-
1. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
Andrew Macey Apr 6, 2016 11:20 AM (in response to Jason Scarlett)1 of 1 people found this helpfulWorks fine for me in 9.1 when I mouse-over the error under Server > Background Tasks for Non Extracts.
6-Apr-16 update:
- Scheduled AD sync detail is in the backgrounder logs under ....\Tableau\Tableau Server\data\tabsvc\logs\backgrounder\backgrounder-*
- Manual AD sync detail is in the portal logs under ..\Tableau\Tableau Server\data\tabsvc\logs\vizportal\vizportal-* logs
-
2. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
Jason Scarlett Apr 1, 2016 7:42 PM (in response to Andrew Macey)We're on v9.2.6 and this is the display I get.
The backgrounder log does show more details .... but I wish the tooltip and the postgres listed the group like it used to in previous versions .. digging through the log file to find this is a bit tedious.
2016-04-01 18:02:06.980 -0600 (Default,,,) pool-2-thread-1 : INFO com.tableausoftware.model.workgroup.workers.SyncSingleActiveDirectoryGroupWorker - Started AD group sync: name=[AHS.PACS.QATechStats], domain=[healthy.bewell.ca], siteId=[1] with siteRole [Interactor]
2016-04-01 18:02:06.980 -0600 (,,,) scheduled-background-job-runner-1 : INFO com.tableausoftware.backgrounder.runner.BackgroundJobRunner - Running job of type :sync_ad_group; no timeout; priority: 10; id: 1289365; args: [AHS.PACS.QATechStats, healthy.bewell.ca, INTERACTOR]
2016-04-01 18:02:06.980 -0600 (Default,,,) pool-2-thread-1 : INFO com.tableausoftware.domain.user.service.SyncWithActiveDirectoryLogic - SyncStarted : starting import for group AHS.PACS.QATechStats in domain healthy.bewell.ca with sitrole Interactor and sysadmin flag null
2016-04-01 18:02:08.105 -0600 (,,,) scheduled-background-job-runner-1 : ERROR com.tableausoftware.backgrounder.runner.BackgroundJobRunner - Error executing backgroundjob: :sync_ad_group
java.util.concurrent.ExecutionException: java.lang.NullPointerException
at java.util.concurrent.FutureTask.report(FutureTask.java:122)
at java.util.concurrent.FutureTask.get(FutureTask.java:206)
at com.tableausoftware.backgrounder.runner.BackgroundJobRunner.executeNextJob(BackgroundJobRunner.java:336)
at com.tableausoftware.backgrounder.runner.BackgroundJobRunner.executeJobs(BackgroundJobRunner.java:277)
at com.tableausoftware.backgrounder.config.BackgroundJobRunnerSchedulingConfig$1.run(BackgroundJobRunnerSchedulingConfig.java:46)
at org.springframework.scheduling.support.DelegatingErrorHandlingRunnable.run(DelegatingErrorHandlingRunnable.java:54)
at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180)
at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
Caused by: java.lang.NullPointerException
2016-04-01 18:02:08.136 -0600 (Default,,,) pool-2-thread-1 : INFO com.tableausoftware.model.workgroup.workers.SyncSingleActiveDirectoryGroupWorker - Started AD group sync: name=[AHS.PACS.QARadStats], domain=[healthy.bewell.ca], siteId=[1] with siteRole [Unlicensed]
2016-04-01 18:02:08.136 -0600 (,,,) scheduled-background-job-runner-1 : INFO com.tableausoftware.backgrounder.runner.BackgroundJobRunner - Running job of type :sync_ad_group; no timeout; priority: 10; id: 1289366; args: [AHS.PACS.QARadStats, healthy.bewell.ca, UNLICENSED]
2016-04-01 18:02:08.136 -0600 (Default,,,) pool-2-thread-1 : INFO com.tableausoftware.domain.user.service.SyncWithActiveDirectoryLogic - SyncStarted : starting import for group AHS.PACS.QARadStats in domain healthy.bewell.ca with sitrole Unlicensed and sysadmin flag null
2016-04-01 18:02:08.183 -0600 (Default,,,) pool-2-thread-1 : INFO com.tableausoftware.domain.user.service.SyncWithActiveDirectoryLogic - Syncing 3 users for active directory group healthy.bewell.ca\AHS.PACS.QARadStats
2016-04-01 18:02:08.246 -0600 (Default,,,) pool-2-thread-1 : INFO com.tableausoftware.domain.user.service.SyncWithActiveDirectoryLogic - SyncComplete: Added 0 users to the active directory group healthy.bewell.ca\AHS.PACS.QARadStats with 0 users not getting upgraded siteRole due to shortage of licenses. 0 had their data updated and 0 had their siterole updated and 0 were removed from group.
