|
Table of Contents
I. Purpose
II. Problem Summary
III. The Login Process
IV. Tree Walking
V. Typical Symptoms
VI. General Troubleshooting
VII. Possible Causes by Product
1. Novell Client Software
2. Novell Server Software
3. NDS
4. ZENworks
5. NDS for NT
6. BorderManager
7. Printing
8. Communication problems
9. Hardware Devices
VIII. Conclusion
I. Purpose
The purpose of this document is to explain the various possible causes of a slow login when using the Novell Client to login to NetWare servers. In addition to an explanation of the possible causes, this document will provide some troubleshooting tips to help isolate the problem. Once the problem and its cause have been identified, potential solutions are suggested.
This document does not cover the following topics:
Slow logins to GroupWise, GroupWise WebAccess (10021914), across dial-up connections (10018778), and with Xconsole/Telnet (2928625).
II. Problem Summary
In a healthy environment, a login to NDS only takes a few seconds. Of course, the process can take longer depending on what programs are run from login scripts or policy packages. In some instances, however, login can be slower than normal. The login process can be delayed for several reasons. This document will explain the possible causes of slow logins. This document assumes that you have downloaded and applied the latest Novell Client software, Client Service Packs and NetWare Support Packs when available.
III. The Login Process defined
The login process is fairly complex. The process begins as the desktop Operating System (OS) begins to load. In general, a Not-Logged-In (NLI) connection is created on a server and the user is prompted to enter their credentials (username and password). Once their credentials are accepted, the login process continues, along with the loading of the OS. If the OS experiences any delays in loading, these delays can be perceived as delays in the login process. The login process is made more complex by the use of login scripts, any programs run from login scripts, and Workstation Manager and Application Launcher components of ZENworks.
IV. Tree Walking
Sometimes "tree walking" can cause delays in the login process. When a client agent submits a request to NDS, the request is not always received by a name server that is qualified to fulfill the request. The name server receiving the request must find a name server that can fulfill the request. Several name servers may need to be contacted before a qualified server is located. To find the information, a name server initiates a search until a replica is found that contains the desired information. This process is called tree walking. As long as the replica information can be accessed quickly, tree walking is not a problem. However, if replica information is only available across a slow link, like a WAN link, delays can occur. Any application that uses NDS can cause tree walking, but tree walking can be minimized with good NDS tree design.
For information regarding NDS tree design, refer to the following articles:
Universal Guidelines for NDS Tree Design
NDS Design for ZENworks and NDS for NT
NDS eDirectory Design
V. Typical Symptoms
Slow login
Login is really slow
Login takes "forever"
Unable to login to the network
Error: "Tree or server could not be found."
VI. General Troubleshooting
To identify what is potentially causing the slow login problem, create a packet trace of the problem occurring, capturing all packets sent to and from the workstation with the problem. Record the version of the following workstation components: OS (plus Service Pack), Novell Client (plus Service Pack), etc. In most cases, an NCCSCAN report file should also be created using NCCSCAN (see NCCUTIL4.EXE or later on Support Downloads). Also collect information about the NetWare server(s) to which the user is trying to login.
Narrow the scope of the problem. Determine if all users are affected and which servers are involved. If the problem is specific to one server, determine if server is having high utilization and the server's busiest thread. Some documents regarding server high utilization include:
10018089 - Troubleshooting High Utilization for NW 4 and NW5
10026835 - Identifying and Troubleshooting Hangs
2941108 - Troubleshooting High Utilization NW 4 Summary
VII. Possible Causes by Product:
1. Novell Client Software
Slow logins are rarely caused by components of the Novell Client, but because the slowness occurs during the login process, the Novell Client is usually the first suspect. If the Novell Client is not configured correctly for its environment (i.e., preferring IPX in a mostly IP environment or specifying incorrect Directory Agents), the login process can be delayed. Slow logins can also be caused by various login script problems (like corrupt scripts, invalid commands, excessive IF statements, etc), unnecessary tree walking, virus protection software, Microsoft Windows components (like MUP.SYS), or incorrect settings in the Windows registry.
Related documents:
2924655 - "Slow login with Client32"
Possible Cause: Corrupt login script.
Troubleshooting: Get packet trace & check login script.
Solution: Repair or replace corrupt login script. Login script could contain invalid commands (10018574) or excessive IF Member of "<group>" statements (1007440).
10012087 - "Troubleshooting Login Scripts"
Possible Cause: Problems with Login Scripts.
Solution: Use troubleshooting tips to resolve login script problems.
10023842 - "Troubleshooting slow login or LAN issues"
Possible Cause: IP only issues.
