IBM Support

PowerHA: UID and GID Mismatch and the Impact it has in a High Availability Environment

Troubleshooting


Problem

This document is intended to explain why it is important to keep UIDs and GIDs in sync, with in an HA environment.

Resolving The Problem

UID/GID mismatches can cause slow IASP vary ons.
A common cause for a UID/GID mismatch, is a lack of matching user profiles on each node in a high availability environment.
UID/GID mismatches can be recognized by looking in the call stack for function names such as transferFromDangler or transferOwnership. If either function appears in the call stack, there is a mismatch and the contents of the IASP are being corrected so they match what is in the system ASP.
The DSPASPSTS command also provides a quick snapshot of where the IASP vary on is in its process.
Note: Look for the step "UID/GID mismatch correction."

Sometimes, messages generated by a user profile also indicate that UID/GID information in the IASP must be corrected. With proper user profile administration (for example, not changing UIDs or GIDs), none of this processing is necessary.

When a UID/GID mismatch occurs and a user performs some form of a HA function (for example, vary on of IASP after FlashCopy, PPRC switchover, GeoMirror switchover, failover), the following occurs during the IASP vary on at the target/new production site:

1. Looks for missing profiles (that own objects in the IASP) and creates them
2. Looks for a UID/GID mismatch
3. Converts all files for the mismatched profile (Note: This conversion can take a long time if the profile owns many objects.)
4. Repeats for all mismatched profiles (Note: These conversions can take a long time.) 

Once a vary on completes the fix, it is not necessary for it to be run on a subsequent vary on of the same IASP (unless the values of the user profile in the system ASP are changed again). In optimal conditions, UID/GID cleanup runs quickly.
  • - Sample joblog of IASP vary on with mismatch occurrence and sample mismatch error message



    vrycfg geo001 *dev *on
    Object TESTPRF2 type *MSGQ created in library QUSRSYS.
    Special authorities granted *NONE.
    User profile TESTPRF2 created.
    /DEV/GEO001 directory created.
    /DEV/GEO001 file system mounted.
    UID or GID mismatch detected for QSECOFR.
    UID or GID mismatch detected for DABEARS.
    Ownership of object E in GEOLIB type *FILE changed.
    Ownership of object GEOLIB in QSYS type *LIB changed.
    Ownership of object D in GEOLIB type *FILE changed.
    Ownership of object C in GEOLIB type *FILE changed.
    Ownership of object B in GEOLIB type *FILE changed.
    Ownership of object F in GEOLIB type *FILE changed.
    Ownership of object A in GEOLIB type *FILE changed.
    UID or GID mismatch detected for TESTPRF2.
    Ownership of object TESTPRF2 in QSYS type *LIB changed.
    Journal receivers QSQJRN0002 and *N detached.
    Object QSQJRN0001 in QRCY00033 type *JRNRCV deleted.
    Object QSQJRN0002 in QRCY00033 type *JRNRCV deleted.
    ... 

    Message ID . . . . . . : CPDB714 Severity . . . . . . . : 20
    Message type . . . . . : Diagnostic
    Date sent . . . . . . : 09/28/24 Time sent . . . . . . : 15:45:01

    Message . . . . : UID or GID mismatch detected for TESTPRF2.
    Cause . . . . . : User profile TESTPRF2 owns or is authorized to objects in
    auxiliary storage pool (ASP) device GEO001 but the user identifier (UID) or
    group identifier (GID) recorded in the ASP does not match that of the user
    profile in the system ASP. The UID and GID information for the objects in
    the ASP is being changed to match that of the user profile.
    Recovery . . . : If the UID or GID difference results from switching the
    ASP among systems that do not all use identical UIDs and GIDs for the same
    user name, the user profiles in the system ASPs should be changed so that
    they do match. Having them match avoids a varyon performance penalty that
    is very significant when a large number of objects must be processed. The
    Users and Groups support under Management Central in System i Navigator can
    be used to correct existing differences and avoid introducing differences in
    the future.

  • - Sample SQL to check for UID/GID mismatch



    In a clustered environment, a user profile is assumed to be the same across servers if the profile names are the same. The name is the unique identifier in the cluster. However, a user profile also contains a user identification number (UID) and group identification number (GID). To reduce the amount of internal processing that occurs during a switchover, where the independent disk pool is made unavailable on one server and then made available on a different server, synchronize the UID and GID values across the cluster.

