Unable to Sync all new Users and groups in VMware Identity Manager.

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Not all users and groups are present in VMware Identity manager 3.3.7 UI from an already configured Directory. When an administrator attempts to perform a manual Inventory sync on the directory, the process completes but zero new users and groups are added.

In the Integrated Components section of the System diagnostic dashboard we can see that OpenSearch Service has Unknown status.

Upon restarting the Opensearch service manually in the /opt/vmware/opensearch/logs/horizon.log we see:
Exception: Unable to upgrade the mappings for the index <index_id>

 

Environment

VMware Identity Manager 3.3.7

Cause

OpenSearch service is not running 

Resolution

Prerequisite: Before proceeding, take snapshots of all vIDM nodes in the vCenter Server environment.

1. Access the affected node: SSH to the VMware Identity Manager node experiencing the Opensearch issue using the root account.
2. Attempt OpenSearch Restart:
   • Try restarting the OpenSearch service and verify its status using the following commands:

     /etc/init.d/opensearch restart
     /etc/init.d/opensearch status

3. Check Logs and Reindex (if restart fails):
   • If OpenSearch fails to start, check the logs at /opt/vmware/opensearch/logs/horizon.log.
   • If the above exception is observed, attempt to manually reindex using the command provided in the resolution section of the following KB article: Unable to search certain users & groups in vIDM UI or assign users & groups to policies.
4. Remove Corrupted Indices (if reindexing doesn't work):
   • If reindexing is unsuccessful and the error persists after attempting to restart in Step 2, remove the corrupted indices one by one:

     rm -rf /db/opensearch/horizon/<index-id>

   • To remove all indices: If numerous corrupted indices are present (indicated in the log when the service fails to start), you can remove all indices with the command below.
     Note: Only run this command if old audit-related data is not required, as it will delete all indices.

     rm -rf /db/opensearch/horizon

5. Final Restart and Verification:
   • Restart the Opensearch service and verify the status:

     /etc/init.d/opensearch start
     /etc/init.d/opensearch status

   • Opensearch should now be running successfully.
6. Restart Horizon Services:
   • Restart the horizon-services to complete the process:

     service horizon-workspace restart