General troubleshooting

Use the workaround and solutions to resolve general issues in IBM® Security Directory Server, version 6.1 and later directory servers.

IBM Installation Manager generates an error when the GSKit repository contains multiple installable
To provide secure communication mechanism, IBM Security Directory Server uses GSKit. IBM Security Directory Server requires both GSKit SSL package and GSKit crypt package to be installed on the computer.
Instance owner unable to access core file
The instance owner is sometimes unable to access the core file for a core file that is produced during server initialization. Follow the steps to work around this issue.
Key labels do not match
If the key labels in the .kdb file and ibmslapd.conf file do not match, follow the steps to resolve this error.
GSKit certificate error
If the GSKIT fails with an error when you try to import a signer or personal certificate, follow the steps to troubleshoot and resolve this error.
Server instance fails to start because of incorrect file permissions
The server instance might fail to start because of incorrect file permissions. You must ensure that the file permissions are readable by the user ID, idsldap.
Server instance fails to start because host name is incorrect
The server instance fails to start because the localhost host name is not set correctly. You must ensure that the host name meets the specified requirements.
Server instance cannot be started except by instance owner
If a user other than the instance owner cannot start a server instance, you must verify the group and access rights of the user.
Error opening slapd.cat file on Windows systems
If an error occurs when you open slapd.cat file on a Windows system, you must check the NLSPATH variable.
DSML file client produces error
When a user tries to connect to an LDAP server that does not use SSL, the DSML file client might give an error. This error is not serious.
Non-default log files need valid path
If you want to store your log files in a nondefault path, you must ensure that the path exists and is valid.
Null searches retrieve entries of deleted suffixes
If you deleted a suffix without first removing the entries of the suffix from the database, those entries are returned by the null search. The entries are returned even though the suffix no longer exists.
Error occurs with the idsldapsearch command
The idsldapsearch command with -h option gives an error with the DIGEST-MD5 mechanism. Follow the steps to resolve this error.
Server behavior when language tags are disabled
To avoid potential problems and unexpected behavior after you enable language tags, you must not disable the language tags.
Key database certificate
You must create the key database certificate before you set up SSL.
idsbulkload hangs during parsing phase
If the idsbulkload seems like it is hanging during the parsing phase, you can resolve this issue by changing some variable values.
Size of log file exceeds the system file size limit
A directory server might fail if the size of any log file exceeds the system file size limit. This failure typically occurs when tracing is enabled on the server.
Unable to connect to directory server over SSL
When you use the idsxinst tool to copy an instance you might not be able to connect to a directory server over SSL. Follow the steps to resolve this problem.
Directory server fails to start after running bulkload
When you run ldap operations after you run bulkload, the directory server fails to start or shows an error. Follow the steps to troubleshoot and resolve this issue.
The idsadsrun tool fails
The idsadsrun tool might fail for some instances when run simultaneously for multiple instances on the same system. You must install the latest IBM Security Directory Integrator fix pack to resolve this issue.
Startup messages are displayed in two different locales
On Windows operating system, directory server startup messages might get displayed in two different locales. This problem usually occurs when a language other than English is specified for the directory server instance.
Unable to open a new connection for an LDAP client
You might be unable to open a new connection for an LDAP client to connect to a directory server instance. This issue is specific to the directory server instance that is running on a Linux or Solaris operating system. You can work around this restriction by increasing the limit on open file descriptors.
Error occurs when you deploy with idsideploy tool
When you deploy a replica or a peer in a replication environment by using the idsideploy tool, an error might occur. You can resolve this issue by ensuring that there is only one replication subentry.
Error occurs because environment variable values contain spaces
The idsadscfg, idssnmp, and idslogmgmt tools might give errors if the environment variable values contain spaces. Ensure that you do not use spaces in the value of the environment variables.
The idsadsrun tool stops during synchronization
The idsadsrun tool stops and exits when it attempts to synchronize Active Directory and IBM Security Directory Server after the directory server is restarted. You can restart the Active Directory synchronization to run in real-time synchronization mode.
The idsadsrun utility fails to synchronize
The idsadsrun utility might fail to synchronize as is from Active Directory Server to a directory server instance. You must check the system configuration and Active Directory settings to troubleshoot this issue.
The idscfgdb command fails to configure a database
The idscfgdb command might fail to configure a database for a directory server instance on Red Hat Enterprise Linux (RHEL) v4, 64-bit operating system. You can update the kernel parameter to resolve this problem.
The idscfgdb command fails with error code GLPCTL028E
The idscfgdb command might fail with error code GLPCTL028E while it is creating a database. You might be required to tune the kernel parameters to resolve this issue.
DMS cooked table space size is not extended exactly
The DMS cooked table space size might not be extended exactly in the multiples of the value that you specify with the -z option of the idscfgdb command. The database manager strives to maintain consistent growth across table space containers. Hence, the actual value that is used to extend the table space might be slightly lesser or greater than the value specified.
Compatibility issue with Common Auditing and Reporting Service (CARS) 6.0.1 server
The CARS logging feature that is provided with IBM Security Directory Server, version 6.2 uses the CARS 6.1 client. Therefore, the CARS 6.1 server is required for using CARS 6.1 clients. Any version of CARS server other than 6.1 is not compatible with the CARS logging tool.
Problem with monitoring server instances on a Solaris system
On a Solaris system, you might face a problem with monitoring directory server instances with an SNMP agent. The problem might occur with an SNMP agent that tries to log on with SSH from IBM Security Directory Integrator.
The idsdbrestore utility displays error messages
The idsdbrestore utility displays error messages if the ldapdb.properties file is modified. You must replace the ldapdb.properties file to resolve this issue.
The idsxinst tool fails
The idsxinst tool might fail to run or might not display the directory server instances if the file sets for the configured locale are not installed.
File path causes backup and restore to fail
The backup and restore operations with the Configuration Tool might not function because the file path is not valid.
Directory server instance starts in config-only mode
A directory server instance might start in config-only mode when you migrate from an earlier version by using Instance Administration Tool. When you provide values for migration by using Instance Administration Tool (idsxinst), ensure that the input values are representable in the system local code page.
The warning message GLPSRV147W is displayed
In an IBM Security Directory Server environment, a warning message with the message code GLPSRV147W might be displayed. This message might be because of the default value of write timeout that is set to 10 seconds.

Parent topic: Known limitations and general troubleshooting