After upgrade to 14.5, directory servers show Service Error:2

Products

• CA Identity Manager

Issue/Introduction

We are noticing more failed login attempts by our IDM integration account for past three days. Observing these are logged in one of the Directory logs - "corp store router summary" and below, given are the sample log entries

[0] 20240820.174811.994 #40163.000 (BIND) : XX.XX.XX.XX COM/TEST/CORPSTORE/PEOPLE/IMADMIN : Service Error 2
[4] 20240820.174812.003 #40164.000 (BIND) : XX.XX.XX.XX COM/TEST/CORPSTORE/PEOPLE/IMADMIN : Service Error 2
[0] 20240820.174812.010 #40165.000 (BIND) : XX.XX.XX.XX COM/TESTCORPSTORE/PEOPLE/IMADMIN : Service Error 2
[4] 20240820.174813.066 #40166.000 (BIND) : XX.XX.XX.XX COM/TEST/CORPSTORE/PEOPLE/IMADMIN : Service Error 2

These failures are only happening for a specific hour of day, like say 3 or 4 PM UTC. and we could see successful BINDs happening before and after this failure occurrence. All tasks are getting completed successfully and we don't see any issues/errors happening within IDM where this same integration account (IMADMIN) is used. But this is worrying us more because we see more login failures, like around 6K per day. Please help us understand why these failures are happening. We upgraded the IDM version from 14.4 CP2 to 14.5

Environment

Identity manager 14.5

Cause

14.5 moved CA directory to a new version:

https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/identity-manager/14-5/Release-Notes/release-features-and-enhancement/identity-manager-14-5.html#concept.dita_d3303fde-e786-4fd4-b0b6-e3a28fd60a82_Directory

 

 

This is the fixed defects list from 14.5:

https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/identity-manager/14-5/Release-Notes/fixed-defects/fixed-defects-14-5.html

 

Resolution

Symantec Directory Upgrade to 14.1 SP4

 

https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/directory/14-1/reference/commands-reference/set-max-users-command.html

 

Our Directory team's recommendation is to make the change incrementally

Since the current max-users value is 255, you can use something like 512 or 1024, and monitor the system. Then tune this setting accordingly.