SRSS Troubleshooting Icons
The Sun Ray Server Software displays various icons on the client screen to help identify problems quickly.
If you see the older version of the icons, the firmware has not been upgraded or is failing. To make sure that you are using the latest firmware, see How to Update Firmware Versions on DTUs.
Types of Troubleshooting Icons
| Icon Type |
Example |
Description |
|---|---|---|
| On-Screen Display (OSD) |  |
Indicates the current state of a client's connectivity. These icons are shown as white icons. They can display even if the client is not connected to a server. and they typically provide the following detailed information:
|
| Server Policy |
 |
Indicates a problem based on a specific server policy that needs attention. These icons are shown as blue icons. They are sent by the server in place of a regular session, they may be overlaid by a concurrent client state OSD icon, and they are not available if the client is behind a NAT router. |
Troubleshooting Icon Quick Reference
| Icon Code (Click for More Information) |
General Category = Server Policy Icon |
Meaning |
|---|---|---|
| 1 | Startup |
Sun Ray DTU is starting up and is waiting for Ethernet link. |
| 2 | Firmware Download |
Sun Ray DTU is downloading new firmware. |
| 3 | Firmware Download | Sun Ray DTU is storing new firmware in its flash memory. |
| 4 | Firmware Download | Either the download or storage of new firmware has failed. |
| 5 | There is no session to connect with the Sun Ray. | |
| 6 | The server is denying access to the Sun Ray. | |
| 7 | Local PIN entry to the smart card has failed. | |
| 8 | In local smart card PIN entry mode. | |
| 9 | There is an "overcurrent" condition on the USB bus, that is, the total number of devices draws too much current. Consider using a powered hub. | |
| 11 | The server is authenticated and the graphic/keyboard network connections are encrypted. | |
| 12 | The server is not authenticated and the graphic/keyboard network connections are encrypted. | |
| 13 | The server is authenticated and the graphic/keyboard network connections are not encrypted. | |
| 14 | The server is authenticated and the graphic/keyboard network connections are not encrypted. | |
| 15 | Session Connection Failure |
Sun Ray DTU is refusing to talk to the server due to the server's refusal or inability to authenticate or encrypt the network connection. |
| 16 | USB bus is busy servicing a high-speed device, and the keyboard or mouse might not be responsive to user input. | |
| 21 | Startup | Sun Ray DTU is booting up and is waiting for DHCP IP address and parameter assignment. |
| 22 | Startup | Sun Ray DTU is booting up and is waiting for the initial connection to a Sun Ray server. |
| 23 | Network Status |
The connection between the Sun Ray DTU and the network is down. Check the network drop cable. If the network drop cable is okay, check the network switch. |
| 24 | Sun Ray DTU has disconnected from the previous server. | |
| 25 | Startup | Sun Ray DTU is being redirected to a new server. |
| 26 | Startup | Sun Ray DTU has connected to the server and is waiting for graphics traffic. |
| 27 | Session Connection Failure | Sun Ray DTU is broadcasting to locate a Sun Ray server since either it was not provided with Sun Ray specific DHCP parameters or all of the specified servers are not responding. |
| 28 | Session Connection Failure | VPN connection being attempted. |
| 29 | Session Connection Failure | VPN connection established. |
| 30 | VPN connection error. | |
| 31 | Network Status1 | The network link is up, the server is authenticated, and graphics/keyboard network connections are not encrypted. |
| 32 | Network Status1 | The network link is up, the server is not authenticated, and graphics/keyboard network connections are encrypted. |
| 33 | Network Status1 | The network link is up, the server is authenticated, and graphics/keyboard are encrypted. |
| 34 | Network Status1 | The network link is up, the server is not authenticated, and graphics/keyboard are not encrypted. |
| 35 | Sun Ray DTU has been disconnected from its server, either by a STOP-Q session disconnect event or by the VPN session timeout value having been set and exceeded. | |
