Today when someone was using Sun Identity Manager to modify a directory managed by Sun Directory Server Enterprise Edition (DSEE 6.3) IDM spit out an object class violation error (I verified that the input data was valid). It also corrupted the directory to the point where I can't even get dsadm to export it into an LDIF file. I was wondering if anybody had any insight or could point me in the right direction of figuring out what is causing this? This is the second time this has happened to this DSEE instance.
Start by looking at the DSEE error and access log entries before and during the incident to try figuring out what caused the issue.
Also, telling the input data is valid doesn't help. If it triggers an object class violation, either there is something wrong with it or the schema has been modified earlier on the directory server.
"dsadm export" error messages would help too.
Thanks for the help jilliagre. I don't have access to the machine from here and I won't be able to copy and paste error messages and log files because it is on a private network not touching the internet.
That actually gave me an idea. Is it possible for IDM to incorrectly send data from its forms to DS? I'm pretty confident the schema hasn't been changed.
That's quite unlikely.
Then how do you explain the object class violation ?
I can't. Thats why I am at a loss as to what happened.
What if DS was corrupted before IDM tried to modify it? The server was recently rebooted. Is it possible that something happened during shutdown or startup?
The error logs are there to provide clues.
The logs were showing replication errors and corrupted entry errors. I found the server is running DSEE 6.2 which I have heard has problems with corruption. I rebuilt it using an LDIF from a replica. Its an inherited system that I thought had been patched. Apparently it was overlooked. Thanks for the input.
Indeed, it's a well known issue with 6.2 which should have been patched to 6.3 or 6.3.1 but as you wrote you were using 6.3, I didn't think of it.