-951 trap

Folks, IDS 11.70 AIX 7.4 Is there any way/method etc. to trap for the following authentication error and send out an alert to security admins ? (other than greping the msg log ) 951: Incorrect password or user is not known on the database server. Preferably would like to have the alarmprogram fire when this occurs but have not found an alarm event id associated with the -951. Thanks in advance, Mark

Hi Mark, I think you can do it with onmode -I 951. https://www-01.ibm.com/support/docview.wss?uid=swg21155532 Regards, SP

You can try setting ALRM_ALL_EVENTS to 1 in ONCONFIG (requires a restart of the Informix instance). Then there will be an event triggered for a failure to authenticate: CLASS_ID=42 EVENT_ID=42001 CLASS_MSG=Event occured SPECIFIC_MSG=listener-thread: err = -951: oserr = 0: errstr = XXXX@YYYY: Incorrect password or user XXXX@YYYY is not known on the database server. Unfortunately, CLASS_ID 42 seems to be a catch all for a lot of events. You will need to edit the alarmprogram script to parse the SPECIFIC_MSG for the -951 error. And with ALRM_ALL_EVENTS=1 the Informix server will be calling the alarprogram.sh much more times, so performance may suffer. Best regards, Luis Marques

Hi, One option is to use a product which can ingest and parse logs, and generate reports based on that. Elasticstack is an open-source example of this with a commercially supported version available. Other similar tools exist. Alternatively and more straightforwardly you could use the imfile module of rsyslog to write the Informix log entries to a file in /var/log, assuming you're using Linux. This may fit with an existing solution where all [r]syslog files in /var/log are monitored by security, especially /var/log/secure, which I'd imagine they are interested in. I wouldn't recommend using "onmode -I" as someone else has suggested which can be a nightmare in general with which to capture frequently occurring events. It will generate a stack track each time and potentially a shared memory dump which will block the server while it takes place as well as consume a lot of disk space. Ben.

Sergio, Luis and Benjamin, Thanks for all of your responses. Regards, Mark