2.1 Novell eDirectory or NDS Error Code List

Warning: Applying all solutions mentioned in this topic could make the problem worse if the actual cause of the problem is not known. Before following a course of action, make sure that you understand the cause of the error and the consequences for the actions suggested.

The serial numbers are in the following ranges:

The error code is returned in context of the following messages:

"NWDS-4.0-624: The login script file could not be opened. Return Code: 1729:-128."

"NETADMIN-4.55-110: The utility can't open the script file. Error Code: FF80."

The information should be saved and the error will not occur.

The login script should now be closed and can be reopened for editing.

If the Supervisor account has been locked by Intruder Detection, the console cannot be unlocked; therefore, enable login cannot be entered at the server console prompt. In this case, the server must be rebooted. After the server is up, enable login can be typed at the server console prompt.

Replace the application or utility with one that encrypts passwords when making calls to log in, verify, or change passwords. If the utility is a NetWare 2.x utility, replace it with a NetWare 3.x, 4.x, or 5.x utility.

If appropriate, allow unencrypted passwords using the set command.

A bindery API request was received that was attempting to remove an object from a trustee assignment where the specified object does not exist as a trustee.

If you are using NDS Manager, do the following actions in order:

The file extension shown in parentheses represents the country code the workstation is using, which is set in config.sys. For example, *.001 is US English. The country code may be different from the one shown here.

In the DOS, Windows, and OS/2* environments, the program searches the following areas for the Unicode files:

The following four files must be in one of these locations of the user's search drive, or this error message is displayed:

If the unicode.nlm is unable to translate the data for eDirectory or NDS, then the data cannot be used.

Or, copy the files from an equivalent server’s sys:public/nls directory.

If after doing all the listed actions the problems still persists, contact a Novell Support Provider.

If using an earlier version of the NLM program, do the following:

The external reference might have been removed or overwritten by an incoming replica.

If the replica is incoming, then it should get updated into the replica ring and should be notified and should correct itself. If the error does not correct itself in this case, contact a Novell Support Provider.

Identify which object is returning the -601 error. To do this, use the set DSTRACE=+sync command on both the source and the target server and on any other servers in the replica list.

If the object with the error is not a server object, try deleting it.

If the object with the error is a server object, see if DSTRACE returns any other errors besides -601. Address those errors, if any.

You can use the Partition Continuity feature of NDS manager to evaluate the partition for synchronization errors. NDS manager has several repair functions that allow you to correct synchronization errors without having to run DSREPAIR from the server.

If Partition Continuity shows no errors besides -601, use NDS manager to send updates from a replica that does not have the error, or receive updates on the replica with the error.

If the problem is with inconsistencies inside the partition, such as objects on different replicas not being the same, use the Send All Objects option or Receive All Objects option in DSREPAIR to update replicas of a partition on the servers holding replicas.

Warning: Applying all solutions mentioned in this topic could make the problem worse if the actual cause of the problem is not known. Before following a course of action, make sure that you understand the cause of the error and the consequences for the actions suggested.

If it is the server’s public keys and that server is a critical server, then contact a Novell Support Provider for assistance in restoring the server’s keys.

If either of these messages is displayed without an error code, do the following action that is applicable to the error displayed: Error unable to communicate or Error sending updates.

The request might be

If the object is a simple object, such as a single user that is not a critical user, delete and recreate the problem object.

If it is the source server that is missing the attribute, then use DSREPAIR to perform a Receive All Updates from the Master to This Replica operation on the source server.

Warning: When a Send All Objects to Every Replica in the Ring operation is performed on large partitions or partitions with numerous replicas, considerable traffic on the network can result.

The request might be

If the error persists, contact the developer of the application.

This case is evident if the server name appears with the old name in DSREPAIR and with the new name at the console prompt.

You can also determine whether this is the cause by using DSTRACE and turning on +limber *l to view the error.

set DSTRACE = +limber *l

Warning: Applying all solutions mentioned in this topic could make the problem worse if the actual cause of the problem is not known. Before following a course of action, make sure that you understand the cause of the error and the consequences for the actions suggested.

You can use noneffective classes as super classes. These noneffective classes define information associated with various effective classes.

The only attributes that are supported for an eDirectory or NDS object are listed within the expanded eDirectory or NDS schema class definition of the object’s base class.

If you suspect that the database on the source server is the problem, try repairing it using DSREPAIR with Rebuild Operational Schema selected.

If you suspect that the database on the source server is the problem, try repairing it using DSREPAIR with Rebuild Operational Schema selected.

When creating an eDirectory or NDS object, the object can only be created as a child of an object whose base class is specified within the containment list of the new object’s expanded eDirectory or NDS schema class definition.

For example, the object class Country can only be created at the top of the eDirectory or NDS tree. The object class User can only be created under Organization object containers and Organizational Unit object containers. The schema enforces the containment rules for eDirectory or NDS.

This error might appear in NDS manager when moving a partition.

Warning: Applying all solutions mentioned in this topic could make the problem worse if the actual cause of the problem is not known. Before following a course of action, make sure that you understand the cause of the error and the consequences for the actions suggested.

