Jan-Otto Kröpke
f8f2a71d77
collectors.ad and collectors.time are the only switches for the Active Directory and clock alerts, like every other opt-in collector. Setting the removed keys fails the build with a message naming the replacement. Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de>
1.4 KiB
title
| title |
|---|
| WindowsADPendingReplication |
Meaning
Pending Active Directory replication operations exceed the configured threshold
for 15 minutes. The default is 50 operations. This alert is generated only with
collectors+: { ad: true } and requires the ad collector on domain controllers.
Impact
Directory changes may be delayed between domain controllers, causing inconsistent authentication, group membership, DNS, or policy behavior.
Diagnosis
-
Inspect
windows_ad_replication_pending_operationsand determine whether the queue is growing or draining. -
On a domain controller, inspect replication health:
repadmin /replsummary repadmin /showrepl repadmin /queue dcdiag /test:Replications -
Check the Directory Service event log, partner reachability, DNS resolution, site links and schedules, and CPU/disk/network pressure.
-
Correlate the queue with WindowsADReplicationFailures and planned large directory changes.
Mitigation
Restore connectivity and DNS between replication partners. Correct replication errors and review site-link capacity or schedules with the directory owner. Relieve resource pressure on domain controllers. Allow expected bulk changes to drain while monitoring progress. Avoid forcing widespread replication or removing partners before understanding the failure. Confirm the queue decreases and replication health checks succeed.