Novell EDIRECTORY 8.8 - GUIDE User manual

Novell
www.novell.com
Novell Confidential Manual (ENU) 21 December 2004
eDirectory
8.8
September 30, 2005
TROUBLESHOOTING GUIDE

Novell Confidential Manual (ENU) 21 December 2004
Legal Notices
Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express
or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. reserves the right to revise this publication and to
make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes.
Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties
of merchantability or fitness for any particular purpose. Further, Novell, Inc. reserves the right to make changes to any and all parts of Novell software,
at any time, without any obligation to notify any person or entity of such changes.
Any products or technical information provided under this Agreement may be subject to U.S. export controls and the trade laws of other countries.
You agree to comply with all export control regulations and to obtain any required licenses or classification to export, re-export, or import deliverables.
You agree not to export or re-export to entities on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the
U.S. export laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. Please refer to
www.novell.com/info/exports/ for more information on exporting Novell software. Novell assumes no responsibility for your failure to obtain any
necessary export approvals.
Copyright © 2005 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or
transmitted without the express written consent of the publisher.
Novell, Inc. has intellectual property rights relating to technology embodied in the product that is described in this document. In particular, and without
limitation, these intellectual property rights may include one or more of the U.S. patents listed at http://www.novell.com/company/legal/patents/ and
one or more additional patents or pending patent applications in the U.S. and in other countries.
Novell, Inc.
404 Wyman Street, Suite 500
Waltham, MA 02451
U.S.A.
www.novell.com
Novell eDirectory 8.8 Troubleshooting Guide
September 30, 2005
Online Documentation: To access the online documentation for this and other Novell products, and to get updates, see
www.novell.com/documentation.

Novell Confidential Manual (ENU) 21 December 2004
Novell Trademarks
Client32 is a trademark of Novell, Inc.
eDirectory is a trademark of Novell, Inc.
NetWare is a registered trademark of Novell, Inc. in the United States and other countries.
NetWare Core Protocol and NCP are trademarks of Novell, Inc.
NMAS is a trademark of Novell, Inc.
Novell is a registered trademark of Novell, Inc. in the United States and other countries.
Novell Client is a trademark of Novell, Inc.
Novell Directory Services and NDS are registered trademarks of Novell, Inc. in the United States and other countries.
Ximiam is a registerd trademark of Novell, Inc. in the United States and other countries.
ZENworks is a registered trademark of Novell, Inc. in the United States and other countries.
Third-Party Materials
All third-party trademarks are the property of their respective owners.
This product includes software developed by the OpenSSL Project for use in the OpenSSL Toolkit (http://www.openssl.org).

4Novell eDirectory 8.8 Troubleshooting Guide
Novell Confidential Manual (ENU) 21 December 2004

Contents 1
Novell Confidential Manual (ENU) 21 December 2004
Contents
About This Book 5
1Resolving Error Codes 7
2Installation and Configuration 9
Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Installation Not Successful . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Installation Takes a Long Time . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
eDirectory Install Fails for Container Administrators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Unable to Install into an Existing Tree over the WAN . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
NICI Installation Failed - 1497 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Naming Objects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
NICI Does Not Get Installed in the Server Mode on Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Tree Name Lookup Failed: -632 Error While Configuring eDirectory 8.8 on Linux . . . . . . . . . . . . . . . . . . 11
Multiple Instances . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
If the First Instance is Down, HTTP Does Not Work . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
3Determining the eDirectory Version Number 13
NetWare . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Solaris . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
AIX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
HP-UX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16
4Log Files 19
modschema.log. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
dsinstall.log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
5Troubleshooting LDIF Files 21
Understanding LDIF . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
LDIF File Format . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
LDIF Content Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
LDIF Change Records . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Line Folding within LDIF Files. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Hashed Password Representation in LDIF Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Debugging LDIF Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Enabling Forward References . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Checking the Syntax of LDIF Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
Using the LDIF Error File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
Using LDAP SDK Debugging Flags. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Using LDIF to Extend the Schema . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Adding a New Object Class . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 33
Adding a New Attribute . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
Adding or Removing Auxiliary Classes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36
6Troubleshooting SNMP 39
Traps Might Not Get Generated As Expected . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
SNMP Group Object . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
SNMP Initializing Errors . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39
SNMP Subagent Does Not Start . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
SNMP on Linux . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40

