Clients forget MCX after server rebuild

Hi everyone. I'm running Mac OS X Server 10.6.8 on an Xserve. The OD system is tied to an Active Directory server in a magic triangle setup, with the OD providing no Kerberos of its own. This was actually changed recently -- due to repeated errors and LDAP deafness, I tore the server down and rebuilt it, re-importing the computers and computer groups from Workgroup Manager. Seems to be humming along fine now.
Except for one thing: The bound client machines, so far just Mac OS X 10.6.8, are starting to forget their MCX settings. For instance, we have a setting requiring a password on wake from sleep or screensaver, and one by one, I'm getting reports that this isn't happening.
Re-binding the machines to the OD server seems to resolve the issue. I'm wondering if anyone can think of a way that might avoid this -- certainly it's a security problem to have the machines not following their security policy until I physically come by and update them.
If anyone can think of a way around this, I would be very grateful!

Hi
This is an old issue and I have a feeling the answer is Time Machine is not supported using port trunking? If you disable the aggregate bond I would not be surprised if it started working?
https://discussions.apple.com/thread/2131323?start=0&tstart=0
This problem appears to have affected 10.5 Server only? Perhaps later versions of the Server don't have the problem?
HTH?
Tony

Similar Messages

IMAP Subfolders Can't Be Accessed After Server Rebuild

I had to reinstall MOSXS 10.4 last night and after reconfiguring the server, I turned mail services on and ditto'd my backup of var/spool/imap back to /var/spool/imap and logged into my IMAP account using Entourage 2004.
The Inbox works correctly, but all subfolders appear to be broken. I told my IMAP account to get the complete folder list, and Entourage crashes. I went so far as to delete/recreate my account, and I can only see the basic folders with no subfolders (like my listserve archives, etc.) I can see the folders and mail in /var/spool/imap/users/(me)/(subfolders)/ and it's all there, but I can't seem to access it.
Any ideas? I'm sure I'm overlooking the obvious.

Most likely using ditto to backup/restore your files missed a few bits. Also /var/spool/imap is not enough, you also need the imap config directory (usually var/imap)
You probably need to reconstruct your mail database. You can use mailbfr to do this. http://osx.topicdesk.com/downloads/
Install it as desribed in the documentation and run it with mailbfr -f
You will loose your read/unread flags though.
Alex

SAP Client to the SAP Server: internal Error (-1102)[Message 131-183]

Hi,
We are using Windows 2008 Server R2, SQL 2008 Standard, SAP B1 8.81 PL08.
When we trying to connect SAP Client to the SAP Server. There has internal Error (-1102) occurred. We can view the database on client, but we always get the same error message after enter the User ID and Password. We have checked the native client and it is installed and also opened the following ports: 1433, 30000, 30001. We have tried to open all of firewall, but itu2019s no use.
When I set a computer in to the engine room and set the network connection, this one can connect SAP Client to the SAP Server.
But when client connect to server by VPN, the IP address will not in the same section. Then We tried to set the IP address has the same network section with the server, but it's still disable.
I set a computer for SAP Server without firewall, complex network, virtual IP and no router in my office. And use a SAP Client which is in different network domain to connect to SAP Server by internet, not VPN, but the SAP Client still canu2019t connect to SAP Server. I get the same internal Error (-1102).
It can not only ping to SAP Server IP, but telnet to the port 1433, 30000, 30001, 445.
When I use a pc with server tools, it can connect to the SAP Server by the localhost license. But if I use a computer only install client and assign the server license. The latter one always got the error.
How could we solve this problem? Is there has another setting I am missing which might be blocking the connection?
Thanks in advance.

Hi,
We are using VPN and using Terminal Licensing or Remote Desktop Conneciton.
The idea here is VPN will connect you to the network and when you are connected to the network
dont use the direct LAN IP connection use the Terminal Licensing to connect.
Again both are needed VPN and Terminal Licensing. VPN for the connection and if successfully connected
use or connect from Terminal Licensing or Remote Desktop connections.
Thanks.
Clint

JSP to Upload file from client machine to Web Server!

Hi,
I want to upload a file from client machine to web server in order to send it as email attachment, How can I do it? After uploading the file the class should give me the path where the file is stored on the web server and the file name in return!
I know the HTML <file> field but dont know how to copy it on web server, HTML Part will be:
<FORM ENCTYPE="multipart/form-data"
method="POST" action="My.jsp">
<INPUT TYPE="file" NAME="mptest">
<INPUT TYPE="submit" VALUE="upload">
</FORM>
Please help!
Thanks,
- Rahul

You can use cos.jar provided by O'Reilly from http://www.servlets.com/cos/. Take a look at com.oreilly.servlet.multipart.* classes.
Package is provided with source, classes, documentation and, of course, ready-to-use jar file.
It is really usefull and - ready!

