| As discussed in Chapter 7, "Diagnostic and Repair Tools," there are a number of Novell-supplied tools that you can use to diagnose and troubleshoot NDS/eDirectory error conditions. In many cases, these tools may not be the most convenient to use, but the server-based utilities are often the most effective because frequently the error is confined to a given server in a replica ring. In addition, server-centric information is useful, and you simply cannot obtain it by using a workstation-based tool. The following sections discuss using the Novell server-based tools to diagnose and troubleshoot DS errors. Use NDS iMonitor to Diagnose and Monitor NDS iMonitor first shipped with eDirectory 8.5 and is available for all supported operating system platforms. It provides a Web-based portal for accessing server-centric eDirectory information, using a Web browser from any workstation on the network. NOTE NDS iMonitor is installed automatically as part of the eDirectory installation process.
You don't need to hunt through a number of different screens in DSRepair and DSBrowse for the necessary information because NDS iMonitor presents you with the easy-to-locate data about a partition, a replica, or a server. Figure 9.1 shows the synchronization status for a partition; you can obtain the server-centric replica status (see Figure 9.2) by clicking the Replica Synchronization link to the right of the partition name. By clicking the NCP server object name in the Replica Status screen, you can retrieve information about the server. Figure 9.1. The partition synchronization status screen. 
Figure 9.2. The Replica Status screen. 
When diagnosing a DS problem, you generally make use of the Partition Synchronization and Replica Synchronization screens in NDS iMonitor. You start by looking at the big picture at the partition level. When you notice a partition showing a nonzero error count, you can drill down to the replica level. From there, you can examine each of the servers in the replica ring that are reporting DS errors. Depending on your screen resolution, you might need to scroll to the far right of the entry in order to see the error code. Then you click the error code listed to see its meaning, possible causes, and possible actions to take. You can also enable DSTrace with various filter settings to gather additional diagnostic information (see Figure 9.3). Figure 9.3. The DSTrace configuration screen. 
NOTE The number of features (such as DSTrace) and amount of information you can see in NDS iMonitor depend on the DS username (thus access rights you have in the tree) you used to access the application. Some options (such as DIB caching information) may not be available, depending on the version of the NDS /eDirectory agent you are monitoring.
When trace is enabled, you can use the additional Live Trace link to view the DSTrace messages in real-time, as shown in Figure 9.4. You can adjust how often the screen is updated; the default is every 15 seconds. Figure 9.4. Live DSTrace messages. 
NOTE When working with an NDS /eDirectory server in NDS iMonitor's proxy mode, you will not be able to access the DSTrace, DSRepair, and Background Process Schedule options. For more information about the proxy mode, refer to Chapter 7 .
You can also use the Agent Health link and its sublinks to get a quick overview of the status of the partitions and local replicas. Figure 9.5 shows the overall health status of the local DS agent (DSA). Figure 9.5. DSA health status. 
If you do not have time to perform health checks on a regular basis, you can use NDS iMonitor to periodically check the agent and replica/partition health status and run health reports on each server. Refer to Chapter 13 for more information about performing DS health checks. Using iManager to Diagnose and Repair Problems Similar to NDS iMonitor, iManager is a Web-based management utility from Novell. It, too, first shipped with eDirectory 8.5 and is available for all supported operating system platforms. Designed to be a replacement for ConsoleOne and NetWare Administrator, iManager does not require a Novell Client to be installed on the workstation ”all its functions are performed through Tomcat servlets that are running on the server. NOTE Because of the dependency on other applications, such as a working Apache Web server and LDAP server, sometimes you might need to troubleshoot the troubleshooter ”your iManager setup ”before you can troubleshoot eDirectory problems. You can find some tips on troubleshooting and setting up iManager in Chapter 7 .
iManager provides a functionality called role-based services (RBS) that uses the concepts of roles (what the job functions are) and tasks (responsibilities associated with the job) such that members of the role will see only the tools necessary for their assigned roles. Two predefined DS management- related roles are included with iManager: -
eDirectory Maintenance -
Partition and Replicas The tasks associated with these roles are identical to many of the DSRepair and DSMerge functions, and you can access them through simple wizards. As you can see in Figure 9.6, you have access to the same repair functions in iManager as you do in DSRepair ”tasks such as single object repair and local database repair. You also have access to advanced repair functions such as schema maintenance and replica ring repair. Also available are other functions, such as tree merge (a function otherwise provided by the DSMerge utility). Figure 9.6. iManager's basic repair options. 
