The SharePoint Farmer's Almanac : SSP

Fixing MOSS Search

Shane — Mon, 13 Apr 2009 14:56:13 GMT

Had a client today (last week now) who broke search all the way. And in their attempts to straighten it out they changed some pieces that weren't broken. Then while they were in the process of trying to put it all back together I called and said let me at it so they just stopped. Needless to say I picked up the farm in an odd state or more exactly Search was dead.

So the first step always when Search is broke is to go to the SSP Admin and check out things.

Open the SSP Administration page
Click on Search Administration and see what it has to say. (if you don't see Search Administration this means you have not installed the infrastructure update. I would highly recommend at a minimum you have that installed. Get the latest update install guide here)

When I opened the page I saw a Crawl status of Error. That is about worthless.

That is pretty much as generic as they come. You get the same Error when the server is on fire as you do when there is small hiccup. So a much better thing to do is:

Go back to the SSP administration page
Click on Search Settings (which is what we used pre infrastructure update)

This page does a much better job of giving you tangible errors. Here is what I got:

Error: An indexer is not assigned to the Shared Services Provider 'SharedServices1'.

Link to: Configure an indexer and a search database for this Shared Services Provider

Well that is fixable but how did they end up like this? They stopped the Indexing service in the farm by:

Go to Central Admin
Click on Operations
Click Services on Server
They choose their Index server
Then clicked Stop to the right of Office SharePoint Search Service

This doesn't just stop the service. This actually removes the service completely. This also removes the Index server from any SSP configured to use it. Now if you did want to just start and stop the service there is a way to do this:

Open a command prompt
Type net stop osearch and press enter
Type net start osearch and press enter

This will cycle the search service. Usually the only time you need to do something like this is after installing a new ifilter but sometimes it makes you feel better to give it a shot and see if that helps your problem. I do it more often than I should just for that reason.

Back to the task at hand clearing up that error! I double checked and they had already reconfigured the Office SharePoint Search Service on the Index server so all I need to do is go back to the Index server and re-associate the indexer.

From Central Administration click on Shared Services Administration from the left hand side of the page.
Hover over the SSP name, click the drop down arrow and click Edit properties

Scroll to the bottom of the page and select your Index server from the Index Server dropdown. If you see No Indexers in red you need to go back to your Services on Server and make sure you have the Office SharePoint Search service started and configured for the Index role.
Confirm that you have the correct index location. Usually the C: drive is less than ideal.
Click Ok

The SSP is now configured with an Indexer. Let's go make sure Search is happy.

Now click on the Shared Services Provider name to open the SSP admin site.
Click Search Settings

Don't be surprised if you get this error:

Error: The search service is currently offline. Visit the Services on Server page in SharePoint Central Administration to verify whether the service is enabled. This might also be because an indexer move is in progress.

Typically this is because the wheels of Search can move slowly. I have seen this error come up for 10 minutes or so in some farms. What Search is really telling you is it is busy getting the index and the database ready to go so you can start indexing. Be patient grass hopper. At the client this was gone after about 2 minutes.

Once I was able to get to a happy Search Settings page I went ahead and reset the Index back to zero. Not always necessary but they had 33,000 items in the index and 140,000 or errors. I thought better to start everything back to 0.

In order to reset the Index.

From the SSP admin screen click Search Administration
From the left hand column (quick launch for those who know terminology) click Reset all crawled content
Select Deactivate search alerts during reset
Click Reset now

Now you have a completely blank index. Why did we choose to deactivate search alerts? This is to keep from annoying the users. We don't want them all to get new alerts when new content is discovered when we recrawl in a minute. Once the index is back to normal we will re enable the alerts for them.

Ok so now the next step should be doing a full crawl. So let's try that.

From your SSP Administration home page click Search Administration
From the Quick Launch bar (on the left) click Content Sources
Hover over your Content Source, click the drop down arrow, and select full crawl
Now go back to the home page of Search Administration and watch to see if the crawl is running

Unfortunately in our case after about a minute I was left with 0 items in the index and 3 errors. After checking the errors I got Access Denied. L If you haven't done any monkeying around with changing your default content access account then it should have been automatically granted full access to your content source. You can confirm this by checking your Policy for web application in Central administration. If you forget how to do that check this blog post for a reminder. http://msmvps.com/blogs/shane/archive/2007/01/21/become-administrator-of-the-entire-web-application.aspx

If that checked out ok then the next thing I would check is to make sure your web application is set to integrated authentication and not basic authentication. MOSS will not pass basic authentication by default. So if you changed your web application from integrated to basic, so people users don't have to enter their domain for example, then you need to setup a custom crawl rule to pass basic authentication.

