Data In Hands
Menu
OID/DIP synchronization diagnostics: profile direction, checkpoints and change numbers

OID/DIP Synchronization Diagnostics: Profile Direction, Checkpoints and Changelog

Separate profile direction, checkpoint source and processing logs when investigating delayed synchronization. Oracle 11g documents orclodipConDirLastAppliedChgNum as an import checkpoint for connected-directory changes applied to OID, not an OID changelog checkpoint. The original commands below have not been validated for the installed version, client syntax or change-number namespace. Do not run them as written.

Security note: Do not use the sample password welcome1. Passing a secret with -w can expose it in process arguments even if it comes from an environment variable. Verify supported authentication and TLS; do not assume port 3060 is encrypted.

1) Find the profile DN

Identify the instance and exact profile DN. Import runs from the connected directory to OID; export runs from OID to the connected directory. Record the direction and connector before choosing a checkpoint.

Why run: Use the correct profile to avoid mixing state and logs. Finding its DN does not authorize direct modification of synchronization status attributes.
What it means: The returned dn: identifies the profile query target. Changelog and rootDSE searches use separate bases; it is not the base for every command.
# List agent profiles under "subscriber profile" and print only DN
ldapsearch -LLL -h dip11g -p 3060 \
  -D cn=orcladmin -w welcome1 \
  -b "cn=subscriber profile,cn=changelog subscriber,cn=oracle internet directory" \
  -s one "(objectClass=orclodipagentprofile)" dn

2) Read orclodipConDirLastAppliedChgNum

Oracle 11g defines this attribute as the import checkpoint for connected-directory changes applied to OID. Distinguish it from an OID export checkpoint and verify the installed version and connector semantics.

Why run: Identify the checkpoint and verify that any comparison uses the same source and change-number namespace.
What it means: This attribute has Directory String syntax. Do not compare an AD import value directly with OID cn=changelog numbers. Even within one verified stream, check filters, mappings and processing records before calling a change pending.
ldapsearch -LLL -h dip11g -p 3060 \
  -D cn=orcladmin -w welcome1 \
  -b "orclodipagentname=MsadSyncProfile,cn=subscriber profile,cn=changelog subscriber,cn=oracle internet directory" \
  -s base "(objectClass=*)" orclodipConDirLastAppliedChgNum

Shell capture example — validate output and data type first

LAST=$(ldapsearch -LLL -h dip11g -p 3060 \
  -D cn=orcladmin -w welcome1 \
  -b "orclodipagentname=MsadSyncProfile,cn=subscriber profile,cn=changelog subscriber,cn=oracle internet directory" \
  -s base "(objectClass=*)" orclodipConDirLastAppliedChgNum |
  awk '/orclodipcondirlastappliedchgnum:/ {print $2}')

echo "LAST = ${LAST}"
Example: 49204 and 49205 illustrate a verified numeric stream only. The case-sensitive awk pattern in the example can return an empty value for differently capitalized output. Confirm query success, value format and source before using LAST+1 arithmetic.

3) Verify direction and namespace before comparing changelog

cn=changelog contains OID changes. The original example comparing it with a connected-directory import checkpoint is not a general diagnostic method. Verify version-specific profile attributes and search schema, then compare only one change stream.

Why run: Validate the comparison and query first. The original filter uses chgNumber but requests changeNumber; verify both against the installed schema.
What it means: Neither outcome proves completion or failure. No result also requires checking access, query errors, retention and search scope. A hit requires checking profile filters, mappings and actual application records.
# If LAST=49204, see if 49205+ exists (just 1 record is enough)
ldapsearch -LLL -h dip11g -p 3060 -D cn=orcladmin -w welcome1 \
  -b "cn=changelog" "(chgNumber>=$((LAST+1)))" changeNumber -z 1

4) (Optional) Check change-number scope and query support

For OID change-stream diagnostics, verify rootDSE attribute support and changelog retention. Sorting flags depend on the LDAP client; the original query does not establish a maximum until its syntax and behavior are validated.