By using the View Partition Information task (see Figure 9.7) and Sync Repair task (see Figure 9.8), you can easily get a quick, overall view of your tree's health. The wizards offer some advanced options in DSRepair but do not allow you to use any of the special command-line options, such as -XK2 . However, you can pop over to NDS iMonitor easily via the Repair option under the iMonitor task, and you can use DSRepair command-line switches there. Figure 9.7. Viewing partition synchronization status. 
Figure 9.8. Viewing server synchronization status. 
NOTE The server must be running eDirectory 8.7 or higher in order for you to use the repair functions in iManager against it. This is because these functions are dependent on the eMBox utility, which ships only with eDirectory 8.7 and above.
Use eMBox and Legacy Tools to Diagnose and Repair Problems Instead of using Tomcat servlets, iManager accesses the eDirectory database via the eDirectory Management Tool Box (eMBox) utility. This means that if you have the proper DS rights, you can perform all the RBS-based eDirectory Maintenance and Partition and Replicas tasks without using iManager by using the eMBox client instead. Because the eMBox client is Java based, you can run it from a server or workstation and perform tasks for a number of servers (as long as they are running the eMBox server, which is part of eDirectory 8.7 and above). NOTE Refer to Chapter 7 for details about configuring and using the eMBox Java client.
You can perform a large number of repair tasks by using the eMBox client. When you're performing DS troubleshooting and repair procedures, it is easiest ”and best ”to run it in the graphical mode, as illustrated in Fig-ure 9.9. You don't want to use the command-line text mode and enter a wrong option mistakenly or leave out a necessary flag and have some crucial information not be reported . Figure 9.9. Performing a local database repair by using the eMBox client. 
The one drawback of using the eMBox client instead of iManager or other tools (such as DSRepair) is the inability to browse for an object. You need to know in advance the distinguished name (DN) of the object/partition or the object's ID for certain operations and enter that manually (see Figure 9.10). This can be a dangerous limitation when you are in a rush or are under pressure to expedite a fix. Figure 9.10. Manually entering information in the eMBox client. 
Web-based tools such as NDS iMonitor and iManager are great when you are working from a remote location. However, sometimes, network security policies (such as firewall configuration) or communication disruptions force you to work directly at the server console, where using a Web-based tool becomes unpractical. Therefore, you should also be familiar with using the server-based "legacy" tools: DSRepair, DSTrace, and so on. The other advantage of these server-based tools (with the exception of Windows versions) is that they are generally "processor efficient" because they are text based. As a result, these tools are generally fast in nature, and most of the processor cycles they consume go directly to collecting and reporting DS information. Note that the Windows versions of these server-based tools are also not overly processor unfriendly. The graphics (dialog boxes and so on) use standard Microsoft Foundation Class APIs and are fairly processor efficient. When compared with text-based applications, however, the GUI-oriented ones always seem to be not as efficient. The tradeoff is in the data representation: It is a lot easier to gain an overall picture of the situation from a graphical view than by having to wade through lines of messages for the necessary information. When you use server-based tools for troubleshooting DS issues, you should generally start with DSTrace because it is non- intrusive (that is, it doesn't modify the DIB files in any way) and can point to the general problematic area where you should focus your attention. From there, you can move on to using DSRepair to get a closer view of partition and replica status. The following sections cover how you can get the most information out of the available tools by using a number of them so you can see the problem from different angles. | 