Client not working after upgrade

Hi,
I am upgrading my SAP 8.8 SP:00 Pl 10 to PL 16. with the help of upgrade wizard all the SAP items are upgraded from PL 10 to Pl 16.
When i was login in through SAP client it asked for upgrade i clicked yes after some time the upgrade stop and the SAP client logo on the server disappear. Now i am not able to login since there is no client to login.
I tried to install client from set up file but it gives following error
Error Number: 0x80040702
Description: Failed to load Dll: creator Dll
I have refered SAP Note: 1408662 and also refered other thread but its not working
I tried to uninstall client from add/ remove program but i am not able to do so
Pls provide solution since i am not able to login.

Hi,
I have already installed the recommended c++ version as per SAP note, still it is not working. I tried to uninstall the client from
B1SHR folder but it gives me error.
The server is properly upgraded and problem exists on 3 of client machines.
I have to any how remove this client file or make it working to acces SAP else i wil have to format system which i dont want to do.

Unable to initialize the Microsoft Exchange Information Store service because the clocks on the client and on the server machine are skewed

Each time I restart this exchange server, the Information Store and System Attendant don't start. If It try to manually start the services, I get the follow errors:
Event ID 5003:
Unable to initialize the Microsoft Exchange Information Store service because the clocks on the client and on the server machine are skewed. This may be caused by a time change either in the client or the server machine, and may require a reboot of that machine. Other than that, verify that your domain is properly configured and is currently online.
Event ID 1005:
Unexpected error The clocks on the client and server machines are skewed. ID no: 80090324 Microsoft Exchange System Attendant occurred.
The clocks on the domain controllers and the exchange server are set to the same time zones. As well, all three clocks are in sync down to the second. Any ideas on what's causing this and how to fix it?

Run this Command from the Exchange Server
Net time \\ADServerName /Set
and confirm the action,
and then you need to restart the service
Microsoft Exchange Active Directory Topology Service
and confirm you are not getting the Error 4001 in the event Viewer.
Thank you, it resolved my issue after being sweating looking for solution.
How can I prevent this from happening? I cannot restart services on each server reboot nor lose 5 years of my life!!!
Sokratis Laskaridis MCP, MCTS, MCITP, Small Business Specialist Netapp ASAP, Symantec STS

AFP login via Kerberos from 10.5 clients to 10.4 server broken

I don't know if this is connected to the problem laid out by William W. Higgins in [Open Directory or LDAP Problem with 10.5 Client and 10.4 Server|http://discussions.apple.com/thread.jspa?threadID=2163645&tstart=0]. The symptoms are... somewhat different, so I'll start a new thread.
We've got a small office with a bunch of 10.5.8 clients, a couple of 10.6 clients, one lone Windows 2000 client, and a number of remote users. I've had my OS X Server 10.4.11 machine (a PowerMac G5 single 1.8GHz, fwiw) working happily as an OD Master for the past few weeks. It's mostly a file server and a back DNS server for our public web site—we have web service turned on, but it's mostly to allow remote users to download files (or upload via WebDAV). The server has a secondary NIC that's hooked up to the cable modem in the DMZ. Everything else is behind the modem's NAT.
We've had some things show up on the logs that are making us want to tighten security, both in the LAN and over the internet. We've gone to HTTPS for the web server and are using TLS/SSL for the PureFTPd server. We closed the SMB ports on the external firewall—something we should have done years ago, probably.
I wanted to switch the AFP service over to Kerberos authentication only. However, when I make that change in Admin Server>AFP>Settings>Access, none of the clients can log on; they get an error reading:
+*Connection Failed*+
+There was an error connecting to the server. Check the server name or IP address and try again.+
+If you are unable to resolve the problem, contact your network administrator.+
Then, after you click on OK, you get the following:
+Sorry, the operation could not be completed because an unknown error occurred.+
+(Error code -5002)+
That code seems to indicate a Kerberos problem.
And when I try to log on as a network user from one of the clients, I get this message:
*+You are unable to log in to the user account "user" at this time+*
+Logging in failed because an error occurred.+
Gee, that's helpful!
Server Admin shows OD and Kerberos as up and running. The Password Service log has the following entry:
+Jan 21 2010 09:18:21 AUTH2: {0x4b4df87638fa1ec80000003400000034, bound-client-machine$} CRAM-MD5 authentication succeeded.+
So the log-on didn't go through Kerberos, for some reason, though it's been working fine that way for weeks.
I tried using +sso_util configure -r KERBEROS.REALM -a diradmin afp+ to make sure that single sign-on was running for AFP. No change.
I can use +dscl -u username -p localhost read /LDAPv3/Users/username+ and read the information on the user's home directory.
I can use /System/Library/CoreServices/Kerberos (or Ticket Agent) to request and receive a ticket. (Side note: does Kerberos really not allow login by secondary short names??? That's a pain! If I add principals for the secondary short names, will it authenticate correctly to the proper account???)
FTP is working. Web authentication is working. If I turn Kerberos authentication off for AFP, everything else seems to return to normal... but then the passwords are passed as cleartext, which isn't acceptable.
So... Is this a bug? Is this a conflict with PureFTPd? Am I doing something wrong?
Message was edited by: David Kudler

