ADSI Account Incremental Import Job takes very long time

[binoy]

Hi team,

We have an Active Directory environment with 50k accounts and 10k entitlements. There are two trusted domains which is why we used the ADSI Connector. Both the ADSI Account Incremental Job and Full Import Job takes almost half an hour.

The ADSI Connector documentation mentions "To store the cookie information for each domain, specify the value of the IMPORTDATACOOKIES parameter. It is a hidden parameter and is used for incremental imports."

We checked the ADSI Connection config, ADSI and Saviynt logs and can see the domain cookie information read and updated correctly for Incremental Import. We can also see in the logs that only a few AD accounts are read and processed with a few minutes as part of adsi.AdsiImportService. But the Job still runs for half an hour, which defeats the purpose of quick incremental imports.

[sudeshjaiswal]

Hello @binoy,

Can you verify whether the data was successfully imported during the execution of the incremental job? The current concern is that the job is running, but it's taking an extended amount of time to complete.

Could you provide your observance from the ECM logs and ADSI agent logs?
To do so, enable the request and response verbose mode, setting it to "1" in the web.config file on the IIS Server.

Thanks.

[binoy]

Hi @sudeshjaiswal 

For ADSI agent log, you asked to "enable the request and response verbose mode, setting it to "1" in the web.config file on the IIS Server". Do you have an example of this? I've not seen any such example. This is what we have, in the web.config and ADSI logs have debug statements.

I've attached the ECM and ADSI logs in the support ticket.

Thanks

[rushikeshvartak]

To enable request and response verbose mode with a setting of "1" in the web.config file on the IIS (Internet Information Services) Server, you can follow these steps:

1. **Locate your web.config file:**
- Navigate to the root directory of your web application where the web.config file is located.

2. **Open the web.config file in a text editor:**
- Use a text editor (e.g., Notepad, Visual Studio Code) to open the web.config file.

3. **Add or modify the following settings:**
- Inside the `<system.web>` or `<configuration>` section, add or modify the following settings to enable verbose mode:

```xml
<system.web>
<!-- Other settings may be present -->

<trace enabled="true" requestLimit="40" pageOutput="true" traceMode="SortByTime" localOnly="false"/>
<customErrors mode="Off"/>
</system.web>
```

Ensure that the `enabled` attribute is set to "true" in the `<trace>` element.

4. **Save the changes:**
- Save the web.config file after making the modifications.

5. **Restart IIS:**
- After saving the changes, restart the IIS server to apply the new configuration.

You can do this by opening a command prompt and running the following command:

```bash
iisreset
```

Please note that enabling verbose mode in a production environment may expose sensitive information and should be done with caution. Additionally, make sure to test the changes in a development or staging environment before applying them to a production server.

[binoy]

I've uploaded the ADSI agent logs as well. It is evident that the ADSI agent returns the response within a minute. But the Job still takes a long time.

[binoy]

Hi team,

Any update on this one please?

Thanks

[rushikeshvartak]

For an incremental account import, the UPDATEDATE attribute of the connector (specified in ACCOUNT_ATTRIBUTE) looks for the maximum value of the Active Directory whenChanged account attribute.

For an incremental group import, the incrementalTimeField attribute of the connector (specified in groupImportMapping) look

[binoy · Accepted solution]

Saviynt Support discovered that this issue was because there were 40K uncorrelated accounts which took 15 minutes to check for correlation even during the incremental job.

Thanks.