Solution: Try changing the Protocol Preference order in the Novell Client | property settings. Try removing the IP stack to determine if the problem is IP only. See also 10014302 "NW5 client slow logging into IPX server", 2950722 "Slow NT Login in Pure IP Environment", 10020376 "The clients are getting a Slow Network login", and 10024740 "Troubleshooting IP Login Issues".
Possible Cause: Contextless login was enabled but not configured with a Tree or Catalog on the Novell Client properties | Contextless Login tab.
Solution: Disable Contextless Login if not needed or specify a Catalog object. In a trace, this is seen by the "Req Resolve Name [Root]" packet as it walks up the tree. See also Solution 10021852 "Slow login over a WAN link due to Contextless Login".
Possible Cause: Corrupted Client installation.
Solution: See Solution 10016768 "Login is very slow from specific machines" and Solution 10017336 "How to do a clean uninstall of Client32".
2930105 - "Slow performance with NT Client"
Possible Cause: Slowness caused by tree walking for Group memberships and Directory Map objects.
Solution: Evaluate NDS design.
2940983 - "Slow login after patching 4.1 server"
Possible Cause: MS WINS configuration.
Solution: Correct the Microsoft WINS database.
2950720 - "Slow NT Login Performance"
Possible Cause: Client requesting user's Group Membership multiple times.
Solution: Removing, disabling or updating virus scanner resolves the problem.
10023186 - "Client v.4.6 are experiencing slow logins."
Possible Cause: Virus scanner installed on workstation, scanning the NetWare volume.
Solution: Disable virus scanner to verify and contact virus scanner vendor.
10026063 - "MUP.SYS Causing slow performance for NWClient"
Possible Cause: MUP.SYS from Microsoft.
Solution: Get latest MUP.SYS from Microsoft.
10024085 - "Workstations very slow to log users in"
Possible Cause: Windows registry referring to policy directories where policies no longer exist.
Solution: Remove or correct registry information.
2938334 - "NT browser hangs when walking tree"
Possible Cause: Spaces used in the NT computer name under the Identification tab.
Solution: Rename computer without spaces in the name.
2. Novell Server Software (NetWare OS)
There have been some issues with NetWare 4.11/4.2 and NetWare 5 NLSLSP.NLM and Winsock modules causing slow login and authentication problems. The solution for these issues is to apply the latest licensing (NLS) fixes.
For NetWare 5 and NetWare 5.1, the fixes are included in NW5SP5 and NW51SP1, when these Support Packs are available. Refer to 10013723 "Understanding NetWare 5 Licensing" for additional information.
Related documents:
10055760 - "Slow logins after NW51 upgrade"
Possible Cause: SLP routing problem. Whenever the client needs to find DS information that is not located on the local server logging into (Zen works search policies, NAL, group memberships with rights to remote volumes, etc, etc), DS will issue a referral list of potential servers that would have that information. The client then attempts to authenticate to one of those servers in the referral list. DS builds this list from SAP (IPX connections) and from the SLP database (IP connections). DS will not be able to distinguish between correct addresses and incorrect address. If the information in the SAP tables or the SLP database is incorrect, DS will spend a lot of time connecting to the invalid connections which results in slow logins. Typically, this problem is found more in IP connections and the SLP database.
2957679 - "Deployment Tool for NLSLSP v5.02"
Possible Cause: Problems with NLS causing high utilization on server.
Solution: Apply NW5SP5 or NW51SP1 or later. The new SET Parameter for MLA Certificates, SET STORE NETWARE 5 CONN SCL MLA USAGE IN NDS=OFF will improve performance in situations where multiple servers are consuming units from the same certificate. When set to OFF, NLS will not update NDS with the information about certificate usage. This problem will typically be seen on sites where multiple (ten or more) servers all consume units from the same certificate.
10020569 - "Login to NetWare server is very slow"
Possible Cause: When CLIB encounters an error condition it is replying "success" instead of "failure" as it should. This causes the sending server to continue sending packets, instead of handling a failure condition.
Solution: New NetWare 4.11 CLIB modules available in NW4SP8a.exe or later.
10023842 - "Troubleshooting slow login or LAN issues"
Possible Cause: Virus scanner running at the server is checking both incoming and outbound files for viruses.
Solution: Most users prefer to scan only files being written to the server (incoming). Scanning both incoming and outbound files can significantly slow down the login process.
10014127 - "NetWare 5 IPX Clients are experiencing slow performance due to Server Busy packets"
Possible Cause: NetWare 5 Server was doing background server-to-server communication to attempt to locate the servers that held a replica of the requested partition.
