Troubleshooting Reports

In general, if something doesn't work the way that you think it should, try the following to troubleshoot your reporting environment:

  • View the log files
  • Rebuild or refresh the reporting data
  • Validate that the reporting service has the correct permissions to read data from the monitored domains and replicate the data.
  • Export diagnostics data for use by IBM Security Technical Support (if technical support requests that you do so).

This section describes some situations that you might encounter, along with some suggested solutions or workarounds.

You Don’t See Any data When You Open a Report

Problem: You’ve installed everything and you can open a report, but you don’t see any data.

Solution: Make sure that there has been at least one synchronization between Active Directory and the reporting database. Use the Report Configuration wizard to do this.

You Don’t See the Report Builder Link in Internet Explorer

Problem: You go the Home page in Internet Explorer, the home page for your deployed reports in SSRS, and you do not see the Report Builder link. But you’re fairly sure that you have the required permissions to create reports.

Solution: Here are some things for you to check:

  1. Make sure that you are logging in within the same domain that SSRS is installed within. For example, if you’re creating an evaluation version that uses a different domain, there may be issues.
  2. Go download the Report Builder for your SQL Server version. For now, it’s a separate download.

You Can’t Log in to Report Services in Internet Explorer

Problem: When you log in to IBM Security Report Services in Internet Explorer, you cannot successfully log in. You see an error message like this: “User domain\user does not have required permissions. Verify that sufficient permissions have been granted and Windows User Account Control (UAC) restrictions have been addressed.”

Explanation: If you’re seeing this issue, it may have happened after your first installation or an upgrade in which you created a new SQL Server instance.

Solution: Here are some things for you to try:

  • When you go to launch Report Services, right-click it and select Run as Administrator. This may allow you to log in to Report Services, and from there you can edit the Site Settings for security.
  • Log in to Report Services as an administrator, and go to Site Settings to add your users by way of adding the domain and assign the group or user a role. For details, see Granting access in SSRS to reports.
  • Make sure that you also set permissions for the home folder, as mentioned in the topic mentioned above.

You Get a Server Error When You Try to Synchronize with Active Directory

Problem: In the Report Services control panel, when you go to synchronize data for report services, the following error displays: “The server is unwilling to process the request.” (KB-6350)

You also see a similar error in the report services log file. Here’s an example of what the error looks like:

[2015-08-21 10:53:25.714 +0800] Centrify.Report.Service.exe[3596,10] Error: SyncServer.DoSynchronization: Failure during synchronize domain a9f1r1.test, DC: a9d1-w2k12r2.a9f1r1.test.

[2015-08-21 10:53:25.714 +0800] Centrify.Report.Service.exe[3596,10] Error: SyncServer.DoSynchronization: Reason: The server is unwilling to process the request.

Explanation: The issue is due to insufficient memory on the domain controller. The domain controller is unable to allocate enough memory for Active Directory caching.

Solution: Adjust the memory allocated to the domain controller, according to Memory requirements.

Port Conflicts

Problem: IBM Security Report Services not install correctly when port 80 is used by another application, such as Apache Tomcat. The following error displays during the report services configuration wizard: “The service was unable to access Report Services.” (KB-7443)

Explanation: By default, Microsoft SQL Server Reporting Services (SSRS) use port 80, and it is not recommended to run it with a third party software that also uses port 80 or 443.

Solution: For port conflict situations, you can configure SSRS to use another port.

To change the port that SQL Server Reporting Services (SSRS) uses:

  1. Open the SQL Server Reporting Services Configuration Manager.
  2. Navigate to the Web Service URL.
  3. Change the TCP port to an unused port other than 80.

For example, port 8080.

  1. Navigate to the Report Manager URL, and click Advanced.
  2. Change the TCP port to the same port number that you specified in Step 3.
  3. Run the IBM Security Report Services Configuration Wizard and specify URLs with the new port number.

For example, http://reportservice:8080/ReportServer_CssREPORTS2

  1. Verify that you can access reports through the specified port.

You may also need to modify your firewall rules for access to the specified port.

SSRS Fails to Start on Windows 2008 R2 Systems

Problem: SQL Server Reporting Services (SSRS) fails to start, due to a timeout issue. This issue occurs only on Windows 2008 R2 systems. (KB-8065)

SSRS Produces the Following Error

Windows could not start the SQL Server Reporting Services (MSSQLSERVER) service on local computer. Error 1053: The service did not respond to the start or control request in a timely fashion.

