Grouper Users - Open Discussion List

[Dave Churchley <>]

Thanks Shilen

Yes, this fixed it. It took a while to resync and then there was a lot in the 
changelog to be processed but it's got through all that and now it's working 
in (almost) real-time.

Thanks
Dave
 
>-----Original Message-----
>From: Shilen Patel 
>[mailto:]
>Sent: 16 December 2015 16:17
>To: Dave Churchley 
><>
>Subject: Re: [grouper-users] PSP incremental provisioning
>
>Yeah, if this was the only problem, then starting over would fix it.
>
>Thanks!
>
>- Shilen
>
>On 12/16/15, 11:12 AM, "Dave Churchley"
><>
>wrote:
>
>>We've just upgraded to 2.2.2.
>>
>>We deleted that group that was causing the error (it had no members
>>anyway) and reran it. It got further but errored on the memberships,
>>complaining about a duplicate key entry:
>>// Duplicate entry '1450278800661000-18530e591e7440d9b76ae937ae6c3cbc'
>>for key 'pit_gs_start_idx'
>>
>>We found an old email chain -
>>https://lists.internet2.edu/sympa/arc/grouper-users/2013-
>04/msg00146.html
>>- so we've followed the advice about starting over. The PIT sync script
>>is still running at the moment. Can we expect the incremental
>>provisioning to just work once that's finished?
>>
>>Thanks
>>Dave
>>
>>>-----Original Message-----
>>>From: Shilen Patel 
>>>[mailto:]
>>>Sent: 16 December 2015 15:51
>>>To: Dave Churchley 
>>><>;
>>> Chris Hyzer
>>><>;
>>> 
>>>
>>>Subject: Re: [grouper-users] PSP incremental provisioning
>>>
>>>If you run it again, can you send both the GSH output along with the logs
>>>in grouper_error.log?
>>>
>>>What version of Grouper are you running?
>>>
>>>Thanks!
>>>
>>>- Shilen
>>>
>>>On 12/16/15, 9:16 AM, "Dave Churchley"
><>
>>>wrote:
>>>
>>>>Hi Shilen
>>>>
>>>>Thanks for the response. No, the person isn't a member of the second
>>>>group in any other way.
>>>>
>>>>Here's the output from that gsh command:
>>>>
>>>>Number of entries in grouper_change_log_entry_temp: 0
>>>>
>>>>
>>>>Searching for missing active point in time fields
>>>>Found 0 missing active point in time fields
>>>>
>>>>
>>>>Searching for missing active point in time members
>>>>Found 27 missing active point in time members
>>>>Done making 27 updates
>>>>
>>>>
>>>>Searching for missing active point in time stems
>>>>Found 4 missing active point in time stems
>>>>Done making 4 updates
>>>>
>>>>
>>>>Searching for missing active point in time groups
>>>>Found 20 missing active point in time groups
>>>>Done making 20 updates
>>>>
>>>>
>>>>Searching for missing active point in time role sets
>>>>Found 0 missing active point in time role sets
>>>>
>>>>
>>>>Searching for missing active point in time attribute defs
>>>>Found 0 missing active point in time attribute defs
>>>>
>>>>
>>>>Searching for missing active point in time attribute def names
>>>>Found 0 missing active point in time attribute def names
>>>>
>>>>
>>>>Searching for missing active point in time attribute def name sets
>>>>Found 0 missing active point in time attribute def name sets
>>>>
>>>>
>>>>Searching for missing active point in time actions
>>>>Found 0 missing active point in time actions
>>>>
>>>>
>>>>Searching for missing active point in time action sets
>>>>Found 0 missing active point in time action sets
>>>>
>>>>
>>>>Searching for missing active point in time group sets
>>>>Found 115 missing active point in time group sets
>>>>// Error: unable to evaluate command: Sourced file: inline evaluation
>>>>of:
>>>>``new
>>>>edu.internet2.middleware.grouper.misc.SyncPITTables().syncAllPITTables
>()
>>>>;'
>>>>' : Method Invocation syncAllPITTables
>>>>// See error log for full stacktrace
>>>>// caused by: java.lang.RuntimeException:
>>>>// Active PITGroup with sourceId=6c3d287e253b4d3f8cc04a31547a713f
>not
>>>>found,
>>>>5 callables out of problem count 5 had problems running outside of
