PAM Database not replicating to cluster members

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

PAM reports the cluster as up, however members of the primary site do not show changes performed on the primary node.  An attempt to resync the site produces this error:

PAM-CMN-5099: Unable to find a member with an active database from the primary site

The secondary site shows a status of "Timeout" and produces the same error message on an attempt to resync the site member.

Environment

PAM 4.2.1 with some published hotfixes missing.

PAM 4.2.0 and 4.2.2 may be affected as well.

Cause

The cluster replication leader had the problem fixed in hotfix 4.2.1.10. As the list of hung processes grows and gets close to consuming all memory, the reduced resources can cause problems with various services leading to erratic behavior. In this case it broke the logic that determines if the replication leader role needs to move, and replication stopped working.

Resolution

If you are on PAM release 4.2.1, make sure to have at least hotfixes 4.2.1.10 and 4.2.1.19 applied. Our general recommendation is to apply all applicable published hotfixes.

For PAM release 4.2.2, published hotfixes 4.2.2.01 and 4.2.2.08 should be applied.

For PAM release 4.2.0, published hotfixes 4.2.0.64 and 4.2.0.68 should be applied.