Explanation: This happens due to SSRS checking for certificate revocation lists (CRL), and this is a Microsoft known issue, as detailed here: http://support.microsoft.com/kb/2745448.

IBM Security does not take any responsibility for the content or availability of this link, it is provided as a courtesy. You should contact Microsoft if there are any further questions.

Solution: You can perform one of the following tasks to try and resolve this issue:

  • Disable certificate revocation lists checking. For details, see http://tech.lanesnotes.com/2014/02/sql-server-reporting-services-service.html
  • Change the default revocation checking behavior using group policy. For details, see https://technet.microsoft.com/en-us/library/ee619786(v=ws.10).aspx

SQL Server 2008 R2 Express Edition Produces an Installation Error

Problem: When you run the installer, you get an error when it tries to install the SQL Server 2008 R2 Express edition for report services. The installer produces the following error: (KB-8172)

The Report Services Configuration Wizard Cannot be Completed Due to an Error that Occurred

The program was unable to install SQL Server on this computer, exit code: 0x851A0017. Please refer to the IBM Security Knowledge Base article (KB-4589) for more information on the error code you received. Please fix the issue and run Setup again.

You might also see something like the following errors in the SQL Server log file, which you can locate in a directory such as C:\Program Files\Microsoft SQL Server\100\Setup Bootstrap\Log\<number>\Detail.txt.

2017-01-25 12:41:31 Slp: Configuration action failed for feature SQL_Engine_Core_Inst during timing ConfigRC and scenario ConfigRC. 2017-01-25 12:41:31 Slp: Could not find the Database Engine startup handle. 2017-01-25 12:41:31 Slp: The configuration failure category of current exception is ConfigurationFailure 2017-01-25 12:41:31 Slp: Configuration action failed for feature SQL_Engine_Core_Inst during timing ConfigRC and scenario ConfigRC. 2017-01-25 12:41:31 Slp: Microsoft.SqlServer.Configuration.SqlEngine.SqlEngineConfigException: Could not find the Database Engine startup handle. 2017-01-25 12:41:31 Slp: at Microsoft.SqlServer.Configuration.SqlEngine.SqlServerServiceBase.WaitSqlServerStart(Process processSql) 2017-01-25 12:41:31 Slp: at Microsoft.SqlServer.Configuration.SqlEngine.SqlEngineDBStartConfig.ConfigSQLServerSystemDatabases(EffectiveProperties properties, Boolean isConfiguringTemplateDBs, Boolean useInstallInputs) 2017-01-25 12:41:31 Slp: at Microsoft.SqlServer.Configuration.SqlEngine.SqlEngineDBStartConfig.DoCommonDBStartConfig(ConfigActionTiming timing) 2017-01-25 12:41:31 Slp: at Microsoft.SqlServer.Configuration.SqlConfigBase.SlpConfigAction.ExecuteAction(String actionId) 2017-01-25 12:41:31 Slp: at Microsoft.SqlServer.Configuration.SqlConfigBase.SlpConfigAction.Execute(String actionId, TextWriter errorStream) 2017-01-25 12:41:31 Slp: Exception: Microsoft.SqlServer.Configuration.SqlEngine.SqlEngineConfigException. 2017-01-25 12:41:31 Slp: Source: Microsoft.SqlServer.Configuration.SqlServer_ConfigExtension. 2017-01-25 12:41:31 Slp: Message: Could not find the Database Engine startup handle.

Explanation: The SQL Server Express edition isn’t able to use the encryption protocols provided by the server.

The installation error occurs because TLS1.0/1.1 and SSL 3.0 protocols and some ciphers have been disabled on the server, due to customer security concerns. SQL Server 2008 R2 Express Edition does not support the newer version of cipher suites (such as TLS1.2 with SHA256), while the regular versions of SQL Server with the latest updates or support packs (SP) do.

Solution: Restore the server settings back to the system defaults that allow TLS1.0/1.1, SSL 3.0 protocols and ciphers. After you do that, the installer will successfully complete a report services installation with SQL Server Express edition.