| 41 | The server is authenticated, the client is authenticated, and the graphic/keyboard network connections are encrypted. | |
| 42 | The server is not authenticated, the client is authenticated, and the graphic/keyboard network connections are encrypted. | |
| 43 | The server is authenticated, the client is authenticated, and the graphic/keyboard network connections are not encrypted. | |
| 44 | The server is authenticated, the client is authenticated, and the graphic/keyboard network connections are not encrypted. | |
| 46 | |
No access to server. |
| 47 | |
No access for Sun Desktop Access Clients. |
| 48 | |
No access: registration required. |
| 49 | |
No access: client key is rejected. |
| 50 | |
No access: security policy violation. |
| 51 | Network Status1 | The network link is up, the server is authenticated, the client is authenticated, and graphics/keyboard network connections are not encrypted. |
| 52 | Network Status1 | |
| 53 | Network Status1 | The network link is up, the server is authenticated, the client is authenticated, and graphics/keyboard are encrypted. |
| 54 | Network Status1 | The network link is up, the server is not authenticated, the client is authenticated, and graphics/keyboard are not encrypted. |
| 60 | |
Insert card. If the site's authentication policy allows access only by card, this icon is displayed to prompt the user to insert a card. Access without a card is disabled. |
| 61 | |
Waiting for primary DTU. The DTU is a secondary DTU in a multihead group, and the primary DTU is not currently connected. |
| 62 | |
Token reader. The DTU is a token reader. When a site policy disallows pseudo-sessions, a DTU configured as a token reader displays the Token Reader icon instead of the Login dialog box. |
| 63 | |
Token reader error. The card is an unknown type or there is a reader error. This error is not restricted to token reader units. |
| 64 | |
Waiting for session access. Access is temporarily denied, but the Sun Ray DTU automatically retries when this condition is resolved. |
1 - Press the Mute+Softer+Louder keys or Ctrl+Pause+N keys simultaneously to display the current network status.
DCHP State Codes
| DCHP State Code | Meaning |
|---|---|
| A | DCHP only provided IP address with no additional parameters. |
| B | DCHP provided IP address, subnet mask, and router, but Sun Ray vendor-specific parameters are missing. |
| C | DHCP provided IP address and Sun Ray vendor-specific parameters, but subnet mask and router are missing. |
| D | DHCP provided all expected parameters. |
| |
Codes E, F, H, and I are valid only with OSD icon 28. |
| E | VPN Phase 1 IKE initiated. |
| F | VPN Phase 1 IKE complete. |
| H | VPN Phase 2 initiated. |
| I | VPN Phase 2 complete. |
Power LED
| DTU Hardware State | Action to Take |
|---|---|
| Off | Check to see whether the DTU is plugged in. Replace the DTU. |
| Green |
Normal operation. |
| Amber | Hardware fault. Replace the DTU. |
| Blinking | PROM is corrupted. Check that firmware downloads are configured and enabled, then power cycle the DTU. |
| Card reader LED remains on even when card is removed | Card reader hardware problem. Replace the DTU. |
(1) DTU Startup Icon
The DTU Startup icon indicates that the DTU has passed the power-on self test but has not yet detected an Ethernet signal. The icon is displayed for a few seconds as part of the normal startup process. When an Ethernet signal is detected, the Network Connection Verified OSD is displayed.
Problem: The DTU Startup OSD is displayed for more than 10 seconds.
- Check that the Ethernet cable is plugged into the DTU correctly and that the other end is plugged in to the correct hub, switch, or network outlet.
- If the DTU is connected through a hub or a switch, verify that the hub or switch is powered on and configured correctly. A link LED on the switch or hub indicates that the connection is alive.
(2) Firmware Download in Progress Icon
The Firmware Download in Progress icon indicates that the DTU is downloading new firmware from a Sun Ray server.
If you see this OSD, wait until the download is complete. Downloading and saving the firmware takes less than a minute. If you interrupt the download, the DTU has to download new firmware the next time it reboots.
