-
Titel
When doing vastool commands, getting "ERROR: Could not communicate with vasd." -
Beschreibung
When doing vastool commands, getting "ERROR: Could not communicate with vasd." The problem is intermittent. It happens on multiple machines.
Also seeing the following while issue is occurring:
1 - Run as root:
/opt/quest/bin/vastool status or /opt/quest/libexec/vas/scripts/vas_status.sh
Produces the following:
FAILURE: 301 VAS cannot find a Domain Controller (DC) that it can communicate with.
Result: <Test(s) failed> (1 seconds)(v0.5.4)2 - ps -ef|grep vas
root 11104 1 0 08:01 ? 00:00:00 /opt/quest/sbin/vasd -p /var/opt/quest/vas/vasd/.vasd.pid
root 11131 1 0 08:02 ? 00:00:00 /opt/quest/sbin/vasgpd -p /var/opt/quest/vgp/vasgpd/.vasgpd.pid
daemon 11142 11104 0 08:02 ? 00:00:01 /opt/quest/sbin/vasd -p /var/opt/quest/vas/vasd/.vasd.pid
daemon 11161 11142 0 08:07 ? 00:00:00 [vasd] <defunct>
daemon 11162 11142 0 08:07 ? 00:00:00 [vasd] <defunct>
daemon 11163 11142 0 08:07 ? 00:00:00 [vasd] <defunct>
daemon 11164 11142 0 08:07 ? 00:00:00 [vasd] <defunct>
daemon 11165 11142 0 08:07 ? 00:00:00 [vasd] <defunct>
daemon 11166 11142 0 08:07 ? 00:00:00 [vasd] <defunct>
daemon 11167 11142 0 08:07 ? 00:00:00 [vasd] <defunct>
daemon 11168 11142 0 08:07 ? 00:00:00 [vasd] <defunct> -
Ursache
Machines were in a firewalled enviroment where they can reach 2 dc's out of 250, from 1 domain out of 8.
vasd was spending time trying to contact every dc in every domain to obtain password policy information for those domains. -
Lösung
1 - The below script will let you identify which domains are reachable and which are not:
D=`/opt/quest/bin/vastool -u host/ info domains`; echo Domains: $D; echo Reachable domains:; for d in $D; do for s in `/opt/quest/bin/vastool info servers -d $d -s \* | grep -v ^Servers`; do /opt/quest/bin/vastool info cldap $s 2>/dev/null | grep "Server Domain" | awk '{print $3}' & done 2>/dev/null ; done | sort | uniq; wait 2>/dev/null
2 - For each domain that is unreachable, block VAS from contacting it by running the followin command:
/opt/quest/bin/vastool configure vas vas_host_services stanza <domain> krb5name=badname/This tells QAS to use a principal different then host/ for contacting that domain, but since it cannot resolve badname/ into a good principal, it just fails, and will not contact the domain