PAM Verify Accounts (Run Once) Job Appears Stuck

Products

• CA Privileged Access Manager (PAM)

Issue/Introduction

A "Verify Accounts" (Run Once) job appears to be stuck in the UI and does not show as completed in the Scheduled Jobs report. Even after a significant amount of time has passed, the job remains visible in the active jobs list.

Cause

This issue is typically not caused by a system failure or hung process. Instead, it is caused by a large number of target accounts resulting in errorCode=406 (unable to communicate with the remote host).

When PAM attempts to verify an account on a remote server that is unreachable, it must wait for the connection to time out before it can proceed to the next account. When processing thousands of accounts, the cumulative wait time for these timeouts causes the job to run significantly longer than expected, giving the appearance that the process has hung.

Resolution

1. Monitor via Log Integration (Splunk/Syslog): For real-time visibility into why jobs are stalling, integrate your PAM logs with a log management tool like Splunk or Syslog. You can create alerts or reports using the following specific log patterns to identify problematic accounts:

   • Search String: type=verifyAccountPassword
   • Filter String: errorCode=406
   • Example query: type=verifyAccountPassword TargetAccount_userName=<Account Name> errorCode=406

   Using these strings allows you to quickly isolate the exact target accounts that are failing to communicate, allowing you to proactively resolve network or firewall issues.

2. Address Unresponsive Target Servers: Once you have identified the list of target accounts returning errorCode=406, investigate their network connectivity. These servers are likely decommissioned, offline, or blocked by firewall rules. Addressing connectivity for these specific targets will resolve the timeouts and significantly reduce future job duration.

3. Allow Job Completion: Once the job processes all remaining accounts—including the time required for the connection timeouts—the job will automatically clear from the UI.