Post-reboot:
Well, the good news is that the kdc now shows up in the kadmin log as starting up:
Jan 26 11:43:02 localhost kadmind[98](info): Seeding random number generator
Jan 26 11:43:03 localhost kadmind[98](info): No dictionary file specified, continuing without one.
Jan 26 11:43:04 localhost kadmind[98](info): starting
The lack of dictionary file I believe is a minor error, right?
The bad news is that a) clients are no longer able to receive tickets (+*Kerberos Error* Configuration does not specify default realm+) and b) clients can't log on at all—not even via the Finder>Go>Connect to Server... command. Not even when you use the static IP address of the server rather than the DNS name.
DNS still seems to be working. I can get reverse lookup:
*cerberus:~ root#* dig -x 10.1.10.2
; << DiG 9.3.6-APPLE-P2 << -x 10.1.10.2
;; global options: printcmd
;; Got answer:
;; -HEADER<<- opcode: QUERY, status: NOERROR, id: 45389
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 3, ADDITIONAL: 2
;; QUESTION SECTION:
;2.10.1.10.in-addr.arpa. IN PTR
;; ANSWER SECTION:
2.10.1.10.in-addr.arpa. 3600 IN PTR cerberus.limbo.jcf.org.
;; AUTHORITY SECTION:
10.1.10.in-addr.arpa. 3600 IN NS ns1.jcf.org.
10.1.10.in-addr.arpa. 3600 IN NS cerberus.limbo.jcf.org.
10.1.10.in-addr.arpa. 3600 IN NS 10.1.10.1.
;; ADDITIONAL SECTION:
ns1.jcf.org. 86400 IN A 207.58.140.213
cerberus.limbo.jcf.org. 3600 IN A 10.1.10.2
;; Query time: 2 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Jan 26 11:50:51 2010
;; MSG SIZE rcvd: 163</div>
*cerberus:~ root#* dig cerberus.hades.jcf.org
; <<>> DiG 9.3.6-APPLE-P2 <<>> cerberus.hades.jcf.org
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 36453
;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 2, ADDITIONAL: 0
;; QUESTION SECTION:
;cerberus.hades.jcf.org. IN A
;; ANSWER SECTION:
cerberus.hades.jcf.org. 86400 IN A 10.0.1.2
;; AUTHORITY SECTION:
hades.jcf.org. 86400 IN NS cerberus.hades.jcf.org.
hades.jcf.org. 86400 IN NS 10.1.10.1.
;; Query time: 4 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Tue Jan 26 11:51:46 2010
;; MSG SIZE rcvd: 93
</div>
*cerberus:~ root#* changeip -checkhostname
Primary address = 10.1.10.2
Current HostName = cerberus.limbo.jcf.org
DNS HostName = cerberus.limbo.jcf.org
The names match. There is nothing to change.
(The DNS also checks out from the clients.)
But.... fubar.
When I run +kadmin.local listprincs+, it lists all of the users and computers I've added—plus a couple that I don't recognize but that seem to be the products of bound computers (the names are along these lines, rather than the actual computer names for the clients: +LKDC:SHA1.59B886209B027XXXXXXXXXXXXXXXXXXXXXXXXXXX$@CERBERUS.LIMBO.JCF.ORG+). But when I run +kadmin.local list_policies *+, it just pops down to the next prompt. There don't seem to be any policies defined. That can't be right, can it????
Further weirdness: I tried rebinding the client that I'm working from (an iMac running 10.6.2), also using the IP address. It goes through the binding process, but no dice—when I try to run System/Library/CoreServices/Kerberos.app, I still can't get a ticket. And the weird bit is, there doesn't seem to be a /Library/Preferences/edu.mit.Kerberos plist file on the client. Well, no wonder the client's Kerberos app can't authenticate the realm—there's no local file in which the data is stored!
I should note that when I rebooted this morning, I first booted to the backup drive and ran Disk Utility; I repaired permissions—more than once—and repaired the disk directory as well. Perhaps I have confused the **** out of it. Though how the permissions got fouled in the first place is beyond me.
I have other things to do (as it says in my profile, I'm the local IT guy by default)—though everyone where I work needs this problem solved.
At this point my options seem to be:
1.) Back up, demote, promote and reload the OD server.
2) Reinstall from scratch.
If anyone has any suggestions in the next hour or so, I'd love to hear them!
Message was edited by: David Kudler

