This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Synchronizing suscribed groups

We have an issue with sync with ad.

when we test it manually with "authentication services" --> servers, I get "server test passed"

single sign on in also joined to the domain.

we get following error.

There was an error synchronizing subscribed groups. The Sophos UTM will continue to operate with a locally cached copy of the data but will be unable to update from Directory Services until the issue is resolved.

Error was:
failed to run samba command on domain.LOCAL, exiting now

--
HA Status          : HA MASTER (node id: 1)
System Uptime      : 6 days 23 hours 48 minutes
System Load        : 0.38
System Version     : Sophos UTM 9.310-11

Please refer to the manual for detailed instructions.

The send limit for this notification has been reached. No further notifications of this type will be sent during this period.

This thread was automatically locked due to age.

Parents

0 PepijnDeneut over 9 years ago

Correct,

I also see that the groups are being updated correctly.
Thanks for the feedback.
Cancel
Vote Up 0 Vote Down

Cancel

0 nyc2mia over 9 years ago in reply to PepijnDeneut

Hi, folks,

I know this thread is several months old, but I wanted to ask if there might be any additional information on this issue, because I started getting the following notifications again:

[WARN-531] Directory Services synchronization
There was an error synchronizing subscribed groups. The Sophos UTM will continue...

Error was:
failed to run samba command on domain.tld, exiting now
...

While looking around, I saw mention that this might be a false positive issue that would be addressed in version 9.313. Well, I'm on 9.350, and I'm still seeing this problem.

Take a look at the following snippets of my fallback.log both before and after I manually kick off the AD sync:

# grep "ad-sync.plx" /var/log/fallback.log
2015:10:15-14:39:01 utm [daemon:notice] ad-sync.plx[1111]:  [ad-sync] started
2015:10:15-14:39:32 utm [daemon:err] ad-sync.plx[1111]:  [ad-sync] error returned from samba command on DOMAIN.TLD
2015:10:15-14:40:02 utm [daemon:err] ad-sync.plx[1111]:  [ad-sync] error returned from samba command on DOMAIN.TLD
2015:10:15-14:40:02 utm [daemon:err] ad-sync.plx[1111]:  [ad-sync] failed to run samba command on DOMAIN.TLD, exiting now

# /var/storage/chroot-http/usr/bin/ad-sync.plx -v
started
running: /usr/sbin/net ads -w 'DOMAIN.TLD' -U 'user%password' dn '' 'defaultNamingContext' -p 3268
default naming context: DC=domain,DC=tld
discovered base_dn: DC=domain,DC=tld
running: /usr/sbin/net ads -w 'DOMAIN.TLD' -U 'user%password' dn '' 'schemaNamingContext' -p 3268
default naming context: CN=Schema,CN=Configuration,DC=domain,DC=tld
running: /usr/sbin/net ads -w 'DOMAIN.TLD' -U 'user%password' dn 'CN=Aggregate,CN=Schema,CN=Configuration,DC=domain,DC=tld' 'attributeTypes' -p 3268
running: /usr/sbin/net ads -w 'DOMAIN.TLD' -U 'user%password' search '(&(ObjectClass=trustedDomain))' 'cn' -p 3268
enumerating domains: DOMAIN.TLD
syncing the primary domain DOMAIN.TLD...
running: /usr/sbin/net ads search '(objectClass=group)' 'distinguishedName' 'objectSID' 'memberOf' -w 'DOMAIN.TLD' -U 'user%password' -p 3268
parsing xx replies
running: /usr/sbin/net ads search '(&(objectClass=user)(objectClass=organizationalPerson)(!(objectClass=computer))(!(userAccountControl[:D]n:1.2.840.113556.1.4.803:=2)))' 'distinguishedName' 'objectSID' 'memberOf' 'userPrincipalName' 'sAMAccountName' 'primaryGroupID' -w 'DOMAIN.TLD' -U 'user%password' -p 3268
parsing yy replies
primary domain DOMAIN.TLD synched
done

# grep "ad-sync.plx" /var/log/fallback.log
2015:10:15-14:39:01 utm [daemon:notice] ad-sync.plx[1111]:  [ad-sync] started
2015:10:15-14:39:32 utm [daemon:err] ad-sync.plx[1111]:  [ad-sync] error returned from samba command on DOMAIN.TLD
2015:10:15-14:40:02 utm [daemon:err] ad-sync.plx[1111]:  [ad-sync] error returned from samba command on DOMAIN.TLD
2015:10:15-14:40:02 utm [daemon:err] ad-sync.plx[1111]:  [ad-sync] failed to run samba command on DOMAIN.TLD, exiting now
2015:10:15-15:30:58 utm [daemon:notice] ad-sync.plx[5935]:  [ad-sync] started
2015:10:15-15:30:59 utm [daemon:notice] ad-sync.plx[5935]:  [ad-sync] syncing the primary domain DOMAIN.TLD...
2015:10:15-15:31:00 utm [daemon:notice] ad-sync.plx[5935]:  [ad-sync] parsing 69 replies
2015:10:15-15:31:00 utm [daemon:notice] ad-sync.plx[5935]:  [ad-sync] parsing 18 replies
2015:10:15-15:31:00 utm [daemon:notice] ad-sync.plx[5935]:  [ad-sync] primary domain DOMAIN.TLD synched
2015:10:15-15:31:00 utm [daemon:notice] ad-sync.plx[5935]:  [ad-sync] done

Funny thing is I didn't make any changes. I didn't resync time on my domain controller, and I didn't change any passwords. All I did was check the log, run the script and check the log again. I should mention that, at some point, the sync will fail again. That's how I know to check the log and manually kick off the sync.