From your SSP Administration home page click Search Administration
In the Quick Launch bar click Crawl rules
Click New Crawl Rule
For path enter your web app URL ex: http://portal.company.com/*
For Crawl Configuration select Include all items in this path
For Specify Authentication select Specify a different content access account
Now fill in username and password remembering your domain\username form. I would recommended using your normal search account as you know it already has read access to the content.
Key step de-select the box to Do not allow Basic Authentication
Now do a full crawl. Also, remember if you have multiple web apps you may need more than one of this rules.

For the client this was not this issue but it is an important and often over looked troubleshooting step so I thought throwing it in here would be helpful.

The next thing I take a look at is the dreaded loopback fix. I showed this one to Todd Klindt one time and he wrote a nice post on the issue and a like to the KB for fixing it. http://www.toddklindt.com/blog/Lists/Posts/Post.aspx?ID=107 It is all but a guarantee these days if you have the WFE and Index role on the same server you are going to need to do this. A lot of farms have ran fine for a long time and just recently they have started requiring it. Must have been a Windows update that is causing this to be needed more but I haven't identified it. Another note even though this fix is only listed as applying to Windows 2003 it also applies to Windows 2008, had a different client need it last week. J

Loopback fix in and the server rebooted I tried another Full crawl. Success! Seems this was the root of their issues but as is often the case that happens to all of us, trying to fix it only made the problem worse. LOL

Don't forget to re-enable those search alerts.

From your SSP administration home page click Search Administration
In the System Status section in the center of the page click Search alerts status Enable

Another troubleshooting step I skipped, because the client had already done it was resetting search permissions. Read the blog post John Ross did summing up the steps to get permissions back on the up and up for the Search Service. http://www.sharepoint911.com/blogs/john/archive/2009/04/03/change-to-group-policy-broke-sharepoint-search-–-thanks-conficker-scare.aspx

Something I learned that was new

I am guessing since I didn't realize this is an option (or more probably I knew and forgot) you probably didn't either. So run stsadm –o help like below and take a look at the output.

Use Stsadm.exe from the 12 hive (c:\program files\common files\Microsoft shared\web server extensions\12\). Actually 12\bin to be exact.

C:\ >stsadm -help osearch

stsadm -o osearch

[-action <list|start|stop|showdefaultsspadmin>] required parameters for 'start' (if not already set): role, farmcontactemail, service credentials

[-f (suppress prompts)]

[-role <Index|Query|IndexQuery>]

[-farmcontactemail <email>]

[-farmperformancelevel <Reduced|PartlyReduced|Maximum>]

[-farmserviceaccount <DOMAIN\name> (service credentials)]

[-farmservicepassword <password>]

[-defaultindexlocation <directory>]

[-propagationlocation <directory>]

[-cleansearchdatabase <true|false>]

[-ssp <ssp name>] required parameter for 'cleansearchdatabase'

So really very similar to the options you have available to you from the GUI. The reason I used it was one of the Query servers was stuck in the starting state. In the GUI there is no stop until the service gets too started, not even a reboot will help. With stsadm you can do a stop and get out of the perpetual starting. J A very helpful trick.

If you are still fighting with Search here are couple of other Search troubleshooting things I wrote a while back

Hope you enjoy what feels like a small book

Shane – SharePoint Consulting

Another Error Message – Access Denied on Profile Import

Shane — Mon, 30 Jun 2008 15:56:31 GMT

I noticed the error message below repeatedly in event viewer and realized it was happening every time a profile import was happening.

Event Type: Error

Event Source: Office SharePoint Server

Event Category: Office Server General

Event ID: 7888

Date: 6/27/2008

Time: 11:37:17 AM

User: N/A

Computer: ServerName

Description:

A runtime exception was detected. Details follow.

Message: Access Denied! Only site admin can access Data Source object from user profile DB.

Techinal Details:

System.UnauthorizedAccessException: Access Denied! Only site admin can access Data Source object from user profile DB.

at Microsoft.Office.Server.UserProfiles.SRPSite.AdminCheck(String message)

at Microsoft.Office.Server.UserProfiles.DataSource._LoadDataSourceDef(IDataRecord rec)

at Microsoft.Office.Server.UserProfiles.DataSource._LoadDataSourceDef(String strDSName)

at Microsoft.Office.Server.UserProfiles.DataSource..ctor(SRPSite site, Boolean fAllowEveryoneRead)

at Microsoft.Office.Server.UserProfiles.DataSource..ctor(SRPSite site)

at Microsoft.Office.Server.UserProfiles.UserProfileConfigManager.GetDataSource()

at Microsoft.Office.Server.UserProfiles.BDCConnector.RefreshConfiguration(String sspName)

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.