Firmware Download Error Codes and Messages
Firmware download error codes are valid only with OSD icon 2.
| Error Code | Error Message |
|---|---|
| E | FW Load: No server |
| F | FW Load: Name too long |
| G | FW Load: Bad read |
| H | FW Load: Bad signature |
| I | FW Load: Failed decompression |
| J | FW Load: Invalid module type |
| K | FW Load: Version mismatch |
| L | FW Load: Not enough memory |
| M | FW Load: Prevented by barrier |
| N | FW Load: Invalid HW version |
| O | FW Load: Flash write error |
(3) Saving PROM Software Icon
The Saving PROM Software icon indicates that the DTU just downloaded new flash PROM software (firmware) from the Sun Ray server and is saving it to the DTU's PROM.
If you see this OSD, wait until the download is complete. Downloading and saving the new firmware takes less than a minute. If you interrupt the download, the DTU has to download new firmware the next time it reboots.
(4) Firmware Download Diagnostics Icon
The Firmware Download icon is displayed with a code or a message when an error occurs during a download of firmware. Table 4 lists the error codes. These error messages appear in English even in localized versions of Sun Ray Server Software.
The Firmware Download with a 4 error code icon is displayed when the DTU fails to download new firmware. The message "FW Load: Prevented by barrier" indicates that the DTU already has a later version of the firmware.
In the syslog, the following message indicates that a barrier level has been set to prevent Sun Ray DTUs from downloading an earlier version of the firmware.
Firmware upgrade/downgrade not allowed! Barrier is 310 Firmware level is 0
- Check /var/opt/SUNWut/log/messages to confirm that your configuration is set up properly.
(15) Session Refused Icon
The Session Refused icons are displayed during a possible security breach because authentication has failed.
Problem: Icon shows the 15D message.
The DTU is refusing to connect to a server because the DTU is unable to verify the validity of the Sun Ray server. This error can occur only if an unknown Sun Ray server tries to emulate a valid Sun Ray server. This situation is a session security breach.
Problem: Icon shows the 50D message.
The Sun Ray server is refusing to grant a session to the DTU because the DTU is unable to fulfill the server's security requirements.
- Upgrade the DTU's firmware version. This error can occur with firmware versions earlier than 2.0 when the server is configured for hard security mode.
- As an alternative, determine whether your site requires hard security mode. If not, the session can be enabled with soft security mode.
(16) Bus Busy Icon
The Bus Busy OSD indicates that the Sun Ray USB bus is servicing a high-speed device and the keyboard or mouse might not be responsive to user input.
This icon is displayed during an unusually long print job and disappears when the job is done. No action is needed unless killing the print job is necessary.
(21) Network Connection Verified Icon
The Network Connection Verified icon indicates that the DTU has detected the Ethernet carrier but has not yet received its initial parameters or IP address from the DHCP server. The icon is displayed for a few seconds as part of the normal startup process.
After the DHCP server has allocated an IP address, the icon is updated with the DTU's assigned IP address. When the network connection is verified, the Sun Ray DTU connects to the Sun Ray server.
Problem: The icon is displayed for more than 10 seconds.
- Verify that the DHCP server is running and has not run out of IP addresses to assign to clients.
- Verify that the DHCP server is configured properly for network parameters.
Problem: The icon displays an IP address and an icon message, either 21A or 21B, depending on whether the Sun Ray server is on a LAN network or a dedicated interconnect.
This condition occurs when the DTU receives an IP address from the DHCP but no other parameters. The Sun Ray DTU issues a DHCP_INFORM request to obtain the Sun Ray-specific parameters.
- Code 21 A indicates that the DTU received an IP address and is waiting for a response to its DHCP inform request.
- Code 21 B indicates that the DTU received an IP address and IP router and is waiting for a response to its DHCP inform request.
If no response is received, the Sun Ray DTU continues the startup process using only the IP address. In a private interconnect or simple LAN configuration, the DTU can function successfully. However, performance of the Sun Ray DTU might be affected. If the Sun Ray DTU is part of a complex LAN configuration, it can fail later in the start up process because it requires the additional parameters and Sun Ray-specific vendor options to handle network operations, such as when a DTU is located several hops away from the Sun Ray server's subnet.
Continue with the startup process, if possible, and at the next opportunity, do the following:
- For LAN configurations with other non-Sun Ray DHCP services but no bootp proxy agent, verify the DHCP server and the Sun Ray vendor tags.