2016-04-01 18:02:08.246 -0600 (Default,,,) pool-2-thread-1 : INFO com.tableausoftware.model.workgroup.workers.SyncSingleActiveDirectoryGroupWorker - Finished AD group sync: name=[AHS.PACS.QARadStats], domain=[healthy.bewell.ca], siteId=[1] with siteRole [Unlicensed]
2016-04-01 18:02:08.246 -0600 (,,,) scheduled-background-job-runner-1 : INFO com.tableausoftware.backgrounder.runner.BackgroundJobRunner - Job finished: SUCCESS; name: Sync Active Directory Group; type :sync_ad_group; notes: null; total time: 87 sec; run time: 0 sec
-
4. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
Toby ErksonApr 4, 2016 7:35 AM (in response to Jason Scarlett)
*** is "Caused by: java.lang.NullPointerException". I see that **** "...NullPointException" in other errors and it means NOTHING TO ME! It sure would be helpful if software developers captured and used meaningful error messages
-
5. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
Matt ColesApr 4, 2016 7:44 AM (in response to Jason Scarlett)
Hey Jason, even if there is a legitimate reason that Server is unable to sync the group, the fact that it's not returning a meaningful error message means it should be considered a bug. Would you mind submitting this to Support? You can try and work around it in the meantime, of course, I just want to make sure we get to the root cause and get it fixed. No one should have to deal with cryptic, non-actionable errors like this.
thanks!
-
6. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
Jason Scarlett Apr 4, 2016 8:03 AM (in response to Matt Coles)I have submitted it to Support and am hoping for a Webex session today.
In my continued digging, groups of 908 and less work fine and groups with 1011 or more members fail. This error only happened after an upgrade from 9.2.0 to 9.2.6.
-
7. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
Jason Scarlett Apr 6, 2016 8:13 AM (in response to Jason Scarlett)1 of 1 people found this helpfulAfter working with Tableau Customer Support we learned that:
- The AD group sync failure occurs only in 9.2.6 (possibly 8.X.X released at the same time)
- The non descriptive error also only appears in 9.2.6
- The AD group sync issue was resolved when we upgraded to 9.2.7.
To answer the initial question, the idea by Andrew Macey of looking in the backgrounder log files (....\Tableau\Tableau Server\data\tabsvc\logs\backgrounder\backgrounder-*) worked to help me find the AD group that was failing.
-
8. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
Todd Schnack Apr 13, 2016 8:34 AM (in response to Jason Scarlett)Thank you for posting this! I have spent two long days so far trying to work through the Group Sync issues we are seeing:
- some users in the AD group are not being created in Tableau even though those users are not in system_users or users (though, by querying the hist_users table, I did find that those users had at one time been created in Tableau but had since been deleted ... not sure why the Group Sync process would look at hist_users to determine which users to create or not ...)
- the sync job adds new users to the server/site BUT shows an "error" in the "Background Jobs for Non-Extracts" report AND then does not add those new users to the Tableau Server group
It sounds like 9.2.7 may have fixed some of the issues (we are currently on 9.2.4). That is the good news. The BAD news is that there is NOTHING in the 9.2.5 | Tableau Software 9.2.6 | Tableau Software 9.2.7 | Tableau Software release notes that mention any corrected issues related to Group Sync AND there are no open issues listed on Known Issues | Tableau Software relating to Group Sync (other than the "In Tableau Server general settings, the "Synchronize All Groups" action only synchronized a group on one site if the same group existed in multiple sites.").
-
9. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
Todd Schnack Apr 13, 2016 8:48 AM (in response to Toby Erkson)AMEN brother. Starting to see that very-unhelpful "Caused by: java.lang.NullPointerException" error show up in many different types of jobs (mostly extract refreshes). It would be very helpful if 1) Tableau could provide guidance on what we admins are to do when we see that and 2) return more specific error messages ...
-
10. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
Todd Schnack Apr 26, 2016 10:01 AM (in response to Todd Schnack)UPDATE: we upgraded from 9.2.4 to 9.2.7 and the AD Group Sync is still having issues (only some of the group's users are being processed by Tableau Server, the job errors out without any error details, and none of the users are added to the Tableau Server group being synced).
When running the sync via tabcmd, no errors are returned BUT, while the tabcmd results show the correct # of users in the Active Directory group ("Users in Active Directory group: 129") and it doesn't return an error, it doesn't add / skip them all AND the users that are processed are not added to the group (they are just added as system/site users).
When syncing via the "Synchronize" button on the Server group page, it appears to only process the same # of users as the "tabcmd" method BUT the background task DOES end with a status of "Error". However, no details of the error are shown on the errored job's pop-up in the "Background Tasks for Non Extracts" page.
I am now going to dig into the log files (vizportal-0.log) to see what I can find ...
Thank you!
-
11. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
Todd Schnack Apr 26, 2016 1:14 PM (in response to Jason Scarlett)Hi Jason - regarding your issue "groups of 908 and less work fine and groups with 1011 or more members fail", I am wondering if it is related to any of the vizportal-related configuration options. Several of them have a default value of "1,000" (vizportal.assign_permissions_to_contents.page_size, vizportal.max_active_directory_group_search_result, vizportal.max_page_size) and one in particular (vizportal.max_active_directory_group_search_result) may be causing your issue. Consider bumping it up to 1,500 and see if the groups larger than 1,000 (but less than 1,501 obv) sync successfully.
-
12. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
Jason Scarlett Apr 28, 2016 6:18 AM (in response to Todd Schnack)Hi Todd,
Here are my values in 9.2.7 (same as they were in 9.2.6):
- vizportal.assign_permissions_to_contents.page_size: 1000
- vizportal.max_active_directory_group_search_result: 1000
- vizportal.max_page_size: 1000
Though, my take on it is that these values would affect the web interface, but shouldn't affect the back end sync. We have groups that are 10,000+ and they are all syncing fine since the upgrade to 9.2.7.