Canceling timers after server restart

hi,
i create a couple of timers. while the application server is up i can cancel them by getting the TimerService object of the bean it's associated with, calling getTimers() and cancelling the Timer objects returned from it.
if i restart the server (let's say it crashed), the timers created in the previous session are back to run - they are persistent by definition. but now i can't cancel them anymore: same getTimers() returns an empty Collection. i think this happens because the old timers from the previous session were not rebound to the new ejbcontext, or something like this.
my question is: how can i cancel timers, that were re-invoked after server restart.
thank you.
Message was edited by:
cyclid

Below are my tests that show canceling of timers working as expected:
Session bean methods:
public void createTimers()
{      System.out.println("### CREATE - a single-action timer that expires in 4s");
ctx.getTimerService().createTimer(4000, "single-action timer that expires in 4s");
System.out.println("### CREATE - an interval timer that expires in every 2s");
ctx.getTimerService().createTimer(2000, 2000, "interval timer that expires in every 2s");
public void cancelAllTimers() {
     System.out.println("### CANCEL - timers:");
     for (java.util.Iterator iter = ctx.getTimerService().getTimers().iterator(); iter.hasNext();) {
          Timer timer = (Timer) iter.next();
          System.out.println(" canceling ... " + timer.getInfo());
          timer.cancel();
public void logCurrentTime() {
     System.out.println("### CURRENT TIME - " + java.util.Calendar.getInstance().getTime());
public void ejbTimeout(Timer timer)
{     System.out.println("### EJB TIMEOUT - " + timer.getInfo());
Java Client test:
ejb.cancelAllTimers();
Thread.sleep(4000);
ejb.logCurrentTime();
ejb.createTimers();
Thread.sleep(8000);
ejb.cancelAllTimers();
ejb.logCurrentTime();
Thread.sleep(8000);
ejb.logCurrentTime();
Logs:
1. Shutdown servers while there is an interval timer
The log shows the interval timer came back and then was cancel after server restart
07/02/06 13:46:23 ### CANCEL - timers:
07/02/06 13:46:27 ### CURRENT TIME - Tue Feb 06 13:46:27 EST 2007
07/02/06 13:46:27 ### CREATE - a single-action timer that expires in 4s
07/02/06 13:46:27 ### CREATE - an interval timer that expires in every 2s
07/02/06 13:46:29 ### EJB TIMEOUT - interval timer that expires in every 2s
07/02/06 13:46:31 ### EJB TIMEOUT - single-action timer that expires in 4s
07/02/06 13:46:31 ### EJB TIMEOUT - interval timer that expires in every 2s
07/02/06 13:46:32 Shutting down OC4J...
C:\oc4j\10131_061009\j2ee\home>java -jar oc4j.jar
07/02/06 13:48:12 Oracle Containers for J2EE 10g (10.1.3.1.0) initialized
07/02/06 13:48:13 ### EJB TIMEOUT - interval timer that expires in every 2s
07/02/06 13:48:15 ### EJB TIMEOUT - interval timer that expires in every 2s
07/02/06 13:48:17 ### EJB TIMEOUT - interval timer that expires in every 2s
07/02/06 13:48:18 ### CANCEL - timers:
07/02/06 13:48:18 canceling ... interval timer that expires in every 2s
07/02/06 13:48:22 ### CURRENT TIME - Tue Feb 06 13:48:22 EST 2007
2. Cancel timers right after they were created
07/02/06 13:50:11 ### CANCEL - timers:
07/02/06 13:50:15 ### CURRENT TIME - Tue Feb 06 13:50:15 EST 2007
07/02/06 13:50:15 ### CREATE - a single-action timer that expires in 4s
07/02/06 13:50:15 ### CREATE - an interval timer that expires in every 2s
07/02/06 13:50:17 ### EJB TIMEOUT - interval timer that expires in every 2s
07/02/06 13:50:19 ### EJB TIMEOUT - single-action timer that expires in 4s
07/02/06 13:50:19 ### EJB TIMEOUT - interval timer that expires in every 2s
07/02/06 13:50:21 ### EJB TIMEOUT - interval timer that expires in every 2s
07/02/06 13:50:23 ### EJB TIMEOUT - interval timer that expires in every 2s
07/02/06 13:50:23 ### CANCEL - timers:
07/02/06 13:50:23 canceling ... interval timer that expires in every 2s
07/02/06 13:50:23 ### CURRENT TIME - Tue Feb 06 13:50:23 EST 2007
07/02/06 13:50:31 ### CURRENT TIME - Tue Feb 06 13:50:31 EST 2007