Solution: Change the Primary NIC to be the NIC that goes to the segment where the SLP Services are available.
3. NDS
In general, the login process expects a healthy NDS. Therefore, if login is slow, the health of NDS should be considered. For information on performing NDS Health Checks, refer to the August 1997 Novell AppNote "Maintaining a Healthy NDS Tree" Part 1 and Part 2.
Related documents:
10060600 - "NDS Health Check Procedures" Possible Cause: DSRepair will return errors if it is having tree-walking problems. Typical errors include -626 all referrals failed, and -634 no referrals. If NDS is not healthy, slow logins may occur.
Solution: Perform an NDS Health Check and resolve any problems identified.
10052959 - "Upgraded from the NDS from the rec man database to the flaim database"
Possible Cause: Many high utilization issues have been caused by bindery services with the NDS 8x.
Solution: DS.NLM 8.59 (or later) has a new setting that will help with bindery issues. The following two NDS parameters must be set:
NDS Bindery QOS Mask (Must be set for the bindery type causing high utilization)
NDS Bindery QOS Delay (Specifies the delay in ms for the selected types in the mask)
10051104 - "High Utilization from NDS"
Possible Cause: High utilization on the server caused by the WM:Registered Workstation attribute having excessive values stored on it. The problem is caused by Novell Clients adding multiple values to a container's WM:Registered Workstation attribute. If the ZENworks Workstation Manager component of the Novell Client is installed, the Client will add a cookie to the user's container to register the workstation for importation. If the workstation is not imported, the Client will continue to add values to the container's WM:Registered Workstation attribute, even though it is not visible using NWAdmin32. A value is added each time a user in the container logs in. Once the number of values added becomes large, NDS synchronization of these multiple values can cause the server to experience high utilization.
Solution: To remove the multiple values, obtain the following DSREPAIR versions and run Dsrepair -wm:
DSREPAIR 7.26 (for eDirectory)
DSREPAIR 5.24 (NDS 7.x)
DSREPAIR 4.69 (NDS 6.x)
Note: These versions of DSREPAIR are not yet available for download. This document will be updated when these versions are available.
If you load Dsrepair -wm and run repair, the error log will contain a message similar to the following:
ERROR 391044b2, WM:Registered Workstation
Object id: 00008052, DN: o=novell.T=swtest1
This will clear all the values off of the attribute and sync them to the other servers in the ring. To prevent the problem from occurring again, upgrade the Novell Clients to version 3.21 / 4.71. The upgraded Novell Clients only add one value to the attribute per workstation.
10014304 - "Login to the tree is slow"
Possible Cause: When you authenticate to the tree, you MUST have your rights check at the root.
Solution: Apply DS.NLM version 7.10 and MASV.NLM (Mandatory Access Control Service) version 1.08a, Oct 1, 1998.
10023842 - "Troubleshooting slow login or LAN issues"
Possible Cause: Duplicate Tree and/or server names.
Solution: An accurate map of the network is a must for tracking down these issues. Server and NDS tree names must be unique.
2950534 - "Slow login for NT workstations"
Possible Cause: User's "Default server" attribute set to non-existent server name.
Solution: Delete or correct user's "Default server" attribute in NDS using NWAdmin.
10016219 - "Error: 128 -128 FFFFFF80 = DSERR_LOCK_FAIL"
Possible Cause: Error: 128 -128 FFFFFF80 = DSERR_LOCK_FAIL.
Solution: Upgrade Novell Clients to version 3.1 / 4.6 (or later version like 3.21 / 4.71), and on the server holding the Master of Root, load DSREPAIR | Advanced Options | Run Local Repair. Select "Yes" on Rebuild Operational Schema and Check Local References. Select "No" on all other options.
10023867 [no longer available] - "NDS8 Performance is poor. Cache Problem"
Possible Cause: Insufficient cache for NDS 8.
Solution: Increase the amount of memory available for NDS using SET DSTRACE = !MB<bytes>.
4. ZENworks for Desktops
ZENworks for Desktops components can potentially cause delays in the login process due to tree walking (searching for policies and applications) or due to running programs or applying policies that are scheduled to run at user login time.
Related documents:
10017000 - "NAL Application Search Settings causing slow login / launch"
Possible Cause: Excessive searching by Application Launcher (NAL) for application associations or Launcher Configuration settings.
Solution: Limit the application inheritance level and set a "top of configuration tree" at the appropriate container level like the user's partition root container, for example. See also 2951690 "NAL and Unwanted Connections" and 10018969 "Server experiencing high utilization with NAL".
