Some backstory, this "appears" to have started or at least when we first noticed a problem was back on July 1st when approx. 2000+ accounts that the "Workorder" Driver had scheduled for deletion occurred. There were also a number of new account creates do to beginning of fiscal year hires.

This is what we were seeing in the driver trace file:

<nds dtdversion="3.5">
<product build="201309111957" instance="\NIU-FLAT\NIU\DirXML\DS1\Office365 Employees" version="">Identity Manager Drive
r for Microsoft Office365</product>
<contact>Novell, Inc.</contact>
<status event-id="WorkOrder#Publisher#01:fc6ac283-83df-4e07-9dc5-db6c20dbe2ec" level="error">Exception of type 'DXMLBase.Xds.X
dsRetryException' was thrown.</status>
[07/04/16 11:50:21.939]:Office365 Employees ST:Resolving association references.
[07/04/16 11:50:21.942]:Office365 Employees ST:Processing returned document.
[07/04/16 11:50:21.945]:Office365 Employees ST:Processing operation <status> for .
[07/04/16 11:50:21.949]:Office365 Employees ST:
DirXML Log Event -------------------
Driver: \NIU-FLAT\NIU\DirXML\DS1\Office365 Employees
Channel: Subscriber
Object: \NIU-FLAT\NIU\Groups\Global-Department-Group-CN00000
Status: Error
Message: Exception of type 'DXMLBase.Xds.XdsRetryException' was thrown.
[07/04/16 11:50:22.688]:Office365 Employees ST:End transaction.
[07/04/16 11:50:22.692]:Office365 Employees ST:Start transaction.
[07/04/16 11:50:22.695]:Office365 Employees ST:Processing events for transaction.
[07/04/16 11:50:22.698]:Office365 Employees ST:
<nds dtdversion="4.0" ndsversion="8.x">
<product edition="Advanced" version="">DirXML</product>
<contact>Novell, Inc.</contact>
<delete cached-time="20160701100021.163Z" class-name="User" event-id="WorkOrder#Publisher#01:6dc5edb2-b8c4-4c70-860b-caa8216dc
736" qualified-src-dn="O=NIU\OU=Users\CN=A1674662" src-dn="\NIU-FLAT\NIU\Users\A1674662" src-entry-id="814312" timestamp="13966448


We contacted technical support and the following was suggested:

1) Upgrade to Identity Manager 4.5, we are currently at AE

Agreed, we need to do that but it won't be today.

2) In the mean time for the error message:

The error you sent in the detailed description, appeared to be a “normal” error.
Exception of type 'DXMLBase.Xds.XdsRetryException' was thrown
From what I can see, it appears that the error is thrown if the user does not have an association to the driver. I see the user being tried to be removed from the group, but the operation fails with a 8003, which indicates the user is not associated to the driver. The user must have an association to the driver if they are to be added or removed from the group.

3) For a fix to the slowness, does this seem a reasonable driver change and what would be the impact of just deleting the offending group?

I do see a huge slowness in the driver when it tries to process the group \NIU-FLAT\NIU\Groups\O365-Migrate-Ready through the subscriber channel. That group has 7,821 users in the group, so it takes a substantial amount of time. The problem comes from the fact that you are vetoing the transaction in the custom rule “Check for required Group attributes” in the Creation policy. It has already taken roughly 3.5 minutes to process the group modify operation, which is converted to an add operation and then eventually vetoed in the creation policy. So you need to move that rule further up in the processing so it vetoes the operation sooner. Instead of having “Check for required Group attributes” in the creation rule, place it as the first rule in the matching policy. So when the group modify get’s converted to an add operation, then it checks for the required attributes and vetoes it immediately if they are not there. I believe it is the Custom Rule “Check for required Group attributes” that you created in the creation policy that is slowing the driver processing down and backing up the change cache for the driver.

For the slowness and cash file getting backed up, it's been 4 days and cash file is still increasing in size. We are thinking of modifying the driver per the recommendation above, but would deleting or just un-populating the group have a immediate positive impact till we can get the driver changes in place?

p.s. I'm not an expert on Identity Manager.

Michael Phelps
Northern Illinois University