Identity Manager Data Governance Edition 9.2.1 - Deployment Guide

Using your preferred database management tool, manually remove the Data Governance Resource Activity database.

The following troubleshooting tips are provided to assist you in deploying and configuring Data Governance Edition:

• Data Governance Edition logs
• Job queue shows that database needs to be compiled
• Receiving unauthorized access violations
• Cannot save the service account
• Cannot connect to a managed host
• DNS error when attempting to add a new managed host
• Agent not connecting to the Data Governance server
• Data Governance agents cannot access NAS devices via SMB
• Agent leases expiring
• Cannot add managed paths to my EMC server
• No activity data
• No activity data available for SharePoint 2010 managed host
• Resource activity is not displaying in the web portal for a business owner
• Governed resources are missing from the All my resources view in the web portal
• Not receiving scheduled reports
• Groups missing from the Group Memberships tree view

Additional troubleshooting tips may be found in the following guides:

• One Identity Manager Data Governance User Guide: Troubleshooting tips related to the day-to-day administration of Data Governance Edition
• One Identity Manager Data Governance IT Shop Resource Access Requests Guide: Troubleshooting tips related to self-service resource access requests and share creation requests.

The first place to look when you run into an issue with Data Governance Edition is the logs. The Data Governance Edition logs available are:

Data Governance configuration wizard log

Log name: Data Governance Configuration Wizard.exe.dlog

The Data Governance configuration wizard log is stored as a Trace log document (dlog) in the users AppData directory. For example: C:\Users\MyName.MyDomain\AppData\Local\One Identity\One Identity Manager\Data Governance Configuration Wizard\.

Used for capturing errors encountered while using the Data Governance Configuration wizard to deploy the Data Governance service and create the Resource Activity database.

Data Governance server log

Log name: DataGovernanceEdition. Service.exe.dlog

The server log is stored as a Trace log document (.dlog) in the Data Governance service installation directory. For example: %ProgramFiles%\One Identity\One Identity Manager Data Governance Edition\Server\.

Used for capturing the following information:

• Data Governance service communication
• Group resolution and group expansion
• Agent lease expiration information
• Points Of Interest (POI) collection information
• Resource activity updates
• Security changes made on a resource from the Manager
• Incoming web service calls related to Data Governance Edition from the One Identity Manager web site

Server logs can be viewed as described below:

• In the Manager, use the Get All Logs task to export the server log to a specified location. From that location, double-click the log file to view the log in the Log Viewer. For more information, see Getting server logs.
• From the Data Governance service machine, double-click the log file or right-click and select Open to view the log in the Log Viewer.

Applications and Services event logs

Severity error level events and audit events are written to the Applications and Services event logs on the Data Governance server under the "Data Governance" node.

• Severity error level errors have a "Source" of "Data Governance Edition".
• Audit events contain information on operations run by the server (such as security changes) and have a "Source" of "Data Governance Audit".

Data Governance agent deployment logs

Log name: <Agent name>_Agent.log

The agent deployment logs are stored as text files in the Agent Deployment Logs folder in the Data Governance service installation directory. For example: %ProgramFiles%\One Identity\One Identity Manager Data Governance Edition\Server\Agent Deployment Logs\.

Used for capturing the agent deployment process for each individual agent. There is a separate agent deployment log for each agent installed in your Data Governance Edition deployment.

Agent deployment logs can be viewed as described below:

• In the Manager, use the Get All Logs task to export the agent deployment logs to a specified location. From that location, double-click the log file to view the log. For more information, see Getting server logs.
• From the Data Governance service machine, double-click the log file or right-click and select Open to view the log.

Data Governance agent logs

Log name: DataGovernance.Agent.exe.dlog

An agent log is stored as a Trace log document (.dlog) in a subfolder on the host computer in the agent installation folder. For example:

%ProgramFiles%\One Identity\One Identity Manager Data Governance Edition\Agent Services\DGE_<DeploymentName>_<HostDnsName>\.

Used for logging communications, synchronization processes and data transfers between the Data Governance server and the agent.

Agent logs can be viewed as described below:

• From the Manager, use the Export agent log task to export the selected agent log to a specified location. From that location, double-click the log file to view the log in the Log Viewer. For more information, see Exporting agent log.
• From the agent machine, double-click the log file or right-click and select Open to view the log in the Log Viewer.

Web client logs

The Web client log files are located in the following directory: C:\inetpub\wwwroot\IdentityManager\App_Data\Logs.

This directory contains a series of log files all named with a time stamp.

Errors encountered with the web client IT Shop are recorded to the web client logs.

The best way to get the proper log is to replicate the issue and take the file with the greatest timestamp.

Job server logs

The default URL for a Job Server log is: http://JobServerHost:1880/Log

Often when you have errors with Active Directory synchronization or report execution you can find clues in the One Identity Manager Job Server logs. In addition, errors encountered with the process chains used to process resource access requests in the IT Shop are recorded in the Job Server logs.

With a default configuration, you can browse these logs by launching a web browser and navigating to a specific URL on the computer hosting the Job Server.

Manager client log

Log name: QAM.Client.Log.dlog

If experiencing issues with Data Governance Edition inside the Manager client, enable the Data Governance Edition client side logging to determine if the issue is related to the user interface rather than the Data Governance server.

The Manager client log files are located in the user profile directory:

C:\Users\<Your User Name>\AppData\Local\One Identity\One Identity Manager\Manager

From the Agents view in the Manager, you can export the agent log for the selected agents to a location of your choosing. The log files are exported through a background operation and will exist once the background operation has completed. The export operation can be viewed in the Background operations view.

To export an agent log

1. In the Navigation view, select Data Governance | Agents.
2. In the Agents view (right pane), select the required agents.
3. Select Export agent log from the Tasks view or right-click menu.

4. In the Browse for folder dialog, select the location where the exported logs are to be stored.

   A compressed zip file is created in the location specified. Clicking this zip file displays a trace log document for the selected agents.

5. Double-click the .dlog file to display the log viewer to view an agent's log entries.