2Novell eDirectory 8.8 Troubleshooting Guide
Novell Confidential Manual (ENU) 21 December 2004
SNMP on HP-UX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 40
Error while Contacting the SNMP Master Agent from the MIB Browser . . . . . . . . . . . . . . . . . . . . . . . . 40
Problems Configuring NET-SNMP-5.0.8. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Problems Configuring the NAA Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Unable to Get the SNMP Query Result from the MIB Browser . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41
Traps are Not Received at the SNMP Console or the MIB Browser. . . . . . . . . . . . . . . . . . . . . . . . . . 41
SNMP Issues After Upgrading from eDirectory 8.7.3 to eDirectory 8.8 . . . . . . . . . . . . . . . . . . . . . . . . . . 41
7Obituaries 43
Examples . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Deleting an Object . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44
Moving an Object . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Impact of Stuck and Orphaned Obituaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Prevention . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45
Troubleshooting Tips . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Solutions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47
Previous Practices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48
8Migrating to Novell eDirectory 49
Migrating the Sun ONE Schema to Novell eDirectory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Step 1: Perform the Schema Cache Update Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Step 2: Rectify the Error LDIF File to Eliminate the Errors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49
Step 3: Import the LDIF File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Migrating the Active Directory Schema to Novell eDirectory Using ICE. . . . . . . . . . . . . . . . . . . . . . . . . . 52
Step 1: Perform the Schema Cache Update Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52
Step 2: Rectify the Error LDIF File to Eliminate the Errors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Step 3: Import the LDIF File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
Migrating from OpenLDAP to Novell eDirectory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Prerequisites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Migrating the OpenLDAP Schema to eDirectory. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
Migrating the Open LDAP Data to Novell eDirectory . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
Making PAM Work with Novell eDirectory After Migration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55
9Replication 57
Recovering from eDirectory Replica Problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 57
10 Novell Public Key Infrastructure Services 59
PKI Operations Not Working . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
LDAP Search from Netscape Address Book Fails . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59
Removing the configuration of an eDirectory server that is acting as a treekey server in a multiserver tree after having
moved the existing eDirectory objects to a different server fails with the error code for Crucial Replica. . . . . . . 59
While Uninstalling the eDirectory Server holding the CA, the KMOs created on that server will be moved to another server
in the tree and become invalid . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
11 Troubleshooting Utilities on Linux and UNIX 61
Novell Import Convert Export Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
ndsmerge Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
ndstrace Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61
ndsbackup Utility . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Using Ndsrepair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Syntax . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62
Troubleshooting ndsrepair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68
Using ndstrace . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Basic Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Debugging Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69
Background Processes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72

Contents 3
Novell Confidential Manual (ENU) 21 December 2004
12 NMAS on Linux and UNIX 77
Unable to Log In Using Any Method . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77
The User Added Using the ICE Utility Is Unable to Log In Using Simple Password . . . . . . . . . . . . . . . . . . . 77
13 Troubleshooting on Windows 79
The eDirectory for Windows Server Won't Start . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
The Windows Server Can't Open the eDirectory Database Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . 79
Restoring eDirectory on Windows after an Emergency Repair . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
14 Accessing HTTPSTK When DS Is Not Loaded 81
Setting the SAdmin Password on NetWare. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Setting the SAdmin Password on Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
Setting the SAdmin Password on Linux, Solaris, AIX, and HP-UX . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82
15 Encrypting Data in eDirectory 83
Error Messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
-6090 0xFFFFE836 ERR_ER_DISABLED . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
-6089 0xFFFFE837 ERR_REQUIRE_SECURE_ACCESS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
-666 FFFFFD66 INCOMPATIBLE NDS VERSION . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 84
Problem With Duplicate Encryption Algorithms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Encryption of Stream Attributes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
16 The eDirectory Management Toolbox 87
Unable to Stop the eMTool Services . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87
17 SASL-GSSAPI 89
Log File Locations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
Error Messages. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89
18 Miscellaneous 91
Backing Up a Container . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
Repeated eDirectory Logins . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 91
NDS Error, System Failure (-632) Occurs When Doing ldapsearch for the User Objects . . . . . . . . . . . . . . . . 91
Disabling SecretStore . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
On Linix and UNIX . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
On NetWare. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92
On Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92

4Novell eDirectory 8.8 Troubleshooting Guide
Novell Confidential Manual (ENU) 21 December 2004

