12 Replies Latest reply on Apr 28, 2016 6:18 AM by Jason Scarlett

    When "Sync Active Directory Group" fails, how do I tell which group it was?

    Jason Scarlett
    Jason Scarlett Mar 31, 2016 1:13 PM

      We have a number of AD groups that are failing to sync since an upgrade to 9.2.6. From the status dashboard "BackgroundTasksforNonExtracts" we can see the failures, but can not tell which groups they are. I've tried looking through "Background Tasks" postgres table but can't see the name of the group there either.

       

      Any ideas on how to get a list of the AD groups that are failing to sync (so we can see if there is something in common causing the failures)?

        • 1. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
          Andrew Macey
          Andrew Macey Apr 6, 2016 11:20 AM (in response to Jason Scarlett)

          Works fine for me in 9.1 when I mouse-over the error under Server > Background Tasks for Non Extracts.

          6-Apr-16 update:

          - Scheduled AD sync detail is in the backgrounder logs under ....\Tableau\Tableau Server\data\tabsvc\logs\backgrounder\backgrounder-*

          - Manual AD sync detail is in the portal logs under ..\Tableau\Tableau Server\data\tabsvc\logs\vizportal\vizportal-* logs

          AD-Sync-failed.png

          1 of 1 people found this helpful
          • 2. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
            Jason Scarlett
            Jason Scarlett Apr 1, 2016 7:42 PM (in response to Andrew Macey)

            We're on v9.2.6 and this is the display I get.

            The backgrounder log does show more details .... but I wish the tooltip and the postgres listed the group like it used to in previous versions .. digging through the log file to find this is a bit tedious.

             

            2016-04-01 18:02:06.980 -0600 (Default,,,) pool-2-thread-1 : INFO  com.tableausoftware.model.workgroup.workers.SyncSingleActiveDirectoryGroupWorker - Started AD group sync: name=[AHS.PACS.QATechStats], domain=[healthy.bewell.ca], siteId=[1] with siteRole [Interactor]

            2016-04-01 18:02:06.980 -0600 (,,,) scheduled-background-job-runner-1 : INFO  com.tableausoftware.backgrounder.runner.BackgroundJobRunner - Running job of type :sync_ad_group; no timeout; priority: 10; id: 1289365; args: [AHS.PACS.QATechStats, healthy.bewell.ca, INTERACTOR]

            2016-04-01 18:02:06.980 -0600 (Default,,,) pool-2-thread-1 : INFO  com.tableausoftware.domain.user.service.SyncWithActiveDirectoryLogic - SyncStarted : starting import for group AHS.PACS.QATechStats in domain healthy.bewell.ca with sitrole Interactor and sysadmin flag null

            2016-04-01 18:02:08.105 -0600 (,,,) scheduled-background-job-runner-1 : ERROR com.tableausoftware.backgrounder.runner.BackgroundJobRunner - Error executing backgroundjob: :sync_ad_group

            java.util.concurrent.ExecutionException: java.lang.NullPointerException

              at java.util.concurrent.FutureTask.report(FutureTask.java:122)

              at java.util.concurrent.FutureTask.get(FutureTask.java:206)

              at com.tableausoftware.backgrounder.runner.BackgroundJobRunner.executeNextJob(BackgroundJobRunner.java:336)

              at com.tableausoftware.backgrounder.runner.BackgroundJobRunner.executeJobs(BackgroundJobRunner.java:277)

              at com.tableausoftware.backgrounder.config.BackgroundJobRunnerSchedulingConfig$1.run(BackgroundJobRunnerSchedulingConfig.java:46)

              at org.springframework.scheduling.support.DelegatingErrorHandlingRunnable.run(DelegatingErrorHandlingRunnable.java:54)

              at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)

              at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:308)

              at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:180)

              at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:294)

              at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)

              at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)

              at java.lang.Thread.run(Thread.java:745)

            Caused by: java.lang.NullPointerException

            2016-04-01 18:02:08.136 -0600 (Default,,,) pool-2-thread-1 : INFO  com.tableausoftware.model.workgroup.workers.SyncSingleActiveDirectoryGroupWorker - Started AD group sync: name=[AHS.PACS.QARadStats], domain=[healthy.bewell.ca], siteId=[1] with siteRole [Unlicensed]