>>>>threads!
>>>>        at
>>>>edu.internet2.middleware.grouper.internal.dao.hib3.Hib3PITGroupDAO.fi
>nd
>>>ByS
>>>>ourceIdActive(Hib3PITGroupDAO.java:100)
>>>>        at
>>>>edu.internet2.middleware.grouper.misc.SyncPITTables.processMissingAc
>tiv
>>>ePI
>>>>TGroupSetsBatch(SyncPITTables.java:802)
>>>>        at
>>>>edu.internet2.middleware.grouper.misc.SyncPITTables.access$000(SyncPI
>TT
>>>abl
>>>>es.java:89)
>>>>        at
>>>>edu.internet2.middleware.grouper.misc.SyncPITTables$1.callLogic(SyncPI
>TT
>>>ab
>>>>les.java:743)
>>>>        at
>>>>edu.internet2.middleware.grouper.misc.SyncPITTables$1.callLogic(SyncPI
>TT
>>>ab
>>>>les.java:739)
>>>>        at
>>>>edu.internet2.middleware.grouper.util.GrouperCallable.tryCallablesWithP
>r
>>>>o
>>>b
>>>>lems(GrouperCallable.java:51)
>>>>        at
>>>>edu.internet2.middleware.grouper.misc.SyncPITTables.processMissingAc
>tiv
>>>ePI
>>>>TGroupSets(SyncPITTables.java:762)
>>>>        at
>>>>edu.internet2.middleware.grouper.misc.SyncPITTables.syncAllPITTables(S
>yn
>>>cP
>>>>ITTables.java:235)
>>>>        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
>>>>        at
>>>>sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorIm
>pl.
>>>java:
>>>>57)
>>>>        at
>>>>sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAcc
>es
>>>sorIm
>>>>pl.java:43)
>>>>        at java.lang.reflect.Method.invoke(Method.java:606)
>>>>        at bsh.Reflect.invokeMethod(Unknown Source)
>>>>        at bsh.Reflect.invokeObjectMethod(Unknown Source)
>>>>        at bsh.BSHPrimarySuffix.doName(Unknown Source)
>>>>        at bsh.BSHPrimarySuffix.doSuffix(Unknown Source)
>>>>        at bsh.BSHPrimaryExpression.eval(Unknown Source)
>>>>        at bsh.BSHPrimaryExpression.eval(Unknown Source)
>>>>        at bsh.Interpreter.eval(Unknown Source)
>>>>        at bsh.Interpreter.eval(Unknown Source)
>>>>        at bsh.Interpreter.eval(Unknown Source)
>>>>        at
>>>>edu.internet2.middleware.grouper.app.gsh.ShellHelper.eval(ShellHelper.
>ja
>>>>v
>>>a
>>>>:63)
>>>>        at
>>>>edu.internet2.middleware.grouper.app.gsh.GrouperShell.run(GrouperSh
>ell.
>>>jav
>>>>a:438)
>>>>        at
>>>>edu.internet2.middleware.grouper.app.gsh.GrouperShell.grouperShellHe
>lp
>>>er(G
>>>>rouperShell.java:232)
>>>>        at
>>>>edu.internet2.middleware.grouper.app.gsh.GrouperShell.main(GrouperS
>he
>>>ll.ja
>>>>va:162)
>>>>        at
>>>>edu.internet2.middleware.grouper.app.gsh.GrouperShellWrapper.main(
>Gro
>>>uperS
>>>>hellWrapper.java:31)
>>>>
>>>>
>>>>
>>>>
>>>>The group causing that error
>(sourceId=6c3d287e253b4d3f8cc04a31547a713f)
>>>>we can see in Grouper UI but it's not in the grouper_pit_groups table.
>>>>
>>>>Thanks
>>>>Dave
>>>>
>>>>
>>>>>-----Original Message-----
>>>>>From: 
>>>>>
>>>>> [
>>>>>]
>>>>> On Behalf Of Shilen Patel
>>>>>Sent: 16 December 2015 13:46
>>>>>To: Dave Churchley 
>>>>><>;
>>>>> Chris Hyzer
>>>>><>;
>>>>> 
>>>>>
>>>>>Subject: Re: [grouper-users] PSP incremental provisioning
>>>>>
>>>>>>> For example, we might have a group representing staff in a certain
>>>>>>>department which isn't provisioned to the AD. That group then might
>>>>>>>be
>>>>>>>a
>>>>>>>member of another group which is provisioned to the AD. If someone
>>>>>>>leaves the first group, they are automatically removed from the
>>>>>>>second
>>>>>>>group in Grouper but they are not being taken out of the AD group.
>>>>>
>>>>>Just making sure, the person isn't a member of the second group in any
>>>>>other way?
>>>>>
>>>>>It's possible that your point in time data is corrupt or out of sync.
>>>>>What's the output of the following?
>>>>>
>>>>>gsh 0% new
>>>>>edu.internet2.middleware.grouper.misc.SyncPITTables().syncAllPITTable
>s(
>>>>>)
>>>>>
>>>>>Thanks!
>>>>>
>>>>>- Shilen
>>>>>
>>>>>On 12/16/15, 5:26 AM, "Dave Churchley"
>>><>
>>>>>wrote:
>>>>>
