Protected Domain Replication Stopped Due to Time Sync Issue

This article applies to all JSDR software versions.

Problem

This problem has two defining characteristics:

• The replication status of the protected domain is stuck as “Stopped” with a red icon.

• An error is reported in the MSA log: “Server failed to authenticate the request…“
  
  For example:
  Oct 30 09:42:36 drva-live DRVA[1123]: JSS:OC:operator()(131): Azure op:BktExists, URI https://avs2.blob.core.windows.net/jetdr-dom-d04b-11ec-8a11-0050569fb8e0, bkt:jetdr-dom-d04b-11ec-8a11-0050569fb8e0, obj:,status code: 403, Reason 'Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.' 403 Server failed to authenticate the request. Make sure the value of Authorization header is formed correctly including the signature.

Troubleshooting

This issue can occur if the DRVA is not synchronized with the ESXi host time. Do the following to confirm the nature of the problem:

1. Identify which DRVA is being used by the protected domain exhibiting the problem.
   
   
2. Run the date command on the DRVA with the problem to check its current date/time.

3. Verify the current date/time on a healthy DRVA and compare it to the DRVA with the problem.
   • If the reported values are not identical, the DRVA with the problem is not in sync with the ESXi host time.

Solution

1. Reboot the DRVA with the problem.
   • This should cause the date/time to become synchronized with the host.
     
     
2. After the DRVA is up and running, check its date/time again.
   • The date/time should now be consistent with other running DRVAs.
   • The protected domain’s replication status icon in the JetStream DR UI should now be green.
     

DRVAs do not use a dedicated NTP configuration setting. Their time is set by synchronizing with the ESXi host on which they run.

NTP IP and time/date settings can also be validated from vSphere where the DRVA is hosted by navigating to: Host > Configure > System > Time Configuration.



However, this is not always possible because under some circumstances such as when using ESXi in AVS, direct access to the host is not allowed.