understanding the “ad op master is inconsistent” alert

i use the term “understanding” loosely.  this is by far no definitive guide on this particular alert, just a few things i have picked up in my attempt to understand it.

let’s look at the context of the alert:

The Domain Controller's Op Master is inconsitent. See additional alerts for details.

first of all, it gives very little information.  the only particularly useful detail is that it indicates which server is having the issue.  other than that, just a spelling error as there are no additional critical alerts to look at for details.

this rule, as you know, comes from a sealed mp.  therefore, we can’t modify anything in it except the overrides.  the couple i’ve tinkered with are:

• interval (sec)
• log success event

to begin with, interval (sec) is just set way too high.  the default is 60 seconds.  why on earth would anyone want to know that your op master consistency may be off, every minute?  actually, i could think of a few reasons, but really, it’s overkill.  the way the script works (which has a copyright of 2001, by the way, and apparently briefly modified for opsmgr by stripping out the createevent calls and replacing them with property bag calls) is to check all replication partners for op master consistency.  on a bridgehead server, that’s quite a big number.  i ended up dropping the value to 3600.

i mentioned earlier that the alert has no useful context.  here’s why.  if you look inside the script, the functions for createevent route to this subroutine:

Sub CreateEvent(lngEventID, lngEventType, strMessage)

    oAPI.LogScriptEvent "AD Replication Partner Op Master Consistency", lngEventID, lngEventType, strMessage
    
    if lngEventID=EVENTID_CANT_DETERMINE_OP_MASTER or lngEventID=EVENTID_OP_MASTERS_INCONSISTENT then
        bState=1
    End if    
End Sub

 

depending on the condition, bState either goes 0 or 1.  this next snippet indicates what to do with the bState condition:

if bState=0  then
    set oBag = oAPI.CreateTypedPropertyBag(StateDataType)
    oBag.AddValue "State", "GOOD" 
    oBag.AddValue "EventID", EVENTID_GOOD
    oAPI.AddItem oBag
END IF    
if bState=1  then
    set oBag = oAPI.CreateTypedPropertyBag(StateDataType)
    oBag.AddValue "State", "BAD" 
    oBag.AddValue "EventID", EVENTID_BAD
    oAPI.AddItem oBag
END If 

and as you can see, the state is captured as well as the event id.  no other detail.  for this reason, you can’t figure out whether bad is really bad or just maybe bad.  i mean, is it really inconsistent, or can the agent simply not retrieve the required data? 

this is where the other override i mentioned earlier, comes into play – log success event.  if you choose to turn this on, you can view the associated events of the health service to see the details it stores.  it will show you every consistent partner – which could potentially be useful.  this is what a “good” event would look like:

AD Replication Partner Op Master Consistency : Op Master PDC 'myDC1.MYDOMAIN.COM' consistent with replication partner 'myDC2.MYDOMAIN.COM'.

and the inverse (logs regardless of log success event override):

AD Replication Partner Op Master Consistency : The script 'AD Replication Partner Op Master Consistency' failed to executethe following LDAP query: '<LDAP://myDC1.myDomain.com/CN=Schema,CN=Configuration,DC=myDomain,DC=com>;(&(objectClass=dMD)(fSMORoleOwner=*));fSMORoleOwner;Subtree'.  
The error returned was 'Table does not exist.' (0x80040E37)


AD Replication Partner Op Master Consistency : Unable to determine schema Op Master on domain controller 'myDC1.myDomain.com'.

that’s actually two events that i pulled out of the operations manager event log on the dc in question.  those events are not captured by opsmgr by default.

when you view the data, it tells you everything you need to know.  first of all, don’t panic.  there’s no inconsistency!  the error is because the partner dc can’t be reached.  (yes, that is a problem obviously but not a data integrity type problem).

i mentioned that there are no additional critical alerts to look at for details.  if you switch to the warning alerts, you will find detail on why the particular alert fired.  for example, here are two that relate to the event messages above:

AD Replication Partner Op Master Consistency : The script 'AD Replication Partner Op Master Consistency' failed to executethe following LDAP query: '<LDAP://myDC1.myDomain.com/CN=Configuration,DC=myDomain,DC=com>;(&(objectClass=crossRefContainer)(fSMORoleOwner=*));fSMORoleOwner;Subtree'.  
The error returned was 'Table does not exist.' (0x80040E37)


AD Replication Partner Op Master Consistency : Unable to determine domain naming Op Master on domain controller 'myDC1'.

looks remarkably alike, right?

if you want to see it all in one view, i suggest using the dc active alerts view which will show you all the alerts stacked up for easier correlation.

optionally, search for the computer name in question.  don’t expect to find it under dc events.  as stated earlier, these events are not picked up by default.

hope that helps!