You can perform some basic troubleshooting to ensure that you have successfully configured the search initiator for distributed search. This section lists the most common issues and the probable causes for these issues.
After doing a distributed search, check the extended status page to view the search status. If the search is not successful, check the following possible causes:
The target server administrator might have disabled distributed searching on the target server. To enable distributed search on the target server, see Step 4 in Authorizing a Search Initiator Server.
The target server administrator might have disabled the search initiator server for distributed searching. Ensure that the search initiator server is enabled in the target server. Fore more information, see Authorizing a Search Initiator Server.
The role that you used for connecting might not have the Search Remote Targets permission.
Network issues in your organization.
Sentinel servers or Sentinel services might be down.
Connection time-out.
The IP address or the port number of the target server has changed, but the search initiator configuration might not be updated.
The Proxy group that is assigned to the search initiator might not have the view all events permission to view the raw data.
The search initiator server and target server might not be communicating with each other. Ensure that the firewall and NAT are set up properly to allow communication in both directions. Ping both ways to test.
You might not be able to view the events from the target servers for one of the following reasons:
The trial license might be expired. You must purchase an enterprise license to reactivate this feature to view the events from the target servers.
The user who has logged in to the search initiator has one set of permissions on the local data such as view all data, view system events, security filter settings, and so on. The search proxy group has another set of permissions, possibly more restrictive. Therefore, certain types of data, such as raw data, system events, and PCI events, might be returned only from the local system and not the target server.
The trial license might be expired. You must purchase an enterprise license to reactivate this feature to run the reports from the target servers.
Different users might have different security filters or other permissions and therefore get different results from a distributed search.
This is by design, for security reasons. Because the data viewing rights for the admin are unrestricted, it is not desirable to allow the admin role to be the search proxy role.
You can also determine the cause of a search failure by examining the log file on the search initiator server. The default location for the log file is /var/opt/novell/sentinel/log. For example, you might see one of the following messages:
Invalid console host name 10.0.0.1
Error sending target request to console host 10.0.0.1
Error getting certificate for console host 10.0.0.1
Authentication credentials in request to opt-in to console 10.0.0.2 were rejected
Request to opt-in to console 10.0.0.2 was not authorized
Error sending target request to console host 10.0.0.1