--- title: Manage liveSync description: Manage PingIDM liveSync operations over REST using the liveSync action directly on a resource or through the sync endpoint component: pingidm version: 8.1 page_id: pingidm:synchronization-guide:manage-livesync canonical_url: https://docs.pingidentity.com/pingidm/8.1/synchronization-guide/manage-livesync.html llms_txt: https://docs.pingidentity.com/pingidm/llms.txt docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md keywords: ["Synchronization"] section_ids: trigger-livesync-ui: Trigger liveSync using the admin UI using_the_platform_admin_ui: Using the Platform admin UI using_the_legacy_admin_ui: Using the legacy admin UI troubleshooting-livesync: Troubleshoot liveSync failures --- # Manage liveSync Because you can trigger liveSync operations using REST (or the resource API) you can use an external scheduler to trigger liveSync operations, rather than using the IDM scheduling mechanism. There are two ways to trigger liveSync over REST: * Use the `_action=liveSync` parameter directly on the resource. This is the recommended method. The following example calls liveSync on the user accounts in an external LDAP system: ``` curl \ --header "X-OpenIDM-Username: openidm-admin" \ --header "X-OpenIDM-Password: openidm-admin" \ --header "Accept-API-Version: resource=1.0" \ --request POST \ "http://localhost:8080/openidm/system/ldap/account?_action=liveSync" ``` * Target the `system` endpoint and supply a `source` parameter to identify the object that should be synchronized. This method matches the scheduler configuration and can therefore be used to test schedules before they are implemented. The following example calls the same liveSync operation as the previous example: ``` curl \ --header "X-OpenIDM-Username: openidm-admin" \ --header "X-OpenIDM-Password: openidm-admin" \ --header "Accept-API-Version: resource=1.0" \ --request POST \ "http://localhost:8080/openidm/system?_action=liveSync&source=system/ldap/account" ``` A successful liveSync operation returns the following response: ```json { "_rev": "000000001ade755f", "_id": "SYSTEMLDAPACCOUNT", "connectorData": { "nativeType": "JAVA_TYPE_LONG", "syncToken": 1 } } ``` Do not run two identical liveSync operations simultaneously. Rather, ensure that the first operation has completed before launching a second, similar operation. ## Trigger liveSync using the admin UI | | | | - | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | | Starting with IDM 8.1, the [legacy admin UI is deprecated](../release-notes/deprecated-functionality.html#legacy-admin-ui-deprecated) and is no longer bundled with IDM. New deployments should use the [Platform admin UI](../setup-guide/platform-admin-ui.html), which is the replacement for the legacy admin UI.Both UIs are available as separate downloads from the [Backstage download site](https://backstage.pingidentity.com/downloads):- To install the Platform admin UI, follow the steps in [Install the Platform admin UI for standalone IDM](../setup-guide/platform-admin-ui.html). - To continue using the legacy admin UI, follow the steps in [Install the legacy admin UI](../setup-guide/legacy-admin-ui.html). | LiveSync operations are specific to a system object type (such as `system/ldap/account`). ### Using the Platform admin UI Apart from scheduling incremental reconciliation, as described in [Schedule liveSync using the admin UI](chap-schedules.html#livesync-ui), you can launch it on demand for a particular object type using the Platform admin UI: 1. From the sidebar, click Provisioners, select the connector, select the object type, then click the Schedules tab. 2. Click Sync Now. The Sync Token field displays the current synchronization token used for incremental inbound reconciliation. ### Using the legacy admin UI Apart from scheduling liveSync, as described in [Scheduling LiveSync using the admin UI](chap-schedules.html#livesync-ui), you can launch a liveSync operation on demand for a particular system object type using the legacy admin UI as follows: 1. From the navigation bar, click Configure > Connectors. 2. On the Connectors page, select a connector. 3. On the connector-name page, click the Object Types tab. 4. Click the edit button [icon: pencil-alt, set=fas]adjacent to the object type to synchronize. 5. Click the Sync tab, and then click Sync Now. The Sync Token field displays the current synchronization token for the object type. ## Troubleshoot liveSync failures To troubleshoot a liveSync operation that has not succeeded, include the `detailedFailure` parameter to return additional information. For example: ``` curl \ --header "X-OpenIDM-Username: openidm-admin" \ --header "X-OpenIDM-Password: openidm-admin" \ --header "Accept-API-Version: resource=1.0" \ --request POST \ "http://localhost:8080/openidm/system/ldap/account?_action=liveSync&detailedFailure=true" ``` The first time liveSync is called, it does not have a synchronization token in the database to establish which changes have already been processed. The default liveSync behavior is to locate the last existing entry in the change log, and to store that entry in the database as the current starting position from which changes should be applied. This behavior prevents liveSync from processing changes that might already have been processed during an initial data load. Subsequent liveSync operations will pick up and process any new changes. Typically, in setting up liveSync on a new system, you would load the data initially (by using reconciliation, for example) and then enable liveSync, starting from that base point. In the case of DS, the change log (`cn=changelog`) can be read only by `uid=admin` by default. If you are configuring liveSync with DS, the `principal` that is defined in the LDAP connector configuration must have access to the change log. For information about allowing a regular user to read the change log, refer to [Allow a User or Application to Read the Change Log](https://docs.pingidentity.com/pingds/8.1/config-guide/replication.html#read-ecl-as-regular-user). If you refer to the following error message, you might have forgotten to set `changelog-read` access for a regular user: ``` Unable to locate the DS replication change log suffix. Please make sure it's enabled, and changelog-read access is granted. ```