- For routed configurations, verify that the bootp proxy agent is configured correctly in the Sun Ray DTU's subnet and that it points to one of the Sun Ray servers in the failover group.
- For non-routed private interconnect configurations, the Sun Ray server performs the functions of a DHCP server. Verify that it is configured properly for DHCP services.
When the Sun Ray DTU concludes the interaction with the DHCP server, it connects to a Sun Ray server and then interacts with the server's Authentication Manager, indicated by the Waiting to Connect to Authentication Manager OSD. Occasionally, the Sun Ray DTU is first routed to another Sun Ray server. In this case, the Redirection OSD icon is displayed for a few seconds and then, as the Sun Ray DTU interacts with the new server's Authentication Manager, the Waiting to Connect to Authentication Manager OSD is displayed.
(22) Waiting to Connect to Authentication Manager Icon
The Waiting to Connect to Authentication Manager icon indicates that the DTU has received its parameters from the DHCP server and it has connected to the Sun Ray server but has not yet completed it authentication. The icon is displayed for a few seconds as part of the normal startup process.
Problem: The icon displays for more than 10 seconds or the DTU resets after the icon is displayed.
- Verify that Sun Ray services, including the Authentication Manager, are running on the Sun Ray server.
In a LAN configuration or other routed environment:
- Verify that the DTU's IP address can reach the Authentication Manager.
- Verify that the DTU's routing information, received from the Sun Ray server, is correct.
- Verify that the bootp proxy agent is configured correctly in the Sun Ray DTU's subnet and that it points to one of the Sun Ray servers in the failover group.
- Run utquery for the DTU's IP address to see the parameters that the DTU received. If the parameters do not include a AuthSrvr parameter, the DHCP server might not have sent the Sun Ray parameters or the parameters might not be correct.
- To confirm that the DHCP server can be reached, check the value of the DHCPServer parameter.
- To confirm that the DHCP server sends the proper Sun Ray-specific parameter values, check the value of the INFORMServer parameter.
If a value is incorrect, look at your bootp relay configurations and DHCP server configurations for network and Sun Ray parameters. For details of these parameters, see the utquery man page. - To restart DHCP on a Solaris server, type the following as superuser:
# /etc/init.d/dhcp stop # /etc/init.d/dhcp start
(23) No Ethernet Signal Icon
The No Ethernet Signal OSD indicates that the DTU had an Ethernet address and an IP address but later lost the Ethernet signal.
- Check that the Ethernet cable has not become unplugged from the DTU or from the switch or network outlet.
- If the DTU is connected through a hub or switch, make sure that the hub or switch is still powered on.
(25) Redirection Icon
The Redirection OSD indicates that the DTU is being redirected to a new Sun Ray server. This redireation can occur for any of several reasons, including load balancing. The icon is displayed for a few seconds while the DTU connects to the new Sun Ray server and then the Waiting to Connect to Authentication Manager OSD is displayed.
(26) Wait for Session Icon
The Wait for Session OSD indicates that the DTU is waiting for its X Window session. The icon is displayed for a few seconds as part of the normal startup process.
If this icon is displayed for a long time, display traffic from the server is not arriving to the client. Some possible reasons for this problem includes:
- The network (routers, switches, firewalls) is not correctly transmitting UDP traffic from the server to the client.
- The server is attempting to display one of the Server Policy icons, but the client is behind a NAT router or gateway.
- The X server (Xnewt or Xsun) that is the source of the display traffic on the Sun Ray server side is not working properly. It might be crashed or hung.
- The display manager (dtlogin on Solaris 10 or gdm on Linux) has failed to start an X server for the session. It might be crashed, hung, or not configured properly. If you suspect that dtlogin configuration files have been corrupted, see How to Check and Fix Corrupted Configuration Files (Solaris).
(27) DHCP Broadcast Failure Icon
The DHCP Broadcast Failure icon is displayed if the DTU is attempting to locate a Sun Ray server and either no servers respond or the Sun Ray-specific DHCP parameters are not correct.
(28) Establishing VPN Connection Icon
The Establishing VPN Connection icon is displayed while a DTU is trying to connect to the Sun Ray server through a VPN connection.