If a new NetWare 4.1 (or later version) server hangs during installation while copying over the existing eDirectory or NDS objects, run DSTRACE on the server holding the master replica of the partition that you are installing the server into. Do this by setting the set DSTRACE = +sync command.

If an error exists after running DSTRACE, run DSREPAIR on the master.

If the problem still exists, run the set DSTRACE = +sync command to find the object returning the error and check the description field (and any other field which accepts a string) for any unusual ASCII characters. Correct the corruption or delete the object, and the replica should complete copying to the new server.

The record structure of the eDirectory or NDS database is checked when loading eDirectory or NDS (ds.nlm) and during any attempts to abort an eDirectory or NDS activity.

If TTS was disabled because volume sys: is full, log into the server and delete unnecessary files from volume sys: and then type enable tts at the console.

To avoid TTS being disabled in the future, maximum transaction tracking can be lowered.

Set the maximum value to 2,000 by typing the following at the console prompt:

set maximum transactions=2000

If the target server already holds a replica and it is not listed in the replica ring on the server holding the master replica, destroy the replica on the target server, and add it again using Partition Manager in NDS manager.

If the read/write replica does not have a target server but the master does, perform a Send All Objects to Every Replica in the Ring operation from DSREPAIR.

Ensure that the source server can communicate with the target server. To verify whether they are communicating, type display servers on the source server.

Determine whether other servers are returning the -625 error for the same target server.

Ensure that the workstations can attach and log in to the target server from the same segment as the source server.

Flag all servers as Up by typing reset routers, and then setting the set DSTRACE = *u command at the source server. Then retry communicating with the target server.

At a client workstation, view the Partition Continuity screen in NDS manager. If every source has an error on one target, and that target server is unable to connect as a source, check to see whether that server is down or whether its eDirectory or NDS database is locked.

To remove a server that has been installed into another eDirectory or NDS tree, do the following:

Verify that the server has a writable replica of the partition containing the container to which you are trying to set the bindery context.

WARNING! Partition boundaries are different. local LocalChildPartitionCount, remote RemoteChildPartitionCount

WARNING! Attempt to add (ObjectEntryID) (ObjectName) with base class (BaseClass) to server list.

Warning: Applying all solutions mentioned in this topic could make the problem worse if the actual cause of the problem is not known. Before following a course of action, make sure that you understand the cause of the error and the consequences for the actions suggested.

Verify the partition connectivity by using the following steps:

On every server in the replica list, run DSREPAIR with the option to Verify Remote Server IDs set.

For example, if you do a Receive Updates in DSREPAIR and the server with the master replica is down, this error will be returned.

Examine the Replica Synchronization status on the server holding the master replica and resolve any -625 (ERR_TRANSPORT_FAILURE) errors.

To ensure that each server in the replica ring is available, the following partition operations can be flagged when submitting the request:

The length of time to complete all the updates will vary depending on the size of the replica, the number of replicas, and the condition of the communication links between all the servers holding the replicas.

This error can also be caused by a moved object that lost the original object (the primary obituary) or by a broken partition.

Additional information on this error can be obtained by using DSTRACE on the target server with the Authentication flag set.

Or, an attempt was made to remove a schema attribute definition specified in a naming, mandatory, or optional attribute list of a schema class definition.

Or, an attempt was made to create a schema class definition whose naming attribute list contains an attribute that is inherited as mandatory or optional from any of the schema class definitions of the base class’ super classes.

Wait. This is a normal error immediately after a partition operation has been initiated.

If this error persists, check to see whether this error indicates that the target server does not recognize a replica of the partition on the source server.

Confirm this through the dsrepair.log, or by watching DSTRACE.

If the partition remains busy for more than a few hours, abort the partition operation on the source server.

You can also remove the source server from the tree, or contact a Novell Support Provider.

If you are using DSTRACE on the eDirectory or NDS server targeted to become the new master and the Synchronization or Partition Operation flags are set, the following message is displayed:

 *CNTL: SetNewMaster for [PartitionRootObjectEntryID] <PartitionRootObjectName>, old highest is Timestamp, current time is CurrentTime, ERR_TIME_NOT_SYNCHRONIZED

Warning: If the master copy was corrupt in any way, that corruption will be dispersed to the other replicas when a Repair Time Stamps or Receive Updates action is performed. Repair Time Stamps and Receive Updates can also cause considerable traffic on the network. You might have to do this one partition at a time.

If the time difference is significant, attempt to abort the partition operation and resolve the issue using Repair Time Stamps.

The following processes occur when eDirectory or NDS attempts to open an eDirectory or NDS database on a server running NetWare:

On the server with the locked database, no activity will be in the DSTRACE screen.

This error occurs when one of the following conditions exist:

UNMATCHED EPOCHS on <ReplicaRootEntryID>--> LOCAL EPOCH: EpochNumber <TargetServer EntryID> EPOCH: EpochNumberReplicRootEntryID TO BE UPDATED TO NEWER EPOCH.

SCHEMA: Error -644 in DSAStartSchemaUpdate for <SourcServerEntryID>

Version: DSARequestVersion Epoch: Timestamp:ReplicaNumber

SYNC: <TargetServerName> has newer epoch. Delaying sync.