About This Book 5
Novell Confidential Manual (99a) 21 December 2004
About This Book
This Installation Guide describes how to install Novell®eDirectoryTM 8.8. It is intended for
network administrators, and contains the following sections:
Chapter 1, “Resolving Error Codes,” on page 7
Chapter 2, “Installation and Configuration,” on page 9
Chapter 3, “Determining the eDirectory Version Number,” on page 13
Chapter 4, “Log Files,” on page 19
Chapter 5, “Troubleshooting LDIF Files,” on page 21
Chapter 6, “Troubleshooting SNMP,” on page 39
Chapter 7, “Obituaries,” on page 43
Chapter 8, “Migrating to Novell eDirectory,” on page 49
Chapter 9, “Replication,” on page 57
Chapter 10, “Novell Public Key Infrastructure Services,” on page 59
Chapter 11, “Troubleshooting Utilities on Linux and UNIX,” on page 61
Chapter 12, “NMAS on Linux and UNIX,” on page 77
Chapter 13, “Troubleshooting on Windows,” on page 79
Chapter 14, “Accessing HTTPSTK When DS Is Not Loaded,” on page 81
Chapter 15, “Encrypting Data in eDirectory,” on page 83
Chapter 16, “The eDirectory Management Toolbox,” on page 87
Chapter 17, “SASL-GSSAPI,” on page 89
Chapter 18, “Miscellaneous,” on page 91
Additional Documentation
For documentation on managing and administering eDirectory, see the Novell eDirectory 8.8
Administration Guide (http://www.novell.com/documentation/edir88/index.html).
Documentation Updates
For the most recent version of the Novell eDirectory 8.8 Installation Guide, see the Novell
eDirectory 8.8 Documentation (http://www.novell.com/documentation/edir88/index.html) Web
site.
Documentation Conventions
In this documentation, a greater-than symbol (>) is used to separate actions within a step and items
within a cross-reference path.

6Novell eDirectory 8.8 Troubleshooting Guide
Novell Confidential Manual (99a) 21 December 2004
A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party
trademark.
When a single pathname can be written with a backslash for some platforms or a forward slash for
other platforms, the pathname is presented with a backslash. Users of platforms that require a
forward slash, such as Linux and UNIX*, should use forward slashes as required by your software.

Resolving Error Codes 7
Novell Confidential Manual (ENU) 21 December 2004
1Resolving Error Codes
For a complete list and explanation of eDirectory error codes, see the Novell Error Codes Web
page (http://www.novell.com/documentation/lg/nwec/index.html).

8Novell eDirectory 8.8 Troubleshooting Guide
Novell Confidential Manual (ENU) 21 December 2004

Installation and Configuration 9
Novell Confidential Manual (ENU) 21 December 2004
2Installation and Configuration
“Installation” on page 9
“Configuration” on page 11
“Multiple Instances” on page 11
Installation
Installation Not Successful
Check for the following error message in the /var/adm/messages directory:
Unable to bind to SLP Multicast Address. Multicast route not added?
This message is displayed if the Linux or Solaris machine is not configured for a multicast
route address.
Add the multicast route address and restart the slpuasa daemon.
If the -632: Error description System failure error message appears during
installation, exit from the installation process.
Set the n4u.base.slp.max-wait parameter to a larger value, such as 50, in the /etc/opt/novell/
eDirectory/conf/nds.conf file, then restart the installation process.
If you are installing eDirectory into a NetWare 5.1 tree, upgrade the eDirectory Master to
NetWare 5.1 Support Pack 5 or later.
For more information, see “Installing or Upgrading Novell eDirectory on NetWare” in the
Novell eDirectory 8.8 Installation Guide.
If you tried to upgrade an eDirectory for Solaris 2.0 installation and it was not successful, the
installation might not complete the second time.
Delete the /var/nds/.n4s_upgrade file and try the installation again.
During installation, if the Tree Name Not Found error message is displayed, do the
following:
1Check whether multicast routing is enabled on the Solaris host that you are installing the
product on.
2Specify the IP address of the master server of the Tree partition.
Installation Takes a Long Time
When you are installing eDirectory into an existing tree and the installation takes a long time to
complete, look at the DSTrace screen on the server. If the -625 Transport failure message
is displayed, you need to reset the address cache.