Oracle 10G Db Starts-up After Server Reboot, BUT Goes DOWN After Some Time

Hi All,
I am really puzzled over this one. I have couple of servers running DB on them and I have used scripts to auto-enable them when server(s) reboot.
But there is one server where I see this funny behavior.
The DB comes-up after server reboot.
I can verify that in the startup logs and some more logs that I created.
I can see that LISTENER is able to communicate also.
But after a while, the DB shuts-down....!!
I have checked all the places I could. I have also tried to see the difference between this server and others (I did not install this one), but can not see any difference.
Is there anyway to find out (log) what is shutting down the DB??
Any help will be much appreciated as I am at my wits end.
Following is snap-shot from my logs:
Fri Mar 16 20:42:29 EDT 2007
Running dbstart.
Done with starting all, let's check status...
Fri Mar 16 20:42:42 EDT 2007
LSNRCTL for Solaris: Version 10.2.0.1.0 - Production on 16-MAR-2007 20:42:42
Copyright (c) 1991, 2005, Oracle. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1)))
STATUS of the LISTENER
Alias LISTENER
Version TNSLSNR for Solaris: Version 10.2.0.1.0 - Production
Start Date 16-MAR-2007 00:46:56
Uptime 0 days 19 hr. 55 min. 46 sec
Trace Level off
Security ON: Local OS Authentication
SNMP OFF
Listener Parameter File /oracle/product/10.2.0/Db_1/network/admin/listener.ora
Listener Log File /oracle/product/10.2.0/Db_1/network/log/listener.log
Listening Endpoints Summary...
(DESCRIPTION=(ADDRESS=(PROTOCOL=ipc)(KEY=EXTPROC1)))
(DESCRIPTION=(ADDRESS=(PROTOCOL=tcp)(HOST=10.103.253.50)(PORT=1521)))
Services Summary...
Service "orcl" has 2 instance(s).
Instance "orcl", status UNKNOWN, has 1 handler(s) for this service...
Instance "orcl", status READY, has 1 handler(s) for this service...
Service "orclXDB" has 1 instance(s).
Instance "orcl", status READY, has 1 handler(s) for this service...
Service "orcl_XPT" has 1 instance(s).
Instance "orcl", status READY, has 1 handler(s) for this service...
The command completed successfully
Current Status:
# date
Fri Mar 16 21:30:40 EDT 2007
# su - oracle -c "lsnrctl status"
Sun Microsystems Inc. SunOS 5.10 Generic January 2005
LSNRCTL for Solaris: Version 10.2.0.1.0 - Production on 16-MAR-2007 21:30:53
Copyright (c) 1991, 2005, Oracle. All rights reserved.
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=IPC)(KEY=EXTPROC1)))
TNS-12541: TNS:no listener
TNS-12560: TNS:protocol adapter error
TNS-00511: No listener
Solaris Error: 146: Connection refused
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=10.103.253.50)(PORT=1521)))
TNS-12541: TNS:no listener
TNS-12560: TNS:protocol adapter error
TNS-00511: No listener
Solaris Error: 146: Connection refused

