question

CharlesMukwevho-9193 avatar image
1 Vote"
CharlesMukwevho-9193 asked ·

Azure Multi-Factor Authentication Secondary Server Lag

When we open MFA Console on the Secondary server it takes a long time to show all users, Radius, and any properties.

The master server works fine on the MFA console but the Secondary just hangs. The organization has 2 on-prem MFA servers (1 in Johannesburg - Master) and (1 in Cape Town - Secondary)

Please help

Regards

Charles

azure-ad-multi-factor-authentication
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

ShashiShailaj-MSFT avatar image
3 Votes"
ShashiShailaj-MSFT answered ·

Hello Charles,
Thank you for your query. We generally have seen that the secondary server UI issues are a by-product of network latency because the secondary server have to copy the pfdata file which contains all the details from primary. However we can troubleshoot this using the logs to find out the cause. Please follow the following and check the logs with the details as described and it can help you analyze and come to a conclusion as to why this would be happening. We will be checking the logs on the secondary server. For simplicity of analysis please use notepad++ for checking timestamp in the logs and deriving a pattern out of it.

Please go to the folder C:\Program Files\Multi-Factor Authentication Server\Logs which is default log location for MFA logs and you can use the logs to find more information . Check the MultiFactorAuthConfiguration_XXX logs (most recent one) to find what is the status of the connection . If it is Connected and online with the primary (master) server or not .

The first thing we would check if the replication is working between the primary (master) and the secondary (slave) server or not . Check the Log file MultiFactorAuthSvc.log . To be 100% sure of whether replication is working or not, check the logs on the slave server for the "Update loaded." message. If this is occurring on a regular basis, then replication is working as expected regardless of the status displayed for the server. You can also check the date on the PhoneFactor.pfdata file on the slave. If it is current, then replication is working.

Now proceed with checking the MultiFactorAuthSvc log to understand if issue is caused due to latency . Check the Log file MultiFactorAuthSvc.log . Search for the keyword “slave|Received” . This will filter the attempts of retrieving the Master Pfdata file from the master server. And it will list the duration taken in each case. This can give you more information if latency is the issue between master and slave. Generally it’s better to avoid running the MFA server UI on a slave server which is geographically distant from the master server. When launching the MFA Server UX on a slave, it connects to the master. The latency that can slow down replication can also contribute to slowness launching the UX. We generally do not recommended to run the MFA Server UX on a slave that is geographically separated from the master for this reason. In your case they are not too far but there could be network latency .

Check the MultiFactorAuthADSyncSvc MFA AD sync service should be set to Manual . Sometimes this is set to automatic which can cause UI issues as well. The service should not be running on the slave , Ideally it is called whenever needed and can be started so make sure its not set t automatic in the services console. If you check the Master server you may find that the logging for pfadssvc service will show that it keeps checking any changes in users information from AD if AD sync/import has been set.

I hope the above data and analysis of the same can help you find a pattern and get the cause of the issue. If the explanation above does not help you to obtain the details , please let us know and we will try to further help you on this.

Thank you.

· Share
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

CharlesMukwevho-9193 avatar image
0 Votes"
CharlesMukwevho-9193 answered ·

Hi @shashishailaj

Thank you for your feedback. I checked all the recommendations you provided and everything seems to be above board but I'm still experiencing the same issue.

Regards

Charles

· 3 · Share
10 |1000 characters needed characters left characters exceeded

Up to 10 attachments (including images) can be used with a maximum of 3.0 MiB each and 30.0 MiB total.

If it still does not help , I would suggest to open a case with Microsoft Support . Ideally the recommendation is against using the UI on secondary server. However , if you feel that is the absolute need in your environment I would suggest to open a ticket with Microsoft support through Azure Portal . And they would help your troubleshoot the same . They may need to collect process dumps and other logs in order to come to any conclusion.

Thank you.

0 Votes 0 · ·

@CharlesMukwevho-9193 . I am just following up on this if you had a chance of getting it solved . If you id , please do share your findings with support.

0 Votes 0 · ·

Hi @shashishailaj

Not yet but I still have an open support ticket with Microsoft.

Regards

Charles

0 Votes 0 · ·