10 Novell eDirectory 8.8 Troubleshooting Guide
Novell Confidential Manual (ENU) 21 December 2004
To reset the address cache, enter the following command at the system console:
set dstrace = *A
eDirectory Install Fails for Container Administrators
The eDirectory 8.8 installation program supports installations by administrators who have
supervisor rights to the container that the server resides in. In order to handle this, the first server
that eDirectory 8.8 is installed into must have supervisor rights to [Root] to extend the schema.
From that point on, subsequent servers do not have to have rights to [Root]. However, with
eDirectory 8.8, depending on the platform that eDirectory 8.8 is installed in to first, all schema
might not be extended, requiring supervisor rights to [Root] for subsequent server installations on
different platforms.
If eDirectory 8.8 will be installed on multiple platforms, make sure that you have supervisor rights
to [Root] for the first server eDirectory will be installed on for EACH platform. For example, if
the first server that eDirectory 8.8 is going to be installed on is running NetWare, and eDirectory
8.8 will also be installed on Solaris, the first server for each platform must have supervisor rights
to [Root]. Subsequent servers on each platform will only have to have container administrator
rights to the container where the server is being installed.
For additional information, see solution NOVL81742 (http://support.novell.com/cgi-bin/search/
searchtid.cgi?/10073723.htm) in the Novell eDirectory 8.7.x Readme Addendum.
Unable to Install into an Existing Tree over the WAN
You need a NetWare 5 or later server to install eDirectory on a Linux or Solaris system over the
WAN.
1Enter the following command at the server console to run the Directory Agent (DA) on the
NetWare server:
slpda
2On the server containing the master replica, edit the DA_ADDR parameter in slpuasa.conf:
DA_ADDR = IP_address_of_the_NetWare_server_where_the_DA_
is_ running
3Restart the slpuasa daemon.
4Install eDirectory over the WAN on the Linux or Solaris system.
4a Run nds-install to add the product packages.
Do not configure the product. See “Linux, Solaris, AIX, and HP-UX Packages for Novell
eDirectory ” in the Novell eDirectory 8.8 Installation Guide for more information.
4b Edit the /etc/opt/novell/eDirectory/conf/nds.conf and add the following parameters:
n4u.uam.ncp-retries = 5
n4u.base.slp.max-wait = 20
4c Edit the /etc/slpuasa.conf to add the following parameter:
DA_ADDR = IP_address_of_the_NetWare_server_where_the
_DA_is_running
4d Run ndsconfig to configure eDirectory.

Installation and Configuration 11
Novell Confidential Manual (ENU) 21 December 2004
NICI Installation Failed - 1497
NICI initialization failed means the NFK file is not right. Ensure that you have the right NFK file.
This problem might not come on Linux and UNIX platforms as by default the NFK file is part of
the NICI package.
Naming Objects
When you use special characters while naming objects, the -671 No Such Parent error
message appears. Avoid using any of the following special characters when naming objects:
\ /, * ? .
NICI Does Not Get Installed in the Server Mode on Windows
In the Properties dialog box of the NICIFK file there is a tab called Security. If there are no names
in the Group or user names field, then this issue occurs.
To work around this problem, do the following:
1Remove the NICIFK file.
This is present in C:/Windows/system32/novell/nici if the system root is C:/Windows/
system32. If the system root is F:/Windows/system32 then this file is present in F:/Windows/
system32/novell/nici.
2Install eDirectory.
Configuration
Tree Name Lookup Failed: -632 Error While Configuring eDirectory 8.8 on Linux
While configuring eDirectory 8.8 on Linux, you might get the Tree name lookup failed: -632 error.
To resolve this, do the following:
1After installing the SLP package, ensure that you manually start SLP as follows:
/etc/init.d/slpuasa start
2After uninstalling the SLP package, ensure that you manually stop SLP as follows:
/etc/init.d/slpuasa stop
Multiple Instances
If the First Instance is Down, HTTP Does Not Work
On Linux and UNIX platforms, if eDirectory is configured on a box with multiple NIC cards and
if HTTP is bound to more than one interface; if the first interface goes down, HTTP would not be
accessible from the remaining interfaces.
This is because the remaining interfaces will redirect the request to the first one, but the first
interface is down.
To resolve this issue, if the first interface goes down, restart eDirectory.

