Symantec Directory : Crowdstrike and Symantec Directory DSAs

Products

• CA Identity Manager
• CA Directory
• SITEMINDER
• CA Identity Suite

Issue/Introduction

After the recent Crowdstrike problem, the Symantec Directory DSAs are failing to start on Windows with one of the following two situations.

Running 'dxserver start <dsaname>' at the command prompt reports:

Datastore inconsistent

OR

Reviewing the DSA's 'alarm' or 'trace' log reports:

DSA is attempting to start after a long outage, perform a recovery procedure before starting

NOTE: The DSA can be any of the following:

• IDM Provisioning Directory services (hostname-impd-main, hostname-impd-inc, hostname-impd-co, hostname-impd-notify)
• IDM User Store service (name can be anything as it is not governed unless it's a vAPP)
• SiteMinder/SSO (name can be anything for DSAs such as Session Store, Policy Store, User Store and Key Store)

Resolution

For "Datastore inconsistent"

simply attempt to start the DSA with 'forcestart' option from command prompt. This error of 'inconsistency' happens the there is a PID file left behind and a DSA is attempted to start. The 'forcestart' option is designed to delete any old/previous PID file and should start the DSA service successfully.

e.g. dxserver forcestart <dsaname>

Reference:
Control DSAs by Using a Command Line

See section titled "Force an Inconsistent DSA to Start Using Command Line"

For "DSA is attempting to start after a long outage, perform a recovery procedure before starting"

Making 100% sure that it happened due to Crowdstrike, it can be simply addressed by running 'dxdisp' command on ALL those DSAs on ALL NODES. No full recovery is needed.

e.g.
Node1 is running: node1-impd-main, node1-impd-inc, node1-impd-co, node1-impd-notify
Node2 is running: node2-impd-main, node2-impd-inc, node2-impd-co, node2-impd-notify
Node3 is running: node3-impd-main, node3-impd-inc, node3-impd-co, node3-impd-notify

Run the following 12 commands on ALL three nodes at the command prompt and attempt to start the DSAs. Copy all of them at onces and execute at the command prompt (last command will require to hit the 'Enter' key)

dxdisp node1-impd-main
dxdisp node1-impd-inc
dxdisp node1-impd-co
dxdisp node1-impd-nodify
dxdisp node2-impd-main
dxdisp node2-impd-inc
dxdisp node2-impd-co
dxdisp node2-impd-nodify
dxdisp node3-impd-main
dxdisp node3-impd-inc
dxdisp node3-impd-co
dxdisp node3-impd-nodify

Once done, run 'dxserver start all' command at the command prompt on ALL 3 nodes.