I was just looking at that.. Thanks for the tip.
Following is what I see. But not sure what does it tell me?? Please help......
From alert_orcl.log:
<snip>
db_recovery_file_dest_size of 2048 MB is 0.00% used. This is a
user-specified limit on the amount of space that will be used by this
database for recovery-related files, and does not reflect the amount of
space available in the underlying filesystem or ASM diskgroup.
Fri Mar 16 20:42:41 2007
Errors in file /oracle/product/10.2.0/Db_1/admin/orcl/udump/orcl_ora_7700.trc:
ORA-00604: error occurred at recursive SQL level 1
ORA-12663: Services required by client not available on the server
ORA-36961: Oracle OLAP is not available.
ORA-06512: at "SYS.OLAPIHISTORYRETENTION", line 1
ORA-06512: at line 15
Fri Mar 16 20:42:42 2007
Completed: ALTER DATABASE OPEN
From /oracle/product/10.2.0/Db_1/admin/orcl/udump/orcl_ora_7700.trc
# cat /oracle/product/10.2.0/Db_1/admin/orcl/udump/orcl_ora_7700.trc
/oracle/product/10.2.0/Db_1/admin/orcl/udump/orcl_ora_7700.trc
Oracle Database 10g Release 10.2.0.1.0 - 64bit Production
ORACLE_HOME = /oracle/product/10.2.0/Db_1
System name: SunOS
Node name: gcars0j6
Release: 5.10
Version: Generic_118833-24
Machine: sun4u
Instance name: orcl
Redo thread mounted by this instance: 1
Oracle process number: 15
Unix process pid: 7700, image: oracle@gcars0j6 (TNS V1-V3)
*** SERVICE NAME:() 2007-03-16 20:42:37.548
*** SESSION ID:(159.3) 2007-03-16 20:42:37.548
Thread 1 checkpoint: logseq 255, block 2, scn 8602014
cache-low rba: logseq 255, block 3
on-disk rba: logseq 255, block 767, scn 8602399
start recovery at logseq 255, block 3, scn 0
----- Redo read statistics for thread 1 -----
Read rate (ASYNC): 382Kb in 0.16s => 2.33 Mb/sec
Total physical reads: 4096Kb
Longest record: 3Kb, moves: 0/1066 (0%)
Change moves: 1/8 (12%), moved: 0Mb
Longest LWN: 308Kb, moves: 0/29 (0%), moved: 0Mb
Last redo scn: 0x0000.0083431e (8602398)
----- Recovery Hash Table Statistics ---------
Hash table buckets = 32768
Longest hash chain = 1
Average hash chain = 149/149 = 1.0
Max compares per lookup = 1
Avg compares per lookup = 1925/2083 = 0.9
*** 2007-03-16 20:42:37.702
KCRA: start recovery claims for 149 data blocks
*** 2007-03-16 20:42:37.705
KCRA: blocks processed = 149/149, claimed = 149, eliminated = 0
*** 2007-03-16 20:42:37.706
Recovery of Online Redo Log: Thread 1 Group 2 Seq 255 Reading mem 0
----- Recovery Hash Table Statistics ---------
Hash table buckets = 32768
Longest hash chain = 1
Average hash chain = 149/149 = 1.0
Max compares per lookup = 1
Avg compares per lookup = 2054/2074 = 1.0
Error in executing triggers on database startup
*** 2007-03-16 20:42:41.963
ksedmp: internal or fatal error
ORA-00604: error occurred at recursive SQL level 1
ORA-12663: Services required by client not available on the server
ORA-36961: Oracle OLAP is not available.
ORA-06512: at "SYS.OLAPIHISTORYRETENTION", line 1
ORA-06512: at line 15

Probelm client auth from jsse client with open ssl server

I tried to connect jsse client with a openssl server.. with clientAuth
This is what i did ..
Using openssl req comand i created a X509 certificate for server and imported the same to java keystore..
The communication works fine without client authentication.
To enable client auth i create client private/public key pair using keytool and exported the public key to a file client.public. and used it in open ssl server .
This is how i invoke the client ..
java
-Djavax.net.debug=all
-Djavax.net.ssl.trustStore=cacerts
-Djavax.net.ssl.trustStorePassword=changeit
-Djavax.net.private -Djavax.net.ssl.keyStorePassword=password EchoClient
After which i get following error in server
SSL3 alert write:fatal:handshake failure
SSL_accept:error in SSLv3 read client certificate B
SSL_accept:error in SSLv3 read client certificate B
ERROR
17246:error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate:s3_srvr.c:1666:
shutting down SSL
CONNECTION CLOSED
The client debug says it is recieving a certificate request.. what could be the problem.. can anybody help...

i also have that problem. I was trying to configure SSL in apache in Win XP machine, but this error occurs. Is there anyone, who can help on it?

Local KDC (LKDC) relating to Leopard clients logging into Tiger Server

This is a follow-up to my posting on this thread:
http://discussions.apple.com/message.jspa?messageID=5982070#5982070
Pursuing the problem I had when I upgraded to Leopard, I found it odd that trusted binding to Tiger OD from a Leopard client created a funny computer entry in the Workgroup Manger (WGM). Previously when using trusted binding from a Tiger machine to a Tiger server, one entry would be created. And Logging in as an OD user worked every time for me. However, it appears that under 10.5.1 Kerberos has changed significantly in that it is now being used extensively through the Leopard OS for Peer-to-Peer applications. This may account for the screwed up Computer account entries in WGM when a 10.5.1 client binds to 10.4.11 Server using trusted binding. The giveaway clue to this is the LKDC:SHA1 entry created in the WGM computer record (usually 3 seperate records for 10.5.1 instead of the normal single record with a Tiger client). My question is this:
Are there any changes that can be performed via command line on the 10.5.1 client to mimic the old 10.4 client Kerberos configuration without pervasive Peer-to-Peer use of Kerberos? Is is a config setting for the mit.kerberos file? Could it be as simple as flipping a switch to get the older more compatible Kerberos config of a 10.4 Tiger client? Can I dump the Local KDC present in Leopard, and get back to the good old days of non-local KDC under Tiger?
http://www.afp548.com/article.php?story=LeopardServerReview-LocalDirectory
"The Local KDC
Yes, you read that right, the local KDC. All Leopard client systems will now create a Local KDC for use with peer to peer file sharing.
While this isn't even as close to as scary as it seems, it is a topic worthy of at least a separate article, if not a whole series. I put on my thinking toque and sat in my thinking corner for a while on this, and I've not yet been able to come up with a reason for why having a KDC on every machine is less secure than how 10.4 did things. Having said that, though, I fully understand how this can seriously freak out your network security team as they don't quite grasp all the ins and the outs of this. Combine this with Back to My Mac, another article that's forthcoming, and you have a very interesting collection of some "sleeper" features in Leopard.
So, in a nutshell, a Local KDC, the LKDC, is created when 10.5 is installed. Local users will get LKDC authentication authorities allowing them to get Kerberos tickets and use that for single sign on to all the services hosted on that client system. Kerberos is supposed to be only used when you use Bonjour to discover the other machine. So primarily in peer to peer on the same LAN cases.
It works, you can see this for yourself. Screen share to another machine as a local user by picking the machine out of the sidebar in the Finder. You'll have to enter in your password the first time, but after that you can close out of that screen sharing session and restart it without having to re-enter your password. You can also see the ticket in the Kerberos.app, still buried in /System/Library/CoreServices."

