Check long running user provisioning task progress

[Chenyang]

Hi IdM friends,

I launched a job to assign business roles to users with context enabled provileges. The task itself completed successfully but the user provisioning has been lasted more than 24 hours. I want to understand when the user provsioning tasks can be completed? Is there a way to check?

I used to check the table mxp_provision to get a rough idea how many pending tasks are left. But this one is not accruate any more. There are less than 100 entries in the table but I can tell it keeps refreshing and there are always new tasks added to the table.

Any help will be appreciated.

Thanks

Chenyang Xiong

[Steffi_Warnecke]

Hello Chenyang Xiong,

24 hours and it's still going? Sounds like there is a loop somewhere.

.

On the admin UI (http://.../idm/admin) you can use the "Monitoring" tab. In the dropdown you have the provisioning queue and the provisioning audit. I'd check for a identity in the audit, if it keeps popping up there. Then they might be looping (doing the assigning and provisioning over and over again).

And in the provisioning queue you can see, how many entries for which tasks are still going.

.

If you don't have access to the admin UI yet, your portal user needs the portal UME role "idm.monitoring" with the UME action "tc~idm~jmx~ump.idm_monitoring_administration".

.

Regards,

Steffi.

[Chenyang]

Hi Artem,

It sounds a good option. But I guess you won't see the entries in the mxi_link or idmv_link_ext table, before the role structure are explanded, right?

[former_member358098]

Yes, method that I proposed is far from perfect. As you mentioned all structure of role will not be there, but the role itself will be with state 1, so you can count it as a whole.

Also this method is not ideal because if some of your systems are not available and provision finished with error that link will stay in state 1, which will mess any further calculations. But we couldn't find any better options for years.

[Chenyang]

Hi Steffi,

Thanks for your help. I doubled the CPU number in half way and the user provisioning finally finished after 60 hours.

I did monitor the provision queue and there aren't many tasks (5-6 tasks maybe) there. The queue is freshed also fairly quickly.

It seems the IdM engine didn't load all the tasks in the queue. The business role assignment to a user may take a few hours to expand its role structure, and wait another few hours to provision. I understand there might be complexity, but I need to know how to check the provisioning progress.

Thanks,

Chenyang

[former_member358098]

If you're talking only about only assignments roles/privileges to users you can check the idmv_link_ext view with mclinkstate=1, this is the ones that are awaiting process (also 0 are already processed and active links).