Symantec Access Management

  • Private Community

  • 1.  How to modify the value of "Server command synchronization delta"

    Broadcom Employee
    Posted Nov 08, 2012 10:57 AM

    Tuesday Tip by Vijay Masurkar, Principal Support Engineer, for 11-6-12


    By default in the smps log following is logged in case of R12:
    “…Server command synchronization delta is 0 second(s)…”

    Question:

    Which registry setting can be modified if I have to change this value?

    Answer:

    ServerCommandTimeDelay.

    Due to the differences in the system times of policy servers sharing a policy store, the store may not be updated consistently. To elaborate further, if multiple policy servers share a single policy store, the data inside the policy store could possibly be out of synchronization. Synchronization issues can occur under the following conditions:

    •
    The system times on the Policy Servers differ. For example, suppose the system time on Policy Server A is 10:00, and the system time on Policy Server B is 10:05. Policy Server A sends its data to the policy store at 10:00. Policy Server B does not record any changes in the data timestamped before 10:05 because those events appear to have occurred earlier.

    •
    Network latency. (So, even when clocks are synchronized but network latency or other factors skew the processing of Server Commands, it can help. )

    To accommodate different system times or network latency issues:

    1.
    Create the following DWORD registry setting for Windows OS for the policy server (REG_DWORD in sm.registry on Unix):
    SiteMinder\CurrentVersion\ObjectStore Key: ServerCommandTimeDelay

    (Be careful not to confuse this with ServerCmdDelay or ServerCmdMsec. ServerCmdDelay is the number of seconds the policy server caches server and/or agent commands before writing them out to the policy store journal. Using ServerCmdMsec, policy server server command replication can be made to use sub second recording and ordering.)

    2.
    Set the value of the key ServerCommandTimeDelay to the number of seconds that corresponds to the time difference. For example, for a five-minute time difference, set the value of the key to 300.



  • 2.  RE: How to modify the value of "Server command synchronization delta"

     
    Posted Nov 14, 2012 03:44 PM
    Thanks for the tip Vijay! :grin:


  • 3.  RE: How to modify the value of "Server command synchronization delta"

    Posted Feb 01, 2013 04:18 PM
    Hi Vijay,

    We are running into an issue where because of AD replication limitations, we need to tweak ServerCommandTimeDelay to something like 15-20minutes. Before we do that:

    1. is this value too high?
    2. can it have other consequences?
    3. will we still be "supported" ?
    4. Any other options to alleviate AD replication limitation

    BTW, we already set the notify option to make AD site-to-site replication quicker but we are still seeing fluctuation replication times. To be safe we would like to set above, if possible.

    Thanks
    Ritesh


  • 4.  RE: How to modify the value of "Server command synchronization delta"

    Broadcom Employee
    Posted Feb 05, 2013 12:34 PM
    Ritesh,
    This value seems be too high.

    But it really depends on your specific environment, differences in clock times on your policy servers sharing a policy store and network latency. That is noted in the tip above. You don't want to try to fix a glaring clock time difference or network latency issue with ServerCommandTimeDelay. There are other ways to fix time differences; ntp, etc.

    You should also consult your network administrator to find out why (if) there is a serious network latency.

    You mention "notify option to make AD site-to-site replication quicker ". Please clarify this. Are you referring to the value for the delay between an originating update on a domain controller and the first change notification?

    - best wishes. Vijay