            2016-04-01 18:02:08.136 -0600 (,,,) scheduled-background-job-runner-1 : INFO  com.tableausoftware.backgrounder.runner.BackgroundJobRunner - Running job of type :sync_ad_group; no timeout; priority: 10; id: 1289366; args: [AHS.PACS.QARadStats, healthy.bewell.ca, UNLICENSED]

            2016-04-01 18:02:08.136 -0600 (Default,,,) pool-2-thread-1 : INFO  com.tableausoftware.domain.user.service.SyncWithActiveDirectoryLogic - SyncStarted : starting import for group AHS.PACS.QARadStats in domain healthy.bewell.ca with sitrole Unlicensed and sysadmin flag null

            2016-04-01 18:02:08.183 -0600 (Default,,,) pool-2-thread-1 : INFO  com.tableausoftware.domain.user.service.SyncWithActiveDirectoryLogic - Syncing 3 users for active directory group healthy.bewell.ca\AHS.PACS.QARadStats

            2016-04-01 18:02:08.246 -0600 (Default,,,) pool-2-thread-1 : INFO  com.tableausoftware.domain.user.service.SyncWithActiveDirectoryLogic - SyncComplete: Added 0 users to the active directory group healthy.bewell.ca\AHS.PACS.QARadStats with 0 users  not getting upgraded siteRole due to shortage of licenses. 0 had their data updated and 0 had their siterole updated and 0 were removed from group.

            2016-04-01 18:02:08.246 -0600 (Default,,,) pool-2-thread-1 : INFO  com.tableausoftware.model.workgroup.workers.SyncSingleActiveDirectoryGroupWorker - Finished AD group sync: name=[AHS.PACS.QARadStats], domain=[healthy.bewell.ca], siteId=[1] with siteRole [Unlicensed]

            2016-04-01 18:02:08.246 -0600 (,,,) scheduled-background-job-runner-1 : INFO  com.tableausoftware.backgrounder.runner.BackgroundJobRunner - Job finished: SUCCESS; name: Sync Active Directory Group; type :sync_ad_group; notes: null; total time: 87 sec; run time: 0 sec

            • 3. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
              Toby Erkson
              Toby Erkson Ambassador Apr 4, 2016 7:31 AM (in response to Jason Scarlett)

              Depending upon how many AD groups you have you could try each one manually until you find the one that fails:

              • 4. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
                Toby Erkson
                Toby Erkson Ambassador Apr 4, 2016 7:35 AM (in response to Jason Scarlett)

                *** is "Caused by: java.lang.NullPointerException".  I see that **** "...NullPointException" in other errors and it means NOTHING TO ME!  It sure would be helpful if software developers captured and used meaningful error messages

                • 5. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
                  Matt Coles
                  Matt Coles Employee Apr 4, 2016 7:44 AM (in response to Jason Scarlett)

                  Hey Jason, even if there is a legitimate reason that Server is unable to sync the group, the fact that it's not returning a meaningful error message means it should be considered a bug. Would you mind submitting this to Support? You can try and work around it in the meantime, of course, I just want to make sure we get to the root cause and get it fixed. No one should have to deal with cryptic, non-actionable errors like this.

                   

                  thanks!

                  • 6. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
                    Jason Scarlett
                    Jason Scarlett Apr 4, 2016 8:03 AM (in response to Matt Coles)

                    I have submitted it to Support and am hoping for a Webex session today.

                     

                    In my continued digging, groups of 908 and less work fine and groups with 1011 or more members fail. This error only happened after an upgrade from 9.2.0 to 9.2.6.

                    • 7. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
                      Jason Scarlett
                      Jason Scarlett Apr 6, 2016 8:13 AM (in response to Jason Scarlett)

                      After working with Tableau Customer Support we learned that:

                      • The AD group sync failure occurs only in 9.2.6 (possibly 8.X.X released at the same time)
                      • The non descriptive error also only appears in 9.2.6
                      • The AD group sync issue was resolved when we upgraded to 9.2.7.