UNMATCHED EPOCHS on <ReplicaRootEntryID>--> LOCAL EPOCH: EpochNumber <TargetServer EntryID> EPOCH: EpochNumber

*DSAStartUpdateSchema: Client <SourceServerEntryID>, New Epoch: Timestamp:Replica Number

To be able to complete the partition operations, upgrade the NetWare 4.0x servers in the replica list to NetWare 4.1 (or later versions).

If this error is seen in DSREPAIR during a remote to local ID check, perform the set DSTRACE=!v command on the NetWare 4.1 (or later version) server. This resets a list that is maintained for restricting use of certain versions of eDirectory or NDS.

Make sure the Set NDS Synchronization Restrictions parameter is used correctly. See the online help for this parameter.

This triggers an attempt by the source server to instruct the target server to request a subordinate reference replica from the master replica of the child partition. However, the target server already holds a replica of the child partition.

INSPECTOR: partitionID of entry ObjectEntryID is invalid

When the source server is using or looking at the wrong public key, the key is the right format, but is for the wrong object. If the problem is the public key, do one of the following:

LinkReplica: DSALinkReplica for partition [PartitionRootObjectEntryID] <PartitionRootObjectName> from [SourceServerEntryID] <SourceServerName> failed, error = -672

Handle this eDirectory or NDS partition operation issue.

Handle this eDirectory or NDS partition operation issue.

Handle this eDirectory or NDS partition operation issue.

Handle this eDirectory or NDS partition operation issue.

If a partition operation has advanced beyond the initial stages identified, it cannot be aborted.

INSPECTOR: Bad subordinate count on entry ObjectEntryID, is EntryRecordCount, should be ActualCount

INSPECTOR: ObjectEntryID, RDN does not match values

INSPECTOR: ObjectEntryID, RDN modification time is not current

INSPECTOR: ObjectEntryID, RDN base class is incorrect

INSPECTOR: ObjectEntryID, ObjectName, missing reference opposite this value

When using DSTRACE on the source server with the Synchronization flag set, the following message is displayed:

SkulkEntry: LOST ENTRY (ObjectName) creationTime = ObjectCreationTimestamp with ReplicaNumber and Event

This error will cause the following message to be displayed on the file server console of the NetWare operating system:

ds.nlm cannot be unloaded at this time because another NLM has registered with DS. Try unloading dsrepair.nlm, dsmerge.nlm, or dsi.nlm.

When using DSTRACE on the source server with the Schema flag set, the following message will be displayed:

WARNING! rejecting DSStartUpdateSchema client <TargetServerName>

SKULKER: invalid replica root

If that message is displayed, this can indicate the following about the specified root partition object:

If DSTRACE is being used on the eDirectory or NDS server that holds the master replica of the partition being moved, the following message will be displayed:

CNTL: Partition <SourcePartitionRoot> entry not found on server <SourcePartitionRootParent'sMasterReplicaServerName>

Unable to initialize schema cache. opSchema is now invalid.

The request to receive a subordinate reference replica can occur while processing a dying replica if the replica’s parent partition exists on the server holding the dying replica or while receiving a replica if the new replica has child partitions.

When DSTRACE is being used on the source server with the Schema Synchronization flag set, the following message will be displayed:

SYNC: ProcessDyingReplica - <PartitionRootObjectName>. Master not found in local ring.

When DSTRACE is being used with the Schema Synchronization or the Partition Operation flags set, the following message will be displayed:

MoveTree: End Notify for [PartitionRootObjectEntryID] <PartitionRootObjectName> failed, error - 699

*SKULKER: SYNCHRONIZATION DISABLED

This will result in the following DSTRACE message if the source server is using DSTRACE with the Minimum or Synchronization flags set:

SYNC: SYNCHRONIZATION DISABLED

If the default ACL for the specified class is nonexistent or incorrect, the initialization routines reassign it to the operational schema class definition.

If the default containment list for the specified class is nonexistent or incorrect, the initialization routines reassign it to the operational schema class definition.

A server running eDirectory or NDS for NetWare, by default, uses CRC checking for all data exchange. This is done to prevent database corruption due to packet corruption.

CRC checking is available only between servers running ds.nlm v5.01 or later.

For example, if eDirectory or NDS makes a request for a connection to a partition with an MASV label and if eDirectory or NDS passes a connection number that is not valid to the label, then this error code will be returned.

For example, you assign Bob a security clearance of Novell for logging in to the partition. So you give all users a level of the security clearance of Novell. Dave comes along and you want to assign Dave an additional security clearance of SSL, so you assign Dave a security of SSL and Novell forgetting that Dave already has the Novell security clearance. This error would be returned because Dave already has a security clearance of Novell.

For example, a valid HRL might be "Novell." If "Novel" was entered, this error would be returned.

set DSTRACE=+s
 set DSTRACE=+part
 set DSTRACE=+misc
 set DSTRACE=+j
 set DSTRACE=*f
 set DSTRACE=*h

Toggle to the Directory Services trace screen and watch for any errors. The object with the zero creation timestamp that is causing the error should be displayed. Delete this object.