10050790 - "NAL is slow with both IP IPX enabled"
Possible Cause: If both IP and IPX are enabled on Windows NT/2000, the workstation will attempt to discover services using both IP and IPX, to determine which server is closest. The client will request cost information for both IP and IPX routes. The problem is that if IPX is turned off at the routers, the client will never receive a response to its IPX RIP requests.
Solution: If IPX is not routed across the network, edit the registry to disable IPX costing on the client so the client will not RIP to discover the cost (hops and ticks) of IPX routes.
10027601 - "Slow login using ZENworks Inventory and NAL"
Possible Cause: ZENworks Inventory scan scheduled to run at every User Login.
Solution: Schedule the Inventory scan to run randomly throughout the day instead of during login.
10015620 - "Workstation Manager & NDS Refresh Rate"
Possible Cause: NDS Refresh Rate value set too low. If this value is set too low, the frequent refreshes (reading NDS for new policies or changes to existing policies) can indirectly cause login to be slow by overloading the server or network.
Solution: Set the NDS Refresh rate to a value that is reasonably high but sufficient for your environment. For example, increase the NDS Refresh Rate from the default of 30 minutes to 270 minutes (4.5 hours) to limit the refresh to once per 9 hour shift or set it to 1380 minutes (23 hours) to allow the refresh to run once during a 24 hour period. Also, use caution when enabling the Application Launcher (NAL) timed refresh setting. There are separate timed refresh settings for the user and workstation (see Launcher Configuration settings, User and Workstation tabs). Setting the timed refresh values too low can cause excessive network traffic and could indirectly affect user's login performance.
10019231 - "Recommendations for Workstation Manager"
Possible Cause: Excessive searching for ZENworks policies and tree walking by Workstation Manager.
Solution: Proper NDS tree design and partitioning, and creating a container Search Policy to limit policy searches. See also 10016465 "How do search policies work?" and 2938393 "Login is very slow with ZENworks client".
10026912 - "Users will attach to the root of the tree on login"
Possible Cause: ZENworks policies are searching on a Global Group that is in the root partition.
Solution: Replace the global group with separate, local groups or add a R/W replica of root to servers in the appropriate sites.
10023842 - "Troubleshooting slow login or LAN issues"
Possible Cause: Workstation Manager is walking the tree to [Root] to search for policy packages. A container Search Policy had not been created.
Solution: If Workstation Manager is running at the workstation, it will, by default, walk up the tree to [Root] in search of policy packages. This is usually noticed on large trees, especially if the upper portions of the tree are across a WAN link. Creating a Container Search Policy Package can control this. You can check the settings of the Search Policy in the Client by going to: HKEY_LOCAL_MACHINE\Software\Novell\Workstation Manager\Search Policy. The String Value, Workstation Context Ceiling, should show the distinguished path to context set in the Search Policy. If not, change it so it won't walk the tree. See also 10023063 "User login takes a very long time" and 10016160 "What is the ZENworks Container Policy used for?".
10025795 - "Slow login to local server"
Possible Cause: Workstations were being routed to servers across the WAN for the ZENworks policy packages. The local site only had a replica of one small partition of the tree.
Solution: Add a R/W replica of root to the local server or create a container Search Policy to limit the searching for policies.
10022889 - "Slow login after setting up the Shell= Nal.exe /s in the Windows NT 4.0 registry"
Possible Cause: Workstation was incorrectly configured to run NAL as the Shell.
Solution: Correctly configure workstation to run NAL as the shell.
December 1999 AppNote "Taking the Pain Out of Windows NT Profiles and System Policies with Novell's ZENworks"
Possible Cause: Temporary Internet Files can cause significant delays during login if using Roaming Profiles.
Solution: Consider altering the location in Internet Explorer Properties | General | Temporary Internet Files | Settings.
5. NDS for NT
Related documents:
10018143 - "Slow login to NDS for NT domain"
Possible Cause: After applying SP2 for Novell Client 4.6 for Windows NT, the NDS for NT client listed the local replica as unavailable causing it to access another replica, possibly crossing a WAN link.
Solution: Currently, there are two workarounds:
1. Revert the client service pack back to SP1. This requires editing the registry to remove the current service pack reference to SP2, then reinstalling SP1.
2. Add a new registry key to force the client to use the local replica. Add a DWORD of
\\HKLM\currentcontrolset\services\netwareworkstation\parameters\BadNameCacheTimeout with a value of zero.
2956100 - "High Utilization, slow Login or Sync-Problems"
Possible Cause: There is a problem with Microsoft's System Management Server 1.2 Service Pack 4 and below.
Solution: A Microsoft Hotfix or SMS 1.2 Service Pack 5.