12 Novell eDirectory 8.8 Troubleshooting Guide
Novell Confidential Manual (ENU) 21 December 2004

Determining the eDirectory Version Number 13
Novell Confidential Manual (ENU) 21 December 2004
3Determining the eDirectory Version Number
The following sections list ways you can determine the version of eDirectory installed on a server:
“NetWare” on page 13
“Windows” on page 14
“Linux” on page 14
“Solaris” on page 15
“AIX” on page 16
“HP-UX” on page 16
NetWare
Run ds.nlm, or any other .nlm.
At the server console, enter ds.nlm. This displays both the marketing string (for example,
Novell eDirectory 8.7) and the internal build number (for example, DS v10410.xx).
Run iMonitor.
On the Agent Summary page, click Known Servers. Then under Servers Known to Database,
click Known Servers. The Agent Revision column displays the internal build number for each
server. For example, an Agent Revision number for Novell eDirectory 8.7.1 might be
10510.64.
For information on running iMonitor, see “Accessing iMonitor” in the Novell eDirectory 8.8
Administration Guide.
Run nwconfig.
At the server console, enter nwconfig, then select Product Info. If the install registered
eDirectory (which it does with NDS®eDirectory 8.5 and later), this will display what was
registered during the install. This is typically a hybrid of marketing and build numbers. For
example, you might see marketing version eDir 8.5 and build version 85.01.
LDAP shows configuration through DSTrace.
This is true for most utilities (for example, DSRepair or DSMerge) as they load. This method
will display the internal build number.
For more information on DSTrace, see Looking Into the Directory Services Trace (DSTrace)
Options (http://developer.novell.com/research/sections/netmanage/dirprimer/2001/august/
spv.htm) and More on Using the DSTrace Command (http://developer.novell.com/research/
sections/netmanage/dirprimer/2001/septembe/p010901.htm).
Read the eDirectory download filename.

14 Novell eDirectory 8.8 Troubleshooting Guide
Novell Confidential Manual (ENU) 21 December 2004
The eDirectory download filename usually matches the marketing string. For example, the
download filename for Novell eDirectory 8.7.1 is edir871.exe.
Enter version at a console prompt.
This will display the eDirectory version.
Windows
Run iMonitor.
On the Agent Summary page, click Known Servers. Then under Servers Known to Database,
click Known Servers. The Agent Revision column displays the internal build number for each
server. For example, an Agent Revision number for Novell eDirectory 8.7.1 might be
10510.64.
For information on running iMonitor, see “Accessing iMonitor” in the Novell eDirectory 8.8
Administration Guide.
Run NDSCons.exe.
In the Windows Control Panel, double-click Novell eDirectory Services. In the Services
column, select ds.dlm, then click Configure. The Agent tabs displays both the marketing
string (for example, Novell eDirectory 8.7.1) and the internal build number (for example,
10510.64).
Run an eDirectory utility.
Most eDirectory utilities have an About option on their Help menu that displays the version
number of the utility (for example, Merge Graft Utility 10510.35). Some utilities include the
internal build version in the main label of the utility (for example, DSRepair - Version
10510.37).
To load an eDirectory utility (such as DSMerge or DSRepair), double-click Novell eDirectory
Services in the Windows Control Panel. In the Services column, select the utility, then click
Start.
View the properties of an eDirectory .dlm file.
Right-click the .dlm in Windows Explorer, then click the Version tab in the Properties dialog
box. This will display the version number of the utility. The default location for eDirectory
.dlm files is C:\novell\NDS.
Linux
Run ndsstat.
The ndsstat utility displays information related to eDirectory servers, such as the eDirectory
tree name, the fully distinguished server name, and the eDirectory version. In the following
example, eDirectory 8.7.1 is the product version (marketing string), and 10510.65 is the
binary version (internal build number).
osg-dt-srv17:/>ndsstat
Tree Name: SNMP-HPUX-RASH
Server Name: .CN=osg-dt-srv17.O=novell.T=SNMP-HPUX-RASH.
Binary Version: 10510.65
Root Most Entry Depth: 0
Product Version: NDS/Unix - NDS eDirectory v8.7.1 [DS]