Turns out that on this server they had a least privileged install done. In this case you need to make sure that within the SSP you have granted your default content access account and your SSP application pool account the manage profile permission. If you need help with that check out this article I wrote on SSPs and their rights. http://msmvps.com/blogs/shane/archive/2007/08/06/give-a-user-access-to-the-ssp.aspx

Shane – SharePoint Consulting

Did you know the BDC only queries the data?

Shane — Tue, 29 Jan 2008 03:36:43 GMT

That it actually does NOT import everything but just pulls the data in on demand? You probably just answered yes you already knew that. So why am I playing the role of Captain Obvious? Well, because possibly if the only thing you ever learned about the BDC prior to this was post was from me you might have gotten the above questions wrong. Brad H. from my Boston admin class emailed me today thinking he had misunderstood me. Nope. He heard me correctly, the problem was I was wrong. I will not rehash what I said wrong but will try to say things correctly from now on.

You use the Business Data Catalog (BDC) to connect MOSS Enterprise to business data sources (such as PeopleSoft, SAP, Seibel, etc)
You can display that data using the business data web parts
You can use the data as metadata in lists or libraries
You can setup custom actions on the displayed data to interact with it
You can make the BDC a content source for search, creating full indexes of the data (this is what cause my confusion)
The BDC is defined and administered at the SSP level (Shared Services Provider)
The BDC is a MOSS 2007 Enterprise feature only

For more information check out this great full feature information from my buddy Sahil http://blah.winsmarts.com/2007-4-SharePoint_2007__BDC_-_The_Business_Data_Catalog.aspx or the official Microsoft scoop at http://blogs.msdn.com/sharepoint/archive/2006/04/18/business-data-catalog.aspx

Anyway my apologies for the miss-information.

Shane – SharePoint Consulting

Finding My Links in the Database

Shane — Wed, 21 Nov 2007 12:44:18 GMT

If someone asked you where My Links were stored what you say?

First guess? They are part of My Sites right? I mean that is where you go to manage them and such. Nope. They are actually stored in your profile.

The reason I found out? A couple of my customers did some work around creating a new SSP and moving My Sites. When they got the My Sites moved over to the new location to their displeasure they found My Links missing. So they called me. Long story short I will tell you how to figure out what database they are in and how to read them out.

As always! Modifying a SharePoint Database is NOT SUPPORTED. Some would even argue running this select query against a database is not supported. In a perfect world ok, but sometimes people want info out of the DB not excuses. So don't shoot the messenger, I am just telling you how to get to it. If you do it or not is up to you.

So the first thing you need to do is figure out what profile database you need information out of. To do that you go to Central Admin.
Now Click Shared Services Administration from the quick launch.
From this screen hover over the appropriate SSP name, click the drop down arrow, and choose Edit Properties.
Now find where it says SSP Database. This your Database Name.
Now you need to open a SQL Query Window using the SQL Management tools
Then run the query below – Remember to replace the Use statement with your database name from step 4

Use SharedServices1_DB

Select

UP.NTName,

UP.PreferredName,

UP.Email,

UL.Title,

UL.URL

From

UserLinks UL inner join UserProfile_Full UP on UL.recordId = UP.recordID

You should then get a nice table of your results back.
In the case of Kenny and Dave they will be emailing each user a report of their links so they can set them up again. Not saying you couldn't find a different way to do this. J That is just the best solution for them.

Special thanks goes out to Kenny T and Dave E for their help with getting this information out there. They have inspired other blog post in the past but this time they actually wrote the SQL query so they get their names up in lights. Thanks guys!

Enjoy Turkey Day!

Shane – SharePoint Help

Give a user access to the SSP

Shane — Mon, 06 Aug 2007 15:00:54 GMT

This can be slightly more daunting and confusing to a SharePoint rookie than it should be. So I thought I would drill through the process and see if I can help someone out. The story usually goes something like this.

You are the IT guy. You got a request to install this MOSS thing so people could make web sites or something like that. Ok. After a couple of tries no problem. You got the darn thing installed for them. You create them a site collection and set them on their marry little way. No problems. Then the following week you get another call. "We need to configure search and import some profiles. We need to access the Shared Service Provider to do this. Can you let us in?" OK. Now what?

You could do it the lazy way and cross your fingers they don't break anything by granting access to the whole web application. That was detailed in my post Become Administrator of the Entire Web Application. But even if you do this you will find they still can't manage profiles , audiences, permissions, or usage analytics. Bummer. So what should you do?

Start off by logging into the SSP admin site.
Now you need to add the user just like you would to any other site. Click Site Actions > Site Settings
Under Users and Permissions click Advanced permissions
Click New > Add Users
Enter your user and put them in a group. Normally I just place them in the Viewers group and hit OK

Now your user can log into the SSP and manage search settings, the Excel Service Settings, and can view the various links list. So how do you give them more permissions? Well in order to do that you need to give them some more access.

