mirror of
https://github.com/prometheus-community/windows_exporter.git
synced 2026-10-17 18:19:04 +02:00
Jan-Otto Kröpke
f8f2a71d77
collectors.ad and collectors.time are the only switches for the Active Directory and clock alerts, like every other opt-in collector. Setting the removed keys fails the build with a message naming the replacement. Signed-off-by: Jan-Otto Kröpke <mail@jkroepke.de>
42 lines
1.4 KiB
Markdown
42 lines
1.4 KiB
Markdown
---
|
|
title: WindowsADPendingReplication
|
|
---
|
|
|
|
## Meaning
|
|
|
|
Pending Active Directory replication operations exceed the configured threshold
|
|
for 15 minutes. The default is 50 operations. This alert is generated only with
|
|
`collectors+: { ad: true }` and requires the `ad` collector on domain controllers.
|
|
|
|
## Impact
|
|
|
|
Directory changes may be delayed between domain controllers, causing inconsistent
|
|
authentication, group membership, DNS, or policy behavior.
|
|
|
|
## Diagnosis
|
|
|
|
1. Inspect `windows_ad_replication_pending_operations` and determine whether the
|
|
queue is growing or draining.
|
|
2. On a domain controller, inspect replication health:
|
|
|
|
```powershell
|
|
repadmin /replsummary
|
|
repadmin /showrepl
|
|
repadmin /queue
|
|
dcdiag /test:Replications
|
|
```
|
|
|
|
3. Check the Directory Service event log, partner reachability, DNS resolution,
|
|
site links and schedules, and CPU/disk/network pressure.
|
|
4. Correlate the queue with [WindowsADReplicationFailures](../windowsadreplicationfailures/)
|
|
and planned large directory changes.
|
|
|
|
## Mitigation
|
|
|
|
Restore connectivity and DNS between replication partners. Correct replication
|
|
errors and review site-link capacity or schedules with the directory owner.
|
|
Relieve resource pressure on domain controllers. Allow expected bulk changes to
|
|
drain while monitoring progress. Avoid forcing widespread replication or removing
|
|
partners before understanding the failure. Confirm the queue decreases and
|
|
replication health checks succeed.
|