Explanation of database mirroring:
The database mirroring feature is intended to improve efficiency on LDAP lookups on Agent Handlers. This feature works with the LDAP sync task, which is a new server task also introduced in ePO 4.6.6. When the LDAP sync task runs, it pulls information from registered LDAP servers and stores it in the ePO database. The LDAP sync task populates the tables in the ePO database that begin with the name "
OrionLdap". For example:
- OrionLdapRequiredItems
- OrionLdapItems
- OrionLdapChildren
- OrionLdapServers
With the database mirroring feature disabled:
- When a client computer sends user data, the Agent Handler must perform an LDAP lookup. This action is to determine the group membership of the user to see whether a user-based policy applies.
- The Agent Handler queries the registered LDAP server. If information about the user is found, either of the following applies:
- It's stored in a local cache on the Agent Handler for up to 30 minutes.
- The ePO Server detects the LDAP change.
If an LDAP change is detected, a signal is sent to the Agent Handlers to flush the cache. Any arbitrary change to a registered LDAP server triggers a cache flush.
The LDAP query can take a significant amount of time to complete, which can drive up session times and lead to max connection issues on the Agent Handler. This situation is wherein database mirroring can help. When the database mirroring feature is enabled, the Agent Handler changes LDAP queries into database queries. The Agent Handler follows the same algorithm as when the database mirroring feature is disabled. But, instead of querying LDAP, it queries the database tables populated by the LDAP sync task to look up information about the users. This query is treated as an authoritative lookup, which means that if the user information isn't found in the database, the lookup fails. It doesn't use LDAP as a fallback because that would introduce the very performance issue the feature is intended to address. Failed LDAP lookups can potentially take much longer to complete than successful ones.
Benefits of database mirroring:
Here are the benefits of enabling the database mirroring feature:
- Increased efficiency on the Agent Handlers. Database queries return much faster than LDAP lookups. The result is less time to process agent-server communication requests.
- Decreased load on the LDAP servers. The LDAP sync task queries the LDAP Server using the information stored in the database. This query is executed rather than each Agent Handler querying the LDAP server if the information isn't currently in the local LDAP cache on the Agent Handler.
- Agent Handlers no longer need ports opened up to LDAP servers because they can pull the LDAP information they need from the database. This feature is especially useful if the Agent Handler is in a DMZ.
The only known downside in enabling the feature is a delay in successful lookups for newly added users associated with user-based policies. If a new user is added to a group associated with a user-based policy, that user-based policy lookup fails until the LDAP sync task runs and adds that user's information to the database.
Enable database mirroring:
The database mirroring feature is disabled by default. You can enable database mirroring using these steps:
- Log on to the ePO console.
- Navigate to Menu, Configuration, Server Settings.
- Click User Policies, Edit.
- Set Database Mirroring to Enabled.
- Click Save.
- Apply the policy to the systems.
