DirectAudit Prevents Control-M Jobs From Running
07-30-2015 07:29 AM - last edited 12-20-2015 08:10 PM
We have seen an issue Control-M jobs failing with DirectAudit turned on UNIX systems.
The solution is to run dastop, disable DirectAudit, after which the jobs run successfully.
It was determined that Control-M was seeing the accounts shell as "CentrifyDA" instead of the right shell for that account that called the job to run. Control-M didn’t know how to handle this so it stopped the job from running.
As I understand it, CentrifyDA wraps around the account in order to audit the accounts actions and passes the shell when called, but Control-M only sees the wrapped CentrifyDA shell.
Now we have started to see Control-M jobs fail even with CentrifyDA turned off and we are unsure why. Starting CentrifyDA and stopping it seems to temporarily solve this issue, but in short order the issue returns
07-30-2015 12:17 PM
I have seen this on the field yes, this is caused by Control-M not understanding the answer of the Centrify DA NSS module and then failing to switch to the correct shell to execute batch jobs. This is more likely to hapens for jobs run into csh.
The way to avoid this is to configure DirectAudit so it will not answer anything to the p_ctmag daemon (Control-M agent). There is a KB article that explain the details for setting this into the configuration file:
KB-4301: Unable to run Control M batch job after enabling audit
Hope that helps.
Don't forget to mark posts as "Solution" to help other identify quickly the answers. And don't be afraid to deliver Kudos as well when you are happy with the solution ;)