Under User Profiles and My Sites click Personalization services permissions.
Click Add Users/Groups
Enter your users name select which permissions you would like to bestow upon them and click Save.

What are all of these different permissions? I am glad you asked. J

Create personal site gives the user the capability to create and use a My Site. Going deep here will have to be saved for another day but if you want to make that My Site link disappear take away this right from the users. But you didn't give it to them. Why do they have it? Go back to the manage permission screen. All authenticated users were given this right by default.
Use personal features is another topic for another day. Essentially though this provides the My Links functionality and allows users to manage their Colleagues.
Manage user profiles this allows your user to do just that. Get in there and modify the profiles for this SSP. Give them this right and now they can access the links: User profiles and properties, Profile services policies, and My Site Settings.
Manage audiences you guessed it but now you can click that handy little Audiences link. Once you are there you can set the schedule or define the rules for building those global audiences.
Manage permissions this will let that user modify Personalization services permissions (the stuff we are doing right now).
Manage usage analytics this gives the user access to make changes to Usage reporting. Small bug here but if the user doesn't have this right they can still open up the screen. Then if they make a change and hit ok they get a 403 forbidden error. Reminds you of SPS 2003 doesn't it. J

So now if you have given the user all of those permissions they should be a happy camper? Depends. If you have MOSS Enterprise then probably not because they still can't manage the BDC. Yikes! More to do.

Click Business Data Catalog permissions from the main screen of the SSP
Click Add Users/Groups
Enter your user, select their permissions and click Save

Since I will not even claim to understand the BDC I will leave you to use the included explanations on the screen to figure out what to give your users.

Anyway, hopefully this will help you out.

Shane – SharePoint Help

What is a Shared Service Provider?

Shane — Fri, 29 Jun 2007 01:45:48 GMT

For those of you who don't know what I am talking about a bit of overview. In MOSS 2007 there is this new concept of Shared Services Providers(SSP). The idea being that there are certain services that really make sense to centrally manage and share. A good example being profiles. With a SSP we can import all of the profile information from AD once and then our various web applications can consume the data. So maybe we have http://marketing and http://accounting it doesn't make sense for each one to maintain identical profile information, they should share.

The major services that are handled by the SSP are:

Profiles and Audiences
My Sites
Search
All of Excel Services
All of the BDC (Business Data Catalog)

Below is an example screen shot from MOSS 2007 Enterprise:

Sometimes the easiest way to think of Shared Services is the Parent vs. Child relationship. The Parent (your SSP) goes out and does all of the work (pulling BDC data, indexing content, hosting My Sites) and the child (your web applications) come to the parents to ask for $5 (request data from the BDC, or view a calculated Excel sheet). Does that help?

Multiple SSPs

One of the most overwhelming things about SSPs for some people planning is how many should I have? It is easy to see from the interface that you are given the opportunity to create more than one. When should you do this?

As a general rule of thumb most companies will use one SSP. This is my default answer. So why do they give you the ability to run multiple SSPs? There are cases where you want separate search or profiles. The most common? Extranet/internet scenarios. Maybe your SharePoint farm hosts two primary web applications. http://portal for your intranet and http://ourcustomers for your extranet. In this scenario you probably want separate search and profiles. And now you have found the reason to have multiple SSPs. You don't want to share information you want unique information for both.

Another advantage of SSPs

Separation of roles. In some medium and large environments it is not uncommon to have one group administering the physical server farm while another group needs to just maintain search. Well the SSP concept makes this very easy. Since the SSP is its own SharePoint site collection you can define a users access so they can NOT access central administration but they CAN access the SSP. And once they get into the SSP you can even limit them. Once inside the SSP you can determine if they can:

Manage user profiles
Manage audiences
Manage permissions
Manage usage analytics

Best I can tell if you give them access to the SSP all of the other SSP functions they will have rights to. Guess it needs more testing.

Still this separation of services from the actual administration of the server can be quite useful. Epically in companies where the less access I give a user the better.

Moral of the story

SSPs are very helpful and important to understand. They should be part of your initial planning. They can be secured at a very granular level or they can be give broad access. Just mark this topic down as something else you need to full think through before you start rolling out SharePoint. And when all else fails just have one SSP.

Shane –SharePoint Help

The SharePoint Farmer's Almanac : SSP

Fixing MOSS Search

Another Error Message – Access Denied on Profile Import

More Problems with SQL Server High CPU and MOSS Search

Did you know the BDC only queries the data?

Finding My Links in the Database

Give a user access to the SSP

What is a Shared Service Provider?