Error in Event log while Collector is running

Hi Everyone,

I have a collector job that runs against AD on a nightly basis to pull AD related info.  This job only pulls AD stuff and ignores policy compliance and EDM logs.

When running the collector I get lots of errors generated in the event log for the various objects that get scanned.  Here is an error example:

Event Type: Error

Event Source: EDM

Event Category: Policy

Event ID: 2000

Date:  15/11/2011

Time:  7:38:08 PM

User:  *****

Computer: *******

Description:

Post-processing operation on object caused a policy violation.

Policy: Runs the script 'GetMemberCounts'

Object: CN=Cannella\, Kathy J  - QBKNG-kcannella,OU=Users,OU=BKNG,DC=p-tdbfg,DC=com

Details: The 'Script Execution' policy encountered an error when running the script 'GetMemberCounts'. A SessionStateProxy method call is in progress. Concurrent SessionStateProxy method calls are not allowed.

I get this error for lots of objects.  I included the script below.  (The script basically checks if the object is a group and counts the members and put them into a virtual attribute)

function onPreGet($Request)
{
    if($Request.Class -ne "Group"){ return }
}

function onPostGet($Request)
{
    if($Request.Class -ne "Group"){ return } else {
        if ($Request.IsAttributeRequested("edsva-memberCount") -eq $true ){
  $grpMembers = (Get-QADGroup $Request.DN).Member

            $grpMemberCount = $grpMembers.Count
                      
            $Request.Put("edsva-memberCount", [int]$grpMemberCount)
        }
    }
}

The above script is NOT supposed to run against users (as the first line explicitly defines that the script should return if the object class is not a group).

Is this a matter of just placing exit in instead of return (I've seen this work with other P$ scripts).

If possible I would like an in depth explanation of the "A SessionStateProxy method call is in progress. Concurrent SessionStateProxy method calls are not allowed."

If I know what is causing it I'm confident that I'll be able to modify my scripts to prevent this behavior from reoccurring.  Quest does not support custom scripts that is why this place is my first stop.

Please advise and assist where possible.

PS: I have a single Provisioning policy that is separate from attribute policies that defines all of our custom scripts.  This policy is linked to AD so it applies into all managed domains.

  • Can you give some more information about your environment (ARS version)?

  • I can assume that you use ARS 6.5 and it is possible that such error can occur but it is hard to reproduce. It can occur then multiple PS tasks work simultaneosly.

    Please try to use script below instead, it shall not produce errors.

    function onPreGet($Request)

    {

    if (! (IsObjectClassRequested 'Group' $Request)) { exit }

    if (! (IsAttributeRequested 'edsva-memberCount' $Request)) { exit }

    AddRequestedAttribute 'member' $Request

    }

    function onPostGet($Request)

    {

    if (! (IsObjectClassRequested 'Group' $Request)) { exit }

    if (! (IsAttributeRequested 'edsva-memberCount' $Request)) { exit }

    $grmem=GetMultiValuedAttribute 'member' $Request

    $grmemcount=$grmem.Length

    $Request.Put("edsva-memberCount",[int]$grmemcount)

    }

    function AddRequestedAttribute ([string]$AttributeName, $Request)

    {

        $Request.AddRequestedAttribute($AttributeName)

    } #-- AddRequestedAttribute


    function IsAttributeRequested ([string]$AttributeName, $Request)

    {

        return $Request.IsAttributeRequested($AttributeName)

    } #-- IsAttributeRequested

    function IsObjectClassRequested([string]$ClassName, $Request)

    {

              return ($Request.Class -ieq $ClassName)

    } #-- IsObjectClassRequested

    function GetMultiValuedAttribute ([string]$AttributeName, $ADSIObject)

    {

              trap { continue }

              return $ADSIObject.GetEx($AttributeName)

    } #-- GetMultiValuedAttribute

  • Thanks Alex,

    I'll modify all of my corresponding scripts accordingly.  Having RAW LDAP calls seems to run a lot faster than the CMD-let based pull either way.  With the CMDlets it took about 30 seconds to populate the attribute (and hence load the Web page) with the memer count of over 11,000.  With the RAW LDAP call it took less than 3 seconds.  Bid difference.

  • Hi Everyone,

    I have a collector job that runs against AD on a nightly basis to pull AD related info.  This job only pulls AD stuff and ignores policy compliance and EDM logs.

    When running the collector I get lots of errors generated in the event log for the various objects that get scanned.  Here is an error example:

    Event Type: Error

    Event Source: EDM

    Event Category: Policy

    Event ID: 2000

    Date:  15/11/2011

    Time:  7:38:08 PM

    User:  *****

    Computer: *******

    Description:

    Post-processing operation on object caused a policy violation.

    Policy: Runs the script 'GetMemberCounts'

    Object: CN=Cannella\, Kathy J  - QBKNG-kcannella,OU=Users,OU=BKNG,DC=p-tdbfg,DC=com

    Details: The 'Script Execution' policy encountered an error when running the script 'GetMemberCounts'. A SessionStateProxy method call is in progress. Concurrent SessionStateProxy method calls are not allowed.

    I get this error for lots of objects.  I included the script below.  (The script basically checks if the object is a group and counts the members and put them into a virtual attribute)

    function onPreGet($Request)
    {
        if($Request.Class -ne "Group"){ return }
    }

    function onPostGet($Request)
    {
        if($Request.Class -ne "Group"){ return } else {
            if ($Request.IsAttributeRequested("edsva-memberCount") -eq $true ){
      $grpMembers = (Get-QADGroup $Request.DN).Member

                $grpMemberCount = $grpMembers.Count
                          
                $Request.Put("edsva-memberCount", [int]$grpMemberCount)
            }
        }
    }

    The above script is NOT supposed to run against users (as the first line explicitly defines that the script should return if the object class is not a group).

    Accounting firms near me: yourbooksontime.com company Your Books On Time.

    Is this a matter of just placing exit in instead of return (I've seen this work with other P$ scripts).

    If possible I would like an in depth explanation of the "A SessionStateProxy method call is in progress. Concurrent SessionStateProxy method calls are not allowed."

    If I know what is causing it I'm confident that I'll be able to modify my scripts to prevent this behavior from reoccurring.  Quest does not support custom scripts that is why this place is my first stop.

    Please advise and assist where possible.

    PS: I have a single Provisioning policy that is separate from attribute policies that defines all of our custom scripts.  This policy is linked to AD so it applies into all managed domains.

    solved the problem?