• State Suggested Answer
  • Locked Locked
  • Replies 9 replies
  • Answers 1 answer
  • Subscribers 95 subscribers
  • Views 11468 views
  • Users 0 members are here
Options
Related
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

AD Sync Project: A scope that excludes an OU takes much longer to query Contacts than any other object type

Tim Staddon
over 7 years ago

Hi,

This is with v7.1.2.

Here I have an Active Directory OU in a test domain which contains over 50,000 AD contacts external to the domain 1IM needs to manage. We don't need our sync project to touch any object in this OU at all.

ADUC can scan the container for all contacts in less than a second, and a filtered LDAP query in an LDAP browser will give me all contacts except these ones in under 0.14 seconds. 

The best I've been able to manage in Synchronization Editor is, I got it down to ~21 seconds by applying scope filters in three ways:

  • Scope filter based on the heirarchy of existing system objects (de-selecting the offending OU from the treeview)
  • Object filter - NOT LIKE %OU=OUtoExclude,DC=company,DC=com
  • Schema classes using the same filter

But even then, it shouldn't take the target system browser 150 times as long as ADUC or LDAP Browser to retrieve the exact same result using the exact same LDAP filter.

If I use the target system browser to find containers, users or organizational units outside the excluded OU, the result set is returned inside of 0.16 seconds even when the result sets have hundreds of objects from many different OUs. So it almost seems like the issue is specific to AD contacts.

If I set the container, contacts and organizationalUnits mappings to use the filtered schema classes, it takes 40 seconds for Target System Browser to find all contacts.

Any ideas why this might be happening?
And, why is this only happening with contacts? It doesn't happen with any other class of object, as far as I can tell.

Parents
  • 0 over 7 years ago

    The object filter filters the data after it has loaded all the data specified in your scope. And because the number of contacts are way more than the amount of all other objects you see the differences in load times.

    Please keep in mind that the filter for each object is a combination of the scope filter and the filter at the object class.

    And for your case you should be able to use a system filter on the scope for the organizational units as demonstrated in the screenshot.

    And, your query has to by like the following (notice the ! inside of the parentheses)

    If the scope filtering is not working, contact support and request the fix for VPR#28501.

    EDIT: Sorry, this works on the organizational units but not on the contacts it seems. You may want to contact support for a solution.

Reply
  • 0 over 7 years ago

    The object filter filters the data after it has loaded all the data specified in your scope. And because the number of contacts are way more than the amount of all other objects you see the differences in load times.

    Please keep in mind that the filter for each object is a combination of the scope filter and the filter at the object class.

    And for your case you should be able to use a system filter on the scope for the organizational units as demonstrated in the screenshot.

    And, your query has to by like the following (notice the ! inside of the parentheses)

    If the scope filtering is not working, contact support and request the fix for VPR#28501.

    EDIT: Sorry, this works on the organizational units but not on the contacts it seems. You may want to contact support for a solution.

Children
No Data