-
Title
User override by group failing. ERROR: Failed, returned or signalled 3. build_useroverride_db: Unable to find user/group from entry -
Description
User override by group failing ERROR: Failed, returned or signalled 3
In the messages or syslog file you will see entries like this:
build_useroverride_db: Unable to find user/group from entry GROUP will re-process in 30 seconds -
Cause
CAUSE 1:
Invalid entries in the /etc/opt/quest/vas/user-override file. These can be syntax errors or entries containing users that do not exist.
CAUSE 2:
Product Defect: 367587 in QAS version 4.1.0.x :
Simple group name (samaccount name) in user-override fails if outside group-search-path
-
Resolution
RESOLUTION 1:1 - Cleanup the /etc/opt/quest/vas/user-override file and remove any invalid entries.
You can run . /opt/quest/libexec/vas/vasd/vas_ovrdupd to help you determine the bad entries. It will print messages like this:2015-10-06 16:55:54 [warn] (63159) build_useroverride_db: Unable to find user/group from entry will re-process in 30 seconds
TROUBLESHOOTING STEPS:To narrow down what entry in the user-override file is causing the error. Please do the following:
1 - /opt/quest/libexec/vas/sqlite3 /var/opt/quest/vas/vasd/vas_ident.vdb "SELECT *FROM user_ovrd" 2>&1 | tee /tmp/user_ovrd_db.outCompare the file to /tmp/user_ovrd_db.out with the /etc/opt/quest/vas/user-override file.2 - You can also run /opt/quest/libexec/vas/vasd/vas_ovrdupd -dg6 -f 2>&1 | tee /tmp/vasover.out to capture more information about what is happening.
FOR CAUSE 2:
For the defect in cause2, in the /etc/opt/quest/vas/user-override file has an entry simliar to this to override group where group specified does not have domain name in it:MY_Group:::4005:::/usr/bin/ksh
Also the setting group-search-path is set in the /etc/opt/quest/vas/vas.conf file
The MY_Group is outside of the group_search-path that is set. For the product defect the below workarounds can be put in place;.WORKAROUND1 :
1 - Add the domain name to the group
OR
WORKAROUND 2:
1 - Add the group's location to search base
STATUS: Fixed in 4.0.3.240 and 4.1.0.21112 and up.
RESOLUTION 2:
Upgrade to Authentication Services 4.1 Maintenance release.
-
Change Request
367587 -
Additional Information
If a single entry fails to process, we re-process everything, every 30 seconds, until everything succeeds therefore CPU will be slowed down.