setting locale to "en_us"
TRACE: [0xf6725740] iClient::setSOTimeout : socket timeout set to [1800]
OK:Successfully Authenticated
TRACE: [0xf6725740] iClient::setSOTimeout : socket timeout set to [1800]
TRACE: [0xf6725740] iClient::setSOTimeout : socket timeout set to [1800]
TRACE: [0xf6725740] iClient::setSOTimeout : socket timeout set to [1800]
TRACE: [0xf6725740] iClient::setSOTimeout : socket timeout set to [1800]
TRACE: [0xf41fcb40] iClient::setSOTimeout : socket timeout set to [1800]
TRACE: [0xf41fcb40] iClient::setSOTimeout : socket timeout set to [1800]
TRACE: [0xf41fcb40] iClient::setSOTimeout : socket timeout set to [1800]
TRACE: [0xf41fcb40] Context.retrievedeltacacheobjects [ time taken : 1677554914 ms ]
TRACE: [0xf41fcb40] threadloop.privdeltacacheupdate took [ time taken : 62 ms ]
TRACE: [0xf41fcb40] threadloop.merging delta and cache file queue took [ time taken : 0 ms ]
TRACE: [0xf41fcb40] time taken to import into global queue [ time taken : 2 ms ]
TRACE: [0xf41fcb40] iClient::setSOTimeout : socket timeout set to [1800]
TRACE: [0xf41fcb40] iClient::setSOTimeout : socket timeout set to [1800]
TRACE: [0xf6725740] iClient::setSOTimeout : socket timeout set to [1800]
TRACE: [0xf6725740] attach time [ time taken : 1448763502 ms ]
OK: action[Attach] with ApplicationInstance label[WorkloadAutomationAE]
TRACE: [0xf6725740] iClient::setSOTimeout : socket timeout set to [1800]
TRACE: [0xf6725740] iClient::setSOTimeout : socket timeout set to [1800]
OK: action[Export] performed on object[ApplicationInstance] count[1]
TRACE: [0xf6725740] iClient::setSOTimeout : socket timeout set to [1800]
OK: action[Export] performed on object[Folder] count[6]
TRACE: [0xf6725740] iClient::setSOTimeout : socket timeout set to [1800]
ERROR: [0xf6725740] ispUtil.HttpPostRequest: select failed or timedout on recv [timeout : 1800]
ERROR: [0xf6725740] +_+_+_ispUtil::ReleasePC: peer closed
log4cxx: No appender could be found for logger (PozFactory).
log4cxx: Please initialize the log4cxx system properly.
TRACE: [0xf6725740] iClient::setSOTimeout : socket timeout set to [1800]
TRACE: [0xf6725740] ABC123 TCPCONNECT1 PORT ADDRESS [5250]
TRACE: [0xf6725740] ispUtil::TcpConnect: EINPROGRESS in connect() - selecting with a timeout(30)
TRACE: [0xf6725740] iClient::setSOTimeout : socket timeout set to [1800]
Current XML file location: line 3 column 237
error: action[Export] object[none] searchUserGroups
Safe Error: [EE_POZERROR Repository Error]
Sponsor Error: [ISE_SESSIONTIMEOUT session timed out]
Debug [Search Error: PozError]
Debug [PE_SPONSORERROR iSponsor Error]
Debug [pozFactory::searchObjects: error invoking iPoz::ObjectSearch on host eemhost.example.com]
Debug [object search failed]
Debug [ISE_SESSIONTIMEOUT session timed out]
TRACE: [0xf6725740] iClient::setSOTimeout : socket timeout set to [1800]
OK: action[Export] performed on object[User] count[29142]
TRACE: [0xf6725740] iClient::setSOTimeout : socket timeout set to [1800]
TRACE: [0xf6725740] ispUtil::TcpConnect: EINPROGRESS in connect() - selecting with a timeout(30)
OK: action[Detach] from ApplicationInstance label[WorkloadAutomationAE]
Encountered [1] error(s) processing XML data.
OK:Total objects Added 0
OK:Total objects Modified 0
OK:Total objects Removed 0
OK:Total objects Skipped 0
OK:Total objects Exported 29149

Cause

There is a hard coded sockettimeout in the iClient layer, with a maximum of 1800 seconds.

So, even if you increase this in the SDK configuration file to a higher value, the maximum is 1800seconds. In this case the customer had more than 700,000 application groups. Processing of these was taking time, almost 6 hours or more for it to work.

Resolution

Instead of using safex to export policies, use dxdumpdb command from CA Directory to export the policies into a CA Directory supported LDIF format. This is much better to use for exports and imports when there is lot of data to be processed.

Refer to How to generate LDIF backup file without shutting down the DSA for more information on dxdumpdb