>>>>>>Yeah, that's how it was set up, and there was no backlog, but
>>>>>>sometimes
>>>>>>things were going out of the temp table but not making into the change
>>>>>>log table.
>>>>>>
>>>>>>We've investigated this more this morning and it seems like it's
>>>>>>working
>>>>>>if we add/remove a member from a provisioned group and if we
>>>>>add/remove a
>>>>>>group from a provisioned group.
>>>>>>
>>>>>>It's not working when we add/remove a member from a group which is
>a
>>>>>>member of a provisioned group. For example, we might have a group
>>>>>>representing staff in a certain department which isn't provisioned to
>>>>>>the
>>>>>>AD. That group then might be a member of another group which is
>>>>>>provisioned to the AD. If someone leaves the first group, they are
>>>>>>automatically removed from the second group in Grouper but they are
>>>not
>>>>>>being taken out of the AD group. In those circumstances, we see an
>>>>>>entry
>>>>>>in the temp table which then disappears but nothing goes into the
>>>>>>change
>>>>>>log table.
>>>>>>
>>>>>>Thanks
>>>>>>Dave
>>>>>>
>>>>>>________________________________________
>>>>>>From: Chris Hyzer 
>>>>>><>
>>>>>>Sent: 15 December 2015 22:38
>>>>>>To: Dave Churchley; 
>>>>>>
>>>>>>Subject: RE: [grouper-users] PSP incremental provisioning
>>>>>>
>>>>>>You have to make sure the grouper loader is running, and there isn't a
>>>>>>backlog of things in the temp table.  The cron in the grouper loader
>>>>>>properties move things from temp to change log, and kicks off loader
>>>>>>jobs.  Not sure exactly how the PSP takes it from there, but that is
>>>>>>the
>>>>>>first step :)
>>>>>>
>>>>>>Thanks,
>>>>>>Chris
>>>>>>
>>>>>>-----Original Message-----
>>>>>>From: Dave Churchley 
>>>>>>[mailto:]
>>>>>>Sent: Tuesday, December 15, 2015 4:59 PM
>>>>>>To: Chris Hyzer; 
>>>>>>
>>>>>>Subject: Re: [grouper-users] PSP incremental provisioning
>>>>>>
>>>>>>Hi Chris
>>>>>>
>>>>>>When it works, I see an entry in the change log temp table move to the
>>>>>>change log table and get provisioned to AD.
>>>>>>
>>>>>>When it doesn't work, I've seen entries in change log temp which
>>>>>>haven't
>>>>>>made it to the change log table (but have still gone from the temp
>>>>>>table). I've also seen changes not appear in either table, although I
>>>>>>can't be completely certain that this wasn't just that I was too slow
>>>>>>looking in the temp table and they'd already moved out.
>>>>>>
>>>>>>On the occasions when the changes haven't made it into the change log
>>>>>>table, I've not seen anything in the logs.
>>>>>>
>>>>>>Thanks
>>>>>>Dave
>>>>>>
>>>>>>________________________________________
>>>>>>From: Chris Hyzer 
>>>>>><>
>>>>>>Sent: 15 December 2015 21:01
>>>>>>To: Dave Churchley; 
>>>>>>
>>>>>>Subject: RE: [grouper-users] PSP incremental provisioning
>>>>>>
>>>>>>When you make changes, do you see the entries in the change log
>temp
>>>>>>table move to the change log table?  Are there debug logs in the PSP
>>>>>>process that show anything?
>>>>>>
>>>>>>Thanks,
>>>>>>Chris
>>>>>>
>>>>>>-----Original Message-----
>>>>>>From: 
>>>>>>
>>>>>>[mailto:]
>>>>>> On Behalf Of Dave
>>>>>Churchley
>>>>>>Sent: Tuesday, December 15, 2015 2:56 PM
>>>>>>To: 
>>>>>>
>>>>>>Subject: [grouper-users] PSP incremental provisioning
>>>>>>
>>>>>>Hello
>>>>>>
>>>>>>We've had a bad couple of days with PSP provisioning to AD. Following
>>>>>>on
>>>>>>from the bulkSync issues I posted about yesterday, we're now seeing
>>>some
>>>>>>unexpected behaviour with the incremental provisioning. It works
>>>>>>sometimes but other times changes made through the Grouper UI
>don't
>>>>>make
>>>>>>it into the change log and so are not reflected in the AD.
>>>>>>
>>>>>>Is there an obvious reason for this? Am I missing something?
>>>>>>
>>>>>>Thanks
>>>>>>Dave Churchley
>>>>>>Newcastle University
>>>>
>>