6. BorderManager
Related documents:
10066939 - "BM3.0 - Slow login through NW5 server"
Possible Cause: The NetWare 5 servers are first resolving the name by addressing all the IP addresses and than using the IPX addresses, although IPX is configured as the preferred protocol.
Solution: Changing the bind order directly in NETINFO.CFG to IPX, TCP, internal, external interface the problem was solved.
7. Printing
ZENworks printers and NDPS Remote Printer Management (RPM) are often configured to install a printer before or just after login. During that time, the ZENworks printer helper (WMPRTNT.DLL or WM95PRT.DLL) or DPMW32.EXE for RPM may be attempting to read a DS replica that may be responding slowly. Both processes do some searching to find the effective policy. Other ZENworks helper DLLs also may be accessing DS at that time.
In many cases, if an application is launched during or just after login, the default printer is checked by Windows. That process may require DS access and may take additional time as well.
If user or workstation printer policies or RPM are being used, they can be disabled temporarily to determine if they are contributing to the slow login problem. Once they are ruled out or the problem is corrected, they can be re-enabled.
8. Communication problems
Related documents:
10023842 - "Troubleshooting slow login or LAN issues"
Possible Cause: Trying to resolve an object that exists on a replica held by another server, and this server is across the WAN or is busy and not responding to requests. This can be seen in a trace where a request is made to resolve an object, but a reply is never received. After the request times out, another request is sent, and the server responds with a Reply Rqst Being Processed; conn=<conn.#> meaning that it is still working on the original request and cannot find a server that will resolve that object.
Solution: Discover why the server that holds the replica for the object cannot be accessed. In many cases it is busy, in an abended state, or not accessible.
10026522 - "Slow Client Login in SLP environment with DA"
Possible Cause: Using SLP with no DA configured or incorrectly configured. See also 10018981 "Clients are experiencing extremely slow login".
Solution: Implement an SLP Directory Agent. See the following TIDs for information about SLP, including SLP DA implementation guidelines:
TID 10025313 - Frequently Asked Questions about SLP
TID 10014467 - Configuring a LAN/WAN infrastructure for SLP
TID 10027163 - Configuring SLP for a NetWare Server
TID 10014466 - Configuring SLP for a NetWare Client
TID 10014396 - SLP Terms and Configuration Reference
TID 10014303 - Understanding the NetWare 5 Client SLP Discovery / Login Process
TID 10024588 - How to troubleshoot SLP with Directory Agents
TID 10014868 - SLP Console and SET Commands
April 2000 AppNote - Understanding and Configuring SLP Directory Agents and Scopes
10014553 - "How to minimize Multicast Traffic from IP"
Possible Cause: Large amount of multicast packets.
Solution: Minimize multicast traffic from IP Clients.
10067701 - "Login Script Runs Extremely Slow"
Possible Cause: Duplicate IPX address on the LAN or WAN.
Solution: Ensure IPX addresses are unique.
10067701 - "Client32 slow login"
Possible Cause: NetWare servers(s) configured for wrong Ethernet frame type and Clients configured to "auto detect" frame type.
Solution: Configure server(s) to use the correct frame type or configure Clients to use specific frame type.
10016660 - "NT Client login is very slow with the Novell Client 4.6 for Windows NT"
Possible Cause: Client installed with IPX only and SAP was disabled.
Solution: Enabling SAP resolved the slow login problem.
9. Hardware Devices
Related documents:
10023842 - "Troubleshooting slow login or LAN issues"
Possible Cause: There have been issues with some 100mb hubs.
Solution: Change out the hubs or change back to the 10mb hubs.
10026676 - "Slow login due to packet loss and long retry"
Possible Cause: Packets lost under heavy network load and long retry times.
Solution: Upgrade network hardware to reduce packet loss, and decrease tick count on WAN interfaces if necessary.
2906621 - "Slow login caused by printer traffic"
Possible Cause: Intel NetPort causing packet storm.
Solution: Disconnected NetPort.
2909373 - "High Utilization when using Intel Net Ports"
Possible Cause: Intel NetPort / HP JetDirect devices not configured correctly and making Bindery calls.
Solution: Update software/firmware to be NDS aware and configure devices correctly. See also 2907850.
2926493 - "Compaq Armada 4100 laptop slow logging in"
Possible Cause: Conflict between LPT1 and built-in NIC in docking station for Compaq Armada 4100.
Solution: Get update from Compaq.
VIII. Conclusion:
As the above evidence indicates, the login process can be delayed for several reasons. Finding the root cause of the problem can be difficult, but knowing the likely causes and narrowing down the problem will make this task much easier..
|
