ZCM 10.3.2 with (2) SLES 11 SP1 x64 Primaries and MS SQL 2005 DB

We we're running 10.3.1 just fine for a few weeks and then all of a sudden our workstations would take about 4 extra minutes to login. We are using the latest version of the Novell Client (4.91 SP5 IR1) and after the user enters their username & password, the Novell Client sits there with an hourglass cursor for approx 4 minutes but eventually logs into eDirectory and the ZCM zone OK.

I enabled all the logging I could think of and I can see exactly where it is happening but I have not idea what is causing it:

From the workstation:


[DEBUG] [03/09/2011 14:55:04.630] [1540] [ZenworksWindowsService] [13] [] [SessionManager] [] [Determining Session to use since this is a device session] [] [] 
[DEBUG] [03/09/2011 14:57:04.630] [1540] [ZenworksWindowsService] [13] [] [SessionManager] [] [Returning 0 user sessions after 119.994 seconds] [] [] 

[DEBUG] [03/09/2011 14:57:04.630] [1540] [ZenworksWindowsService] [13] [] [SessionManager] [] [Determining Session to use since this is a device session] [] [] 
[DEBUG] [03/09/2011 14:59:04.630] [1540] [ZenworksWindowsService] [13] [] [SessionManager] [] [Returning 0 user sessions after 119.997 seconds] [] []
The entire log is available here: http://dl.dropbox.com/u/2445283/zmd-messages.log (zone name and domain name removed)


[604-6A8] [14:54:47] CASA_AuthToken -FreeAuthCacheEntry- Start, pEntry = 0x7C45BAC
[604-6A8] [14:54:47] CASA_AuthToken -FreeAuthCacheEntry- End
[604-6A8] [14:54:47] CASA_AuthToken -ObtainAuthTokenInt- End, retStatus = 00000000
[604-6A8] [14:54:47] CASA_AuthToken -ObtainAuthTokenEx- End, retStatus = 0
[604-EB8] [14:59:19] CASA_AuthToken -ObtainAuthTokenEx- Start
[604-EB8] [14:59:19] CASA_AuthToken -ObtainAuthTokenInt- Start
[604-EB8] [14:59:19] CASA_AuthToken -ObtainAuthTokenInt- ServiceName = com.novell.zenworks.<ZONE NAME REMOVED>

ZENLGN [204-208] [14:54:43:109] ZenLgnLogin entered
ZENLGN [204-208] [14:54:43:109] Calling ZENIsServerAvailable
ZENLGN [204-208] [14:54:44:156] Returned from ZENIsServerAvailable
ZENLGN [204-208] [14:54:44:156] About to call ZENLogin in agent service
ZENLGN [204-208] [14:59:07:255] Returned from calling ZENLogin in agent service
ZENLGN [204-208] [14:59:07:255] LgnSetZenUsernameHistory
ZENLGN [204-208] [14:59:07:255] LgnSetRealmNameHistory
ZENLGN [204-208] [14:59:07:255] CacheUsersZenName Entered
ZENLGN [204-208] [14:59:07:255] CacheUsersZenName returning:  0
ZENLGN [204-208] [14:59:07:255] ZenLgnLogin returning 0
ZENLGN [204-208] [14:59:07:364] ZenLgnLoginUI exiting:  0
I don't see anything on the primary server side in the loader-messages.log or in the CASA logs.

I have tried using different eDirectory servers as the user source and no matter which one I use, we have this issue. As soon as I remove the user source and the user logs in without one, the login times are back to normal.

I can browse the user source just fine in ZCC and using an LDAP browser. The response times to browse the user source in the ZCC are actually really fast.

The workstation does eventually login but it takes approx 4 minutes -- as you can see from the two instances of "Returning 0 user sessions after 119.997 seconds".

I tried upgrading to 10.3.2 hoping that would resolve the issue, but it did not. No certificates are expired on either the ZCM primaries or the eDirectory servers. Everything is resolvable through DNS (both forward and reverse). I have multiple 10.3.1 ZCM deployments and this is the only one with this issue. Date & time between ZCM primaries and workstations is within a couple minutes, if not less.

I've been suspecting it's something unique to their eDirectory tree or with the MS SQL DB server.

Any help is greatly appreciated! :)