none
Timeout when creating Set in FIM 2010 R2

    Question

  • Hi,

    I am experiencing a peculiar issue when creating a Set by using criteria in FIM 2010 R2. The Set is supposed to show users which still have EREs attached to them when they are about to be deleted.

    The criteria I am using is the ERE display name and the resource parent belonging to a set for users about to be deleted.

    When testing the set it works just fine, but when submitting it takes a long time, and eventually an error is displayed saying that a timeout has occured.

    Has anybody experienced this? And how can I fix it?

    Thanks

    Johan Marais


    JkM6228

    Friday, July 12, 2013 3:30 PM

Answers

  • Firstly, try rebuilding the full text index on the FIMService database, then try creating your set again.  I always ensure I have a SQL Agent job which rebuilds this automatically - nightly if need be.

    If you still can't create your set after this, you may need to redesign your set filters.  If it comes to this, can you post your filter definitions here so we can come up with some possible variations for you?


    Bob Bradley (FIMBob @ TheFIMTeam.com) ... now using Event Broker 3.0 for just-in-time delivery of FIM 2010 policy via the sync engine, and continuous compliance for FIM

    • Marked as answer by Johan Marais Tuesday, July 16, 2013 8:03 AM
    Monday, July 15, 2013 2:15 PM

All replies

  • Firstly, try rebuilding the full text index on the FIMService database, then try creating your set again.  I always ensure I have a SQL Agent job which rebuilds this automatically - nightly if need be.

    If you still can't create your set after this, you may need to redesign your set filters.  If it comes to this, can you post your filter definitions here so we can come up with some possible variations for you?


    Bob Bradley (FIMBob @ TheFIMTeam.com) ... now using Event Broker 3.0 for just-in-time delivery of FIM 2010 policy via the sync engine, and continuous compliance for FIM

    • Marked as answer by Johan Marais Tuesday, July 16, 2013 8:03 AM
    Monday, July 15, 2013 2:15 PM
  • Bob,

    Thanks for the reply. I have rebuilt the full text index, this helped.  What I did notice is that as the day carries on, the timeout on Set creation happens more often. I then leave it until next morning after which it succeeds.

    What I also noticed is that the timeout doesn't occur consistently for any type of Set criteria, for example if I want to get the users to which the AD sync rule apply it would timeout, but when I use the same criteria with a different Sync rule it would not timeout.  Even when doing the "View Members" under any criteria it works, it is only on submitting the Set that it timeout.

    My Set criteria is very simple, listing users who are to be deleted from AD which still have EREs for other MAs connected to them. I then retrieve the users from that Set to apply a WF and MPR to remove the relevant SR. here is the Set definition:

    1. To get EREs

    Select Expected rule entry that match all:

    Resource Parent in Set of users in Exit OU in AD

    Resource Parent In Set of users with Removal date

    Display name is "the name of the SR"

    2. To get the actual users from the 1st Set, I use an XPATH filter:

    <Filter xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" Dialect="http://schemas.microsoft.com/2006/11/XPathFilterDialect" xmlns="http://schemas.xmlsoap.org/ws/2004/09/enumeration">/Person[((ExpectedRulesList = /Set[ObjectID = '2c8337dc-e600-4a84-860d-ad4668ae0fbc']/ComputedMember))]</Filter>

    The highlighted part s the objectID of the 1st Set. 

    We can mark your reply as the answer as rebuilding the full text index does help, I just don't want to do the often during the day.

    I should also have added that my FIM solution is running on three servers:

    1. FIM Sync engine and DB

    2. FIM Service DB

    3 FIM Portal, Service SSPR registration and reset

    Regards

    Johan


    JkM6228

    Tuesday, July 16, 2013 8:03 AM
  • I am not surprised at the results you are getting - set creation working for a while after reindexing then performance deteriorating over time to the point it doesn't work - this is consistent with my experience.

    Try combining your first and second sets "Set of users in Exit OU in AD" and "Set of users with Removal date" into a single set (i.e. "Set of users in Exit OU in AD and with Removal date") then use this:

    Select Expected rule entry that match all:

    • Display name is "the name of the SR"
    • Resource Parent In Set of users in Exit OU in AD and with Removal date

    Notice the order of the criteria is reversed - I am not sure if this makes any difference, but I think it might actually perform better than the reverse (just try both and see - I suspect the underlying SQL query is actually constructed differently depending on the order, but I can't confirm this without running a SQL trace).


    Bob Bradley (FIMBob @ TheFIMTeam.com) ... now using Event Broker 3.0 for just-in-time delivery of FIM 2010 policy via the sync engine, and continuous compliance for FIM

    Tuesday, July 16, 2013 2:57 PM
  • Increase the dataReadTimeoutInSeconds and dataWriteTimeoutInSeconds in the FIM Service config file.


    http://www.wapshere.com/missmiis

    Wednesday, July 17, 2013 3:10 AM
  • Bob,

    I have tried to reverse the criteria, but that didn't make a difference.  Will see if the combination of the two Sets will better the performance.  If that doesn't work, I will try what Carol suggested.

    Will provide feedback.

    Thanks


    JkM6228

    Wednesday, July 17, 2013 7:13 AM
  • Carol,

    Thanks, will try this as well.  Is there some guidance on when one should increase the timeout values from the defaults? My FIM portal has about 250k objects, and I run the solution on three servers.

    Regards

    Johan


    JkM6228

    Wednesday, July 17, 2013 7:18 AM