(29) VPN Connection Established Icon
When the VPN connection is established, the VPN Connection Established icon is displayed.
(31-34) Ethernet Address Icon
The Ethernet Address OSD shows the Ethernet address, the assigned IP address, the connected server, encryption status, DHCP state, link speed and link mode.
To display current information about the Ethernet link, do one of the following at any time.
- On a Sun keyboard, press the three audio volume keys simultaneously. To get the same effect on a non-Sun keyboard, type Crtl-Pause-N.
- Disconnect and reconnect the Ethernet cable.
A value of 10 indicates a link speed of 10 Mbps; 100 indicates 100 Mbps. A value of F indicates that the link mode is full duplex. A value of H indicates half-duplex mode.
(46) No Access to Server Icon
This icon usually displays if the policy disallows card access and a card is inserted.
(47) No Access for Sun Desktop Access Clients Icon
This icon indicates that access for Sun Desktop Access Clients is disabled by default. To enable access for Sun Desktop Access Clients, go to How to Enable Access for Sun Desktop Access Clients.
(48) No Access: Registration Required Icon
The card or DTU is not registered. If ATI is configured for a site, the ATI script is run when this icon is first displayed. If the script registers the card, this state might not last long.
(49) No Access: Key Rejected Icon
This icon is displayed if only confirmed keys are allowed access by policy. It might be displayed if there is a key conflict, but other icons might display instead.
(50) No Access: Security Policy Violation Icon
This icon is displayed if the client is running old firmware that does not support encryption or client authentication and the server has "hard" security mode set. This icon might also display in other security-related cases, such as key conflict or failed key validation, but other icons might display instead.
(60) Insert Card Icon
If the site's authentication policy allows access only by card, this icon is displayed to prompt the user to insert a card. Access without card is disabled.
(61) Waiting for Primary DTU Icon
The DTU is a secondary DTU in a multihead group, and the primary DTU is not currently connected.
(62) Token Reader Icon
The DTU is a token reader. When a site policy disallows pseudo-sessions, a DTU configured as a token reader displays the Token Reader icon instead of the Login dialog box.
(63) Card Error Icon
The Card Error icon indicates that the firmware is unable to read the card's token due to one of the following causes:
- The DTU is running old firmware.
- The token's contacts are dirty, the contacts on the DTU's token reader are dirty, or the card is not properly inserted.
- The token is malfunctioning.
- The token is of a type that the firmware is not configured to read.
- An error exists in the configuration for reading this type of card.
To fix this problem, try one of the following actions:
- Clean the card.
- Upgrade the firmware.
- Replace the card.
(64) Waiting For Access Icon
This icon indicates that the server is not allowing access at the current time. This problem occurs when a Sun Ray DTU loses power or the network connection to the server is interrupted and the smart card from the Sun Ray DTU is inserted into a different Sun Ray DTU before the server has timed out the lost connection. Because the old connection is still active, new connections using the same smart card are unable to gain access.
When this conditions occurs, the server checks the status of the old connection. After the time reserved for this check has elapsed (an initial default of 10 seconds), the Sun Ray DTU connection is restarted and the condition should be automatically resolved. Either the session access is granted or the Sun Ray DTU remains in this Waiting for Access state (64).
If a Sun Ray DTU continues to remain in this state, the same token is being used with another connection. Specifically, two physical tokens (smart card, DTU, Sun Desktop Access Client profile) are trying to connect to the same session.
Possible reasons for this issue include the following:
- A security incident where a copied or fake smart card is used to gain access to the session.
- A security incident where a copy of a Sun Desktop Access Client profile is used to gain access to the session. This situation might also indicate a user error. Sun Desktop Access Client profile files should not be copied to a different computer or user account.
- A registered token policy is in effect, alias tokens have been configured, and an alias token is still connected to the session the user is trying to access. If access is denied because of a currently connected alias token, the connected alias token needs to be disconnected to regain access. For example, the aliased smart card must be removed from its Sun Ray DTU.
Sign up or Log in to add a comment or watch this page.