What gives? More importantly, how do I fix it? [:S] Help! [:(]

UTM 9 Home Use

Reply

0 nyc2mia over 9 years ago in reply to PepijnDeneut

Hi, folks,

I know this thread is several months old, but I wanted to ask if there might be any additional information on this issue, because I started getting the following notifications again:

[WARN-531] Directory Services synchronization
There was an error synchronizing subscribed groups. The Sophos UTM will continue...

Error was:
failed to run samba command on domain.tld, exiting now
...

# grep "ad-sync.plx" /var/log/fallback.log
2015:10:15-14:39:01 utm [daemon:notice] ad-sync.plx[1111]:  [ad-sync] started
2015:10:15-14:39:32 utm [daemon:err] ad-sync.plx[1111]:  [ad-sync] error returned from samba command on DOMAIN.TLD
2015:10:15-14:40:02 utm [daemon:err] ad-sync.plx[1111]:  [ad-sync] error returned from samba command on DOMAIN.TLD
2015:10:15-14:40:02 utm [daemon:err] ad-sync.plx[1111]:  [ad-sync] failed to run samba command on DOMAIN.TLD, exiting now

# /var/storage/chroot-http/usr/bin/ad-sync.plx -v
started
running: /usr/sbin/net ads -w 'DOMAIN.TLD' -U 'user%password' dn '' 'defaultNamingContext' -p 3268
default naming context: DC=domain,DC=tld
discovered base_dn: DC=domain,DC=tld
running: /usr/sbin/net ads -w 'DOMAIN.TLD' -U 'user%password' dn '' 'schemaNamingContext' -p 3268
default naming context: CN=Schema,CN=Configuration,DC=domain,DC=tld
running: /usr/sbin/net ads -w 'DOMAIN.TLD' -U 'user%password' dn 'CN=Aggregate,CN=Schema,CN=Configuration,DC=domain,DC=tld' 'attributeTypes' -p 3268
running: /usr/sbin/net ads -w 'DOMAIN.TLD' -U 'user%password' search '(&(ObjectClass=trustedDomain))' 'cn' -p 3268
enumerating domains: DOMAIN.TLD
syncing the primary domain DOMAIN.TLD...
running: /usr/sbin/net ads search '(objectClass=group)' 'distinguishedName' 'objectSID' 'memberOf' -w 'DOMAIN.TLD' -U 'user%password' -p 3268
parsing xx replies
running: /usr/sbin/net ads search '(&(objectClass=user)(objectClass=organizationalPerson)(!(objectClass=computer))(!(userAccountControl[:D]n:1.2.840.113556.1.4.803:=2)))' 'distinguishedName' 'objectSID' 'memberOf' 'userPrincipalName' 'sAMAccountName' 'primaryGroupID' -w 'DOMAIN.TLD' -U 'user%password' -p 3268
parsing yy replies
primary domain DOMAIN.TLD synched
done

# grep "ad-sync.plx" /var/log/fallback.log
2015:10:15-14:39:01 utm [daemon:notice] ad-sync.plx[1111]:  [ad-sync] started
2015:10:15-14:39:32 utm [daemon:err] ad-sync.plx[1111]:  [ad-sync] error returned from samba command on DOMAIN.TLD
2015:10:15-14:40:02 utm [daemon:err] ad-sync.plx[1111]:  [ad-sync] error returned from samba command on DOMAIN.TLD
2015:10:15-14:40:02 utm [daemon:err] ad-sync.plx[1111]:  [ad-sync] failed to run samba command on DOMAIN.TLD, exiting now
2015:10:15-15:30:58 utm [daemon:notice] ad-sync.plx[5935]:  [ad-sync] started
2015:10:15-15:30:59 utm [daemon:notice] ad-sync.plx[5935]:  [ad-sync] syncing the primary domain DOMAIN.TLD...
2015:10:15-15:31:00 utm [daemon:notice] ad-sync.plx[5935]:  [ad-sync] parsing 69 replies
2015:10:15-15:31:00 utm [daemon:notice] ad-sync.plx[5935]:  [ad-sync] parsing 18 replies
2015:10:15-15:31:00 utm [daemon:notice] ad-sync.plx[5935]:  [ad-sync] primary domain DOMAIN.TLD synched
2015:10:15-15:31:00 utm [daemon:notice] ad-sync.plx[5935]:  [ad-sync] done

UTM 9 Home Use

Children

No Data