Eric,
Thanks so much for your thoroughness and assistance. I think we have decided, for now, to forgo the 10.5 clients attaching to the 10.4 server because of too many intermittant issues. Similar machines on 10.5 gave different results. And at this point, our client is very skittish about the process working at all. I think we need more testing and that is the directon we'll take for now.
Here are some of our results:
I did find information on afp548 regarding the 10.5 preference. It was specificall referenced in this article:
http://www.afp548.com/forum/viewtopic.php?forum=18&showtopic=16064
Clearing the check box on the 10.4 server under OD > Settings > Security "Require password change on new user login" did solve the memory issue that kerberos was having. After clearing the setting, I:
* deleted all binding references at the server (WGM > Accounts > Lists > All Computers
* Deleted the bindings at the client and the the LDAP server references in Directory Access
* Restarted the machine
* Reconnected the LDAP server, Rebind the machine
* Check the LDAP search in issuing id <username> in Terminal
* OPen System PReferences > Accounts > Login Items, the preference is there!
* Yeehah
Oh, but the user still can't login in that machine. Uhm, why? I have no idea. I take a new machine, 10.5.1, no login accounts except a local admin, and no that user still cannot login. Other users, no problem, but not that user.
Take a new system, 10.4.11, set up the binding, the LDAP server, try to log in that same user: works every time. Ugh.
So of course, I think there is something up with that user, but nothing in logs gives an indication of what is going on. That I can find. THis is after 10 hours of testing and trying. Needless to state, the client is frustrated, and so am I.
You know, we do have one 10.5.1 client laptop that did work. After lots of binding and rebinding, it just somehow starting working as expected. But, the reason that we're sticking with 10.4 clients for now is that machine will not respond to password change mandates. I select that user in the WGM, check the "require password change on next login" and nothing happens on their end. They are not an admin, I have reset their account more times than I can count, and so I expect there are more non-working items with 10.5.1 clients and 10.4 server that will get me. It needs more testing for now.
So, back to your message, I haven't tried the SSL certificate, but I will give that a try.
In general, for your network, how are your laptop users configured? As mobile users? Network homes? Or Local homes?
Thanks again for your help. I really appreciate it.

Can i Host the KMS Server in the Server which is a KMS client of other KMS Server

Hi,
Is it Possiblei can Host the KMS Server in the Server(2012 R2) which is a KMS client of other KMS Server..?
If yes ... Do i need to do any special configuration for that or normal Host configuration is enough..?
Thanks
Balaji K

Hi Sir,
"The KMS service does not require a dedicated server. The KMS service can be co-hosted with other services, such as Active Directory® Domain Services (AD DS) domain controllers and read-only domain controllers (RODCs).
KMS hosts can also run on physical computers or virtual machines that are running any supported Windows operating system, including Windows Server 2003. Although a KMS host that is running Windows Server 2008 R2 can activate any Windows operating
system that supports Volume Activation, a KMS host that is running Windows 7 can activate only computers running Windows 7 and Windows Vista."
Based on this ,it should work .
If you want to activate a windows server please enable KMS on a server .
"By default, client computers connect to the KMS host for activation by using anonymous RPCs through TCP port 1688. (You can change the default port.) After establishing a TCP session with the KMS host, the client sends a single request packet.
The KMS host responds with the activation count. If the count meets or exceeds the activation threshold for that operating system, the client is activated and the session is closed. The KMS client uses this same process for renewal requests. The communication
each way is 250 bytes."
https://technet.microsoft.com/en-us/library/ff793434.aspx
Also you can change it if that port is used by other service :
https://technet.microsoft.com/en-us/library/ff793407.aspx?f=255&MSPPError=-2147217396
Best Regards,
Elton Ji
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Subscriber Support, contact [email protected] .