                       

                      To answer the initial question, the idea by Andrew Macey of looking in the backgrounder log files (....\Tableau\Tableau Server\data\tabsvc\logs\backgrounder\backgrounder-*) worked to help me find the AD group that was failing.

                       

                      1 of 1 people found this helpful
                      • 8. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
                        Todd Schnack
                        Todd Schnack Apr 13, 2016 8:34 AM (in response to Jason Scarlett)

                        Thank you for posting this! I have spent two long days so far trying to work through the Group Sync issues we are seeing:

                        1. some users in the AD group are not being created in Tableau even though those users are not in system_users or users (though, by querying the hist_users table, I did find that those users had at one time been created in Tableau but had since been deleted ... not sure why the Group Sync process would look at hist_users to determine which users to create or not ...)
                        2. the sync job adds new users to the server/site BUT shows an "error" in the "Background Jobs for Non-Extracts" report AND then does not add those new users to the Tableau Server group

                         

                        It sounds like 9.2.7 may have fixed some of the issues (we are currently on 9.2.4). That is the good news. The BAD news is that there is NOTHING in the 9.2.5 | Tableau Software 9.2.6 | Tableau Software  9.2.7 | Tableau Software release notes that mention any corrected issues related to Group Sync AND there are no open issues listed on Known Issues | Tableau Software relating to Group Sync (other than the "In Tableau Server general settings, the "Synchronize All Groups" action only synchronized a group on one site if the same group existed in multiple sites.").

                        • 9. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
                          Todd Schnack
                          Todd Schnack Apr 13, 2016 8:48 AM (in response to Toby Erkson)

                          AMEN brother. Starting to see that very-unhelpful "Caused by: java.lang.NullPointerException" error show up in many different types of jobs (mostly extract refreshes). It would be very helpful if 1) Tableau could provide guidance on what we admins are to do when we see that and 2) return more specific error messages ...

                          • 10. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
                            Todd Schnack
                            Todd Schnack Apr 26, 2016 10:01 AM (in response to Todd Schnack)

                            UPDATE: we upgraded from 9.2.4 to 9.2.7 and the AD Group Sync is still having issues (only some of the group's users are being processed by Tableau Server, the job errors out without any error details, and none of the users are added to the Tableau Server group being synced).

                             

                            When running the sync via tabcmd, no errors are returned BUT, while the tabcmd results show the correct # of users in the Active Directory group ("Users in Active Directory group: 129") and it doesn't return an error, it doesn't add / skip them all AND the users that are processed are not added to the group (they are just added as system/site users).

                             

                            When syncing via the "Synchronize" button on the Server group page, it appears to only process the same # of users as the "tabcmd" method BUT the background task DOES end with a status of "Error". However, no details of the error are shown on the errored job's pop-up in the "Background Tasks for Non Extracts" page.

                             

                            I am now going to dig into the log files (vizportal-0.log) to see what I can find ...

                             

                            Thank you!

                            • 11. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
                              Todd Schnack
                              Todd Schnack Apr 26, 2016 1:14 PM (in response to Jason Scarlett)

                              Hi Jason - regarding your issue "groups of 908 and less work fine and groups with 1011 or more members fail", I am wondering if it is related to any of the vizportal-related configuration options. Several of them have a default value of "1,000" (vizportal.assign_permissions_to_contents.page_size, vizportal.max_active_directory_group_search_result, vizportal.max_page_size) and one in particular (vizportal.max_active_directory_group_search_result) may be causing your issue. Consider bumping it up to 1,500 and see if the groups larger than 1,000 (but less than 1,501 obv) sync successfully.

                              • 12. Re: When "Sync Active Directory Group" fails, how do I tell which group it was?
                                Jason Scarlett
                                Jason Scarlett Apr 28, 2016 6:18 AM (in response to Todd Schnack)

                                Hi Todd,

                                Here are my values in 9.2.7 (same as they were in 9.2.6):

                                • vizportal.assign_permissions_to_contents.page_size: 1000
                                • vizportal.max_active_directory_group_search_result: 1000
                                • vizportal.max_page_size: 1000

                                 

                                Though, my take on it is that these values would affect the web interface, but shouldn't affect the back end sync. We have groups that are 10,000+ and they are all syncing fine since the upgrade to 9.2.7.