    When you switch an IASP between systems as part of a CRG, if the UID and GID are not in sync for each profile, the UID and GID of each object must be updated on each switch, for each object owned by the mismatched profile. Because this can take a long time, it is good to get the UID and GID synced for each profile on the system that uses objects in the IASP.

    To see whether the UID and GID for profiles are mismatched, do the following:

    1. On each system, on the operating system command line type the following:

    DSPUSRPRF USRPRF(*ALL) OUTPUT(*OUTFILE)

    Press the Enter key. Place the output files on the same system. In this case, one file is named FILE1 and the other file is named FILE2; they are in library LIB. If you use different names or libraries, the SQL statement would need to be updated.
    2. Run the SQL statement:

    select
    a.upuprf,
    a.upsyst,
    a.upuid,
    a.upgid,
    b.upuprf,
    b.upsyst,
    b.upuid,
    b.upgid
    from lib/file1 a inner join lib/file2 b on
    b.upuprf = a.upuprf
    where a.upuid <> b.upuid
    or a.upgid <> b.upgid

    Here is some sample output:

    User        System          USER ID        GROUP ID   User        System          USER ID        GROUP ID
                                NUMBER         NUMBER                                 NUMBER         NUMBER  
    PGUPTA      SYSTEM01          4,253               0   PGUPTA      SYSTEM02            569               0
    QAFDFTUSR   SYSTEM01            131               0   QAFDFTUSR   SYSTEM02            118               0
    QAFOWN      SYSTEM01            129               0   QAFOWN      SYSTEM02            116               0
    QAFUSR      SYSTEM01            130               0   QAFUSR      SYSTEM02            117               0
    QCLUMGT     SYSTEM01  4,294,770,723               0   QCLUMGT     SYSTEM02  4,294,770,724               0
    QCLUSTER    SYSTEM01  4,294,770,724               0   QCLUSTER    SYSTEM02  4,294,770,725               0
    QDCE        SYSTEM01            124               0   QDCE        SYSTEM02            113               0
    QDESADM     SYSTEM01            137             139   QDESADM     SYSTEM02            107               0
    QDESUSR     SYSTEM01            138             105   QDESUSR     SYSTEM02            108             101
    3. This generates an entry for each profile on each system that does not have an exact match for user profile name, UID, and GID on the other system. It does not list profiles that exist on one system, but not the other system.
    This does not show only profiles that own objects on the IASP; it shows profiles across the entire system.


Note1: For other methods to check mismatches as well as synchronize UIDs (user identifiers) and GIDs (group identifiers) across nodes in a HA environment, look into the use of a clustering function called Cluster administrative domain
Another option to aid in synchronizing UID/GIDs is using PowerHA Tools Smart Assist which is offered by IBM Lab Services.
For more information go to the Smart Assist for PowerHA on IBM i website.

Note2: Beginning with OS/400 720, the processing time for the 'UID/GID mismatch correction' step in the IASP vary on process is significantly reduced. Processing time for traditional /QSYS.LIB objects is  eliminated, and processing time for IFS objects is minimized. It is still recommended to synchronize the UID and GID attributes of user profiles using administrative domain to eliminate all UID/GID mismatch processing during vary on.

[{"Type":"MASTER","Line of Business":{"code":"LOB68","label":"Power HW"},"Business Unit":{"code":"BU070","label":"IBM Infrastructure"},"Product":{"code":"SWG60","label":"IBM i"},"ARM Category":[{"code":"a8m0z0000000CGgAAM","label":"High Availability"}],"ARM Case Number":"","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"All Versions"},{"Business Unit":{"code":"BU054","label":"Systems w\/TPS"},"Product":{"code":"SSB2MW","label":"PowerHA SystemMirror for i"},"Component":"","Platform":[{"code":"PF012","label":"IBM i"}],"Version":"All Versions","Edition":"","Line of Business":{"code":"","label":""}}]

Historical Number

583556146

Document Information

Modified date:
04 October 2024

UID

nas8N1011839

Page Feedback