Installing SQL Server from the IBM Security Management Services Installer Generates Error Codes

Problem: When you install the SQL Server version that is bundled with the IBM Security Management Services installer, there are errors. (KB-4589)

SQL Server installation error Description
0x84B40000 - full text service cannot run under local system account on DC. This means user is trying to install SQL Server on a Domain Controller with Full Text Search service configured under a local system account. This is not supported by Microsoft. Workaround is to either install SQL on a member server, or manually install SQL and select a different account to run it as Full Text Search service.
For this error code, more information is needed, see below on how to collect logs.
0X6AA If SQL server is already installed on a machine with default SQL server instance (with advanced services), the SQL server setup will fail with the above error code. To workaround this issue, reinstall SQL Native Client (SNAC) before installing the second instance of SQL Server 2005 Express Edition with Advanced Services. - http://msdn.microsoft.com/en-us/sqlserver/ff658533 (Provided as a courtesy)
This means a hyphen (-) in the SQL server's instance name has been specified and is not allowed.
SQL Server Management Studio 2005 has been installed on the system and there is an attempt to install SQL 2008 on top of it. To workaround this issue, manually uninstall SQL Server Management Studio and then install the later version.
PowerShell 2.0, which is a prerequisite for Microsoft SQL server 2014, is not installed. Install Windows Management Framework 2.0 first before run Report Services Configuration Wizard
SQL Server 2008 R2 express edition with advanced features will fail to install an new instance when TLS 1.0/1.1 and SSL 3.0 protocols are disabled. It fails with a message like: SQL Server installation failed. To continue, investigate the reason for the failure, correct the problem, uninstall SQL Server, and then rerun SQL Server Setup. To work around this issue, re-enable the protocols (Update corresponding values to 1.) The SQL Server instance then can be installed successfully. Refer to: https://blogs.msdn.microsoft.com/friis/2016/07/25/disabling-tls-1-0-on-your-windows-2008-r2-server-just-because-you-still-have-one/

If the SQL Server installation fails for any other reason, send the installation log files to IBM Security support. You can locate the installation log files in the following locations:

  • SQL Server 2008 and 2008 R2:

%ProgramFiles%\Microsoft SQL Server\100\Setup Bootstrap\LOG

  • SQL Server 2012:

%ProgramFiles%\Microsoft SQL Server\110\Setup Bootstrap\Log\.

  • SQL Server 2014:

%ProgramFiles%\MicrosoftSQL Server\120\Setup Bootstrap\Log\.

  • SQL Server 2016:

%ProgramFiles%\ Microsoft SQL Server\130\Setup Bootstrap\Log\

See also: https://centrify.my.salesforce.com/50180000000blYD, http://support.microsoft.com/kb/955396.

Can’t install SQL Server 2012 or 2014 instance on Windows 2008 SP2

Problem: If you use the Report Services Configuration wizard to install a new instance of SQL Server version 2012 or 2014 on Windows Server 2008 SP2, the installation fails if Windows Powershell 2.0+ or Windows Management Framework 2.0 is not already installed. The installation failure has an exit code of 0x84BE0260 (KB-7096).

Explanation: Windows Server 2008 SP2 doesn’t include PowerShell 2.0 or Windows Management Framework 2.0 by default. Later versions of Windows Server do include these components by default.

Solution: Install PowerShell 2.0 or higher and Windows Management Framework 2.0 before you run the Report Services Configuration Wizard to install a new instance of Microsoft SQL Server 2012 or 2014.

You can download Windows Management Framework 2.0 from https://support.microsoft.com/en-us/kb/968930.

Report Services computation takes longer than it used to

Problem: If Report Services uses SQL Server 2014 or above, you might notice that Report Services spends more time on computation.

Explanation: In SQL Server 2014, Microsoft introduced a new cardinality estimator (CE). This cardinality estimator was redesigned to improve query performance, and there may be some performance degradation for some SQL statements.

Solution: If you notice some report services computation performance issues, set the database compatibility level to 110 to force SQL Server to use the old cardinality estimator.

To set the database compatibility level to 110:

  1. In SQL Server Management studio, run the following before Report Services synchronizes with Active Directory:

ALTER DATABASE <the database name deployed by Report Services> SET COMPATIBILITY_LEVEL = 110

Frequently asked questions about report services

Question: Is it possible for report services to use an existing database that's already been created according to our organization's standards?

Answer: Report services cannot use an existing database, the Configuration Wizard creates a new database.

Question: Does report services create just one database?

Answer: Yes. If you reconfigure report services, the Configuration Wizard creates a new database.

Question: Does the report services installation make any other modifications to database objects other than in the database it creates?

Answer: No.