Applies to:  

All versions of Centrify DirectAudit 


Problem:

Centrify dad daemon is running but dainfo shows it is offline.   Restarting the service does not help.

root@demorhel:/$ ps -ef | grep -w dad
root 10682502 3276990 4 May 02 - 1:46 /usr/sbin/dad


root@demorhel:/$ dainfo
Pinging adclient: adclient is available
Daemon Status: Offline
Current Collector:
Offline Store Size: 682.91 KB
Getting offline database information:
Size on disk: 1.78 MB
Database filesystem usage: 510.32 MB used, 1.50 GB total, 1.00 GB free
DirectAudit is enabled on the following:
/bin/bsh
/bin/csh
/bin/ksh
/bin/psh
/bin/tsh
/usr/bin/bsh
/usr/bin/csh
/usr/bin/dash_bin_bsh
/usr/bin/dash_bin_csh
/usr/bin/dash_bin_ksh
/usr/bin/dash_bin_psh
/usr/bin/dash_bin_tsh
/usr/bin/dash_usr_bin_bsh
/usr/bin/dash_usr_bin_csh
/usr/bin/dash_usr_bin_dzsh
/usr/bin/dash_usr_bin_ksh
/usr/bin/dash_usr_bin_psh
/usr/bin/dash_usr_bin_tsh
/usr/bin/dzsh
/usr/bin/ksh
/usr/bin/psh
/usr/bin/tsh 


Cause:

It would be best to run below command to identify what installation name is being used or are listed.

# dainfo --diag

The example below after running the above command may produce a list of more than one installation name.  In this output, it indicates that agent has been configured to use installation named “DefaultInstallation” which does not have any Audit Stores under it.  The agent needs to be configured to talk to the correct DA installation which would be either CentrifyDA-AuditServer-Prod or CentrifyDA-AuditServer-QA or CentrifyDA_Audit_Server_Prod or DefaultInstallation1

Establishing connection with dad: Success
Dad's current state: The agent is not in the scope of any Audit Store
The agent is not in the scope of any Audit Store
Dad's current Installation: 'DefaultInstallation' (configured locally)
Dad's current Audit Store: N/A
Dad's current Collector: N/A
........
.......
Installations:
   CentrifyDA-AuditServer-Prod          <--------------Installation name
      Active Directory Object: ###########
.......
.......
   CentrifyDA-AuditServer-QA               <-------------Installation name
      Active Directory Object: ###########
.......
.........
   CentrifyDA_Audit_Server_Prod         <-------------Installation name
      Active Directory Object: ###########


Resolution:

Run below command as root to configure the Unix agent to talk to the right installation.

# dacontrol -i <installation name> 


Cause #2

There may be cases where the UNIX/Linux DA agent is already connected to a DirectAudit installation, but is still showing the following error in the dadebug logs (shown in red)

/usr/bin/dainfo -d :
Establishing connection with dad: Success
Pinging adclient:  adclient is available
Daemon status:     Offline
(Both audit session and audit trail are not connected)
Current installation: 'Cooperators_DA_Prod' (configured locally)
Current state: The agent is not in the scope of any Audit Store (The agent is not in the scope of any audit store)
Current audit store: N/A
Current collector: N/A

It is seen here that the machine is connected to an installation, but still exhibiting the error. The issue here is that the machine was not added to the audit store scope.


Resolution: Use the Centrify Audit Manager Console to add the site where the audited machine is located to the audit store scope. This can be done using the following steps:


1) Open the Centrify Audit Manager console


2) Expand Installation Name > Then right-click the AuditStore and choose 'properties' 







3) Choose the 'scope' tab and choose 'add site' and add the site where the audited machine is located in Active Directory Sites & Services. 



*Note, the site where the machine is located can be found using the following methods:

a) When running the adinfo command, look at where it says 'Preferred Site'
b) When viewing the dadebug logs, there will be an entry that says 'Machine is in site <site name>'
c) By using the Active Directory Sites & Services console


4) Then on the affected machine(s) run the following commands:

# adflush -f
# daflush -i -n
# dareload


5) Run the dainfo command on each machine with the issue and they should now be connected and online