Determining the eDirectory Version Number 15
Novell Confidential Manual (ENU) 21 December 2004
For information on running ndsstat, see “Novell eDirectory Linux and UNIX Commands and
Usage” in the Novell eDirectory 8.8 Administration Guide, or the ndsstat man page
(ndsstat.1m).
Run ndsd --version.
For information on running ndsd, see “Novell eDirectory Linux and UNIX Commands and
Usage” in the Novell eDirectory 8.8 Administration Guide, or the ndsd man page (ndsd.1m).
Run iMonitor.
On the Agent Summary page, click Known Servers. Then under Servers Known to Database,
click Known Servers. The Agent Revision column displays the internal build number for each
server. For example, an Agent Revision number for Novell eDirectory 8.7.1 might be
10510.64.
For information on running iMonitor, see “Accessing iMonitor” in the Novell eDirectory 8.8
Administration Guide.
Run rpm -qi NDSserv.
Entering this command will display similar information to ndsd --version.
Solaris
Run ndsstat.
The ndsstat utility displays information related to eDirectory servers, such as the eDirectory
tree name, the fully distinguished server name, and the eDirectory version. In the following
example, eDirectory 8.7.1 is the product version (marketing string), and 10510.65 is the
binary version (internal build number).
osg-dt-srv17:/>ndsstat
Tree Name: SNMP-HPUX-RASH
Server Name: .CN=osg-dt-srv17.O=novell.T=SNMP-HPUX-RASH.
Binary Version: 10510.65
Root Most Entry Depth: 0
Product Version: NDS/Unix - NDS eDirectory v8.7.1 [DS]
For information on running ndsstat, see “Novell eDirectory Linux and UNIX Commands and
Usage” in the Novell eDirectory 8.8 Administration Guide, or the ndsstat man page
(ndsstat.1m).
Run ndsd --version.
For information on running ndsd, see “Novell eDirectory Linux and UNIX Commands and
Usage” in the Novell eDirectory 8.8 Administration Guide, or the ndsd man page (ndsd.1m).
Run iMonitor.
On the Agent Summary page, click Known Servers. Then under Servers Known to Database,
click Known Servers. The Agent Revision column displays the internal build number for each
server. For example, an Agent Revision number for Novell eDirectory 8.7.1 might be
10510.64.
For information on running iMonitor, see “Accessing iMonitor” in the Novell eDirectory 8.8
Administration Guide.
Run pkginfo -l NDSserv.

16 Novell eDirectory 8.8 Troubleshooting Guide
Novell Confidential Manual (ENU) 21 December 2004
Entering this command will display similar information to ndsd --version.
AIX
Run ndsstat.
The ndsstat utility displays information related to eDirectory servers, such as the eDirectory
tree name, the fully distinguished server name, and the eDirectory version. In the following
example, eDirectory 8.7.1 is the product version (marketing string), and 10510.65 is the
binary version (internal build number).
osg-dt-srv17:/>ndsstat
Tree Name: SNMP-HPUX-RASH
Server Name: .CN=osg-dt-srv17.O=novell.T=SNMP-HPUX-RASH.
Binary Version: 10510.65
Root Most Entry Depth: 0
Product Version: NDS/Unix - NDS eDirectory v8.7.1 [DS]
For information on running ndsstat, see “Novell eDirectory Linux and UNIX Commands and
Usage” in the Novell eDirectory 8.8 Administration Guide or the ndsstat man page
(ndsstat.1m).
Run ndsd --version.
For information on running ndsd, see “Novell eDirectory Linux and UNIX Commands and
Usage” in the Novell eDirectory 8.8 Administration Guide, or the ndsd man page (ndsd.1m).
Run iMonitor.
On the Agent Summary page, click Known Servers. Then under Servers Known to Database,
click Known Servers. The Agent Revision column displays the internal build number for each
server. For example, an Agent Revision number for Novell eDirectory 8.7.1 might be
10510.64.
For information on running iMonitor, see “Accessing iMonitor” in the Novell eDirectory 8.8
Administration Guide.
HP-UX
Run ndsstat.
The ndsstat utility displays information related to eDirectory servers, such as the eDirectory
tree name, the fully distinguished server name, and the eDirectory version. In the following
example, eDirectory 8.7.1 is the product version (marketing string), and 10510.65 is the
binary version (internal build number).
osg-dt-srv17:/>ndsstat
Tree Name: SNMP-HPUX-RASH
Server Name: .CN=osg-dt-srv17.O=novell.T=SNMP-HPUX-RASH.
Binary Version: 10510.65
Root Most Entry Depth: 0
Product Version: NDS/Unix - NDS eDirectory v8.7.1 [DS]
For information on running ndsstat, see “Novell eDirectory Linux and UNIX Commands and
Usage” in the Novell eDirectory 8.8 Administration Guide, or the ndsstat man page
(ndsstat.1m).
Run ndsd --version.