Why run: Compare a checkpoint and range from the same verified source. Do not calculate lag by subtracting a connected-directory import value from an OID change number.
What it means: A high absolute number does not prove recent activity. Even in one verified namespace, a numeric gap is not elapsed delay or the number of applicable changes. Check time-series observations, filters, retention and application records.

4-1. RootDSE lastChangeNumber

ldapsearch -LLL -h dip11g -p 3060 \
  -D "cn=orcladmin" -w welcome1 \
  -b "" -s base "(objectClass=*)" lastChangeNumber

4-2. Changelog sorting example — validate client syntax

ldapsearch -LLL -h dip11g -p 3060 -D cn=orcladmin -w welcome1 \
  -b "cn=changelog" -s one "(objectClass=*)" changeNumber -S changeNumber:desc -z 1

5) Recommended checks & actions

  • Profile property: verify import/export direction and checkpoint source first. Do not use (chgNumber >= LAST+1) until namespace, numeric format and schema are confirmed
  • Mode/control: verify version-specific meanings of orclodipSynchronizationMode and orclodipAgentControl, then compare profile status, schedule, retries, filters and mappings
  • Reader log: treat Searching changelog with base=cn=changelog as an original example, not a universal marker. Match log level, rotation, profile and time; trace query and application outcomes
  • Force reset (caution): do not use checkpoint reduction as a routine fix. Require a supported installed-version procedure, replay scope and recovery plan before any separately approved change
  • Replication load: the original oidmon -cmd showreplmon example has not been validated. Use supported version-specific tools and time-aligned evidence before inferring contention

6) Checkpoint-change risks and supported procedures

Changing a checkpoint is not a rollback of directory data. Oracle 11g discourages arbitrary synchronization-status changes. The original LDIF and ldapmodify examples remain for review only; their support has not been established. Do not apply them as written.

Why run: Avoid assuming LAST caused the delay. First check direction, filters, schedule, retries and errors; any necessary change requires the correct attribute and supported installed-version management procedure.
What it means: An incorrect checkpoint can stop synchronization or cause erroneous application. Lowering it can cause replay, duplication or ordering problems and cannot restore purged changes. A profile backup alone does not guarantee safe recovery.

6-1. Backup the profile entry (LDIF)

ldapsearch -LLL -h dip11g -p 3060 -D "cn=orcladmin" -w welcome1 \
  -b "orclodipagentname=MsadSyncProfile,cn=subscriber profile,cn=changelog subscriber,cn=oracle internet directory" \
  -s base "(objectClass=*)" \* + > MsadSyncProfile_backup.ldif

6-2. Original LDIF — do not apply before support verification

dn: orclodipagentname=MsadSyncProfile,cn=subscriber profile,cn=changelog subscriber,cn=oracle internet directory
changetype: modify
replace: orclodipConDirLastAppliedChgNum
orclodipConDirLastAppliedChgNum: 49200

6-3. Original apply command — review only, do not execute

ldapmodify -h dip11g -p 3060 -D "cn=orcladmin" -w welcome1 -f reset_last.ldif
Note: A state change requires separate approval, a supported procedure, retained replay range, impact analysis and recovery criteria. 49200 is not a recommended safe value. One post-restart log line does not prove recovery.

7) Reader debugging tips

Match profile and time, then distinguish query attempts, read results and mapping/application outcomes. First identify the change source used by the import connector.

Why run: Pre-query errors and post-read application errors require different responses. Check status, scheduling and retry records as well.
What it means: A missing Searching changelog with base=cn=changelog line does not prove no query occurred. Verify version, logging level, rotation and process. Its presence does not prove successful querying or application either.
  • The original JPS security-debug flag -Doracle.security.jps.debug=true does not guarantee DIP Reader tracing. Verify version-specific logging, sensitive-data handling and a stop plan before enabling it
  • Log needle: Searching changelog with base=cn=changelog
© Data In Hands · OID/DIP Operations Guide. Original commands are review examples; do not execute before validating version, authentication, change namespace and supported procedures.
Scroll to Top