Client jvm.dll vs server jvm.dll

I recently had to work on an legacy application which led me dig into jvm.dll things but could not find something concrete.
From my research, i know
client jvm.dll- comes with JRE, for lighter apps.
server jvm.dll-comes with JDk and more optimized implementation of jvm.
But-
why jdk/jre for 64-bit doesnt contain client jvm.dll (only server.dll)??
jdk/jre for 32 bit contains client jvm.dll.
Our app (which is actually a windows service written by some unknown team) didnt run with server jvm.dll and after struggling a lot, we realized it requires client jvm.dll
which led us to download 32 bit jdk.
That app/wondows service was created using apache commons daemon on jdk 4.

user5873044 wrote:
...didnt run with server jvm.dll That either means that
1. It threw an exception - which would tell you something.
2. It crashed.
3. You had some 'criteria' which was not met for one of them.
Additionally it might have been one of the above but you don't know what caused the problem.
It would be helpful and interesting to know which it was.
(which is actually a windows service written by some unknown team)Which suggests one possible failure in that they used jni and were explicitly loading one dll versus the other.
why jdk/jre for 64-bit doesnt contain client jvm.dll (only server.dll)??Possibly because when they first put together the 64 bit VMs the only machines that ran 64 bits were server class machines.

SCCM 2007 SP2 R3 client on App V Server with Terminal Server

Hii,
We have the following servers in our environment.
Termincal Services with Server 2008 and App v on same machine
SCCM 2007 SP2 R3. When I installed SCCM client on APP V server yesterday, terminal and App V servers / services stopped working and users were unable to use these services. After uninstalling of SCCM client, its working. What is the recommendation for this
situation? Is it recommended to do not install SCCM client on APP V servers? And if we install SCCM client then APP V services stop working?
Please suggest.
Regards, Syed Fahad Ali

issue has been resolved via below link.
http://support.microsoft.com/kb/2694295/en-us
the client advertise setting was set to Allow virtual application package advertisement. For the
time being we uninstall the SCCM client from all APP V servers. Soon we will test with the mentioned setting in above link.
Thanks for your response.
Regards, Syed Fahad Ali

10.6 Client and 10.7 Server Open Directory

I´ve got an Mac Mini running Lion Server. It´s configured as an Open Directory Server.
And I´ve got some 10.6 Clients running on the same local network.
All Clients have the Mini Server as DNS Server.
And now I want to use NetworkAccounts form the 10.7 Server on the 10.6 Clients.
I´ve connected the 10.6 Clients to the Server (without SSL) and all Clients say "Network Accounts available".
But if I try to log in on the Client it just shakes the login window. I´ve tried it on all my Clients with different Accounts but nothing worked.
It just won´t work! But why? Can you please help me?
What I´m doing wrong? Or is the combination of 10.6 Clients and 10.7 Server not Supported by OpenDirectory on 10.7 Server ?
Thank you !

Check your authentication against the server from one of the clients using the following command:
dscl /LDAPv3/<server name or IP> authonly <shortname of an account that cannot login>
The server name should be the same name or IP you used when binding your 10.6 client to a 10.7 server.
If you get the response "Failed to authenticate user <shortname> (tDirStatus: -14103)" you are having the same issue I was having. I found an answer to this, but you are not going to like it.
Apparently Workgroup manager and Server.app deal with accounts differently. If you are using Workgroup Manager to import a long list of accounts, don't. Server.app needs to write an addition setting that is not part of Workgroup manager or in Passenger I doesn't work correctly with accounts that have home folders that are not local. Here are the steps I used to resolve the issue:
Export all your accounts and groups
Using Server Admin, demote your OD to a standalone directory
Once the demotion is complete, use Server.app to promote your server to an OD Master
Update: I've not found it to make a difference if you use server.app or Server Admin to configure your Open Directory Master.
Once the server is again an Open Directory Master, import the users that you exported using Server.app instead of Workgroup Manager.
If you are importing groups, set the Home Directory by editing the account in Server.app before importing groups to avoid overwriting your group settings. Thankfully, you can select multiple accounts at a time.
Import your groups using Server.app
Verify group membership and test the loginsIf you test the login using the dscl command from above, you should get no error after entering the password, but as long as you have a bound client, you should be able to login at this point.
Hope this reaches you in time to help.

Clients forget MCX after server rebuild

Similar Messages

Maybe you are looking for