952 errors
A site on AIX 6 / IDS 11.50.FC6 saw repeated -952 "password is not correct" errors in the online log for one specific user, even though that user could log in and use the database fine. Suggestions included checking the remote host/trusted-host setup for the connecting machine, running onmode -I 952 to dump diagnostic af files, checking that the oninit binary is owned by root (it was), a possible IDS bug triggered by certain AIX security settings (raise a PMR or apply the latest 11.50), and a client/batch job or tool such as OAT passing a stale or wrong password in its connection string. No resolution is recorded in the thread.
Auto-generated by DrWatson from the posts below — may be imperfect; read the full thread.
For some reason we are getting -952 errors for a particular user over and over in the log. I can login as the user just fine, and access the database. We are running AIX 6 and IDS 11.50.FC6. Any ideas on how to stop the messages or figure out why they're coming in? 09:05:48 Password Validation for user [xxxxxxx] failed! 09:05:48 Check for password aging/account lock-out. 09:05:48 listener-thread: err = -952: oserr = 0: errstr = xxxxxxx@somewhere: User (xxxxxxx@somewhere)'s password is not correct for the database server.
Hello.
If you can log into the server using the user and password, you might check
for:
1) remote connection (what´s the output from @somewhere section printed in
online.log file)?
If it´s another machine, check for authentication - eg: host.equiv file - the
source connection machine must not be granted on target machine
2) if it´s an application running, it´s harder to debug, try to active an
onmode -I 952, and try to get more information from a network trace...you could consider upgrading to 11.70, new resources on that version indicate
the name of the external program trying to access your engine ;)
Hope this helps.
Best regards.
Alexandre Marini
IBM Informix Certified Professional v10 / v11.50 / v11.70
IBM Information Management Informix Technical Professional
IBM Infosphere DataStage Technical Professional
Database Administrator
> To: ids@iiug.org
> From: john.callicotte@ottawa.edu
> Subject: 952 errors [26723]
> Date: Tue, 17 Apr 2012 10:07:09 -0400
>
> For some reason we are getting -952 errors for a particular user over and
over
> in the log. I can login as the user just fine, and access the database. We
are
> running AIX 6 and IDS 11.50.FC6. Any ideas on how to stop the messages or
> figure out why they're coming in?
>
> 09:05:48 Password Validation for user [xxxxxxx] failed!
> 09:05:48 Check for password aging/account lock-out.
> 09:05:48 listener-thread: err = -952: oserr = 0: errstr = xxxxxxx@somewhere:
> User (xxxxxxx@somewhere)'s password is not correct for the database server.
>
>
>
*******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
Check the permissions of the oninit binary. If the owner is not root, you
can get the -952 error when the database must do explicit validation of
the password.
Pam Ekstrand
Database Administrator
email: ekstrand@us.ibm.com
Home Office: 727-729-8210
Cell: 727-365-3781
From:
"Alexandre Marini" <alexandre@briug.org>
To:
ids@iiug.org
Date:
04/17/2012 10:40 AM
Subject:
RE: 952 errors [26724]
Sent by:
ids-bounces@iiug.org
Hello.
If you can log into the server using the user and password, you might
check
for:
1) remote connection (what´s the output from @somewhere section printed in
online.log file)?
If it´s another machine, check for authentication - eg: host.equiv file -
the
source connection machine must not be granted on target machine
2) if it´s an application running, it´s harder to debug, try to active an
onmode -I 952, and try to get more information from a network trace...you could consider upgrading to 11.70, new resources on that version
indicate
the name of the external program trying to access your engine ;)
Hope this helps.
Best regards.
Alexandre Marini
IBM Informix Certified Professional v10 / v11.50 / v11.70
IBM Information Management Informix Technical Professional
IBM Infosphere DataStage Technical Professional
Database Administrator
> To: ids@iiug.org
> From: john.callicotte@ottawa.edu
> Subject: 952 errors [26723]
> Date: Tue, 17 Apr 2012 10:07:09 -0400
>
> For some reason we are getting -952 errors for a particular user over
and
over
> in the log. I can login as the user just fine, and access the database.
We
are
> running AIX 6 and IDS 11.50.FC6. Any ideas on how to stop the messages
or
> figure out why they're coming in?
>
> 09:05:48 Password Validation for user [xxxxxxx] failed!
> 09:05:48 Check for password aging/account lock-out.
> 09:05:48 listener-thread: err = -952: oserr = 0: errstr =
xxxxxxx@somewhere:
> User (xxxxxxx@somewhere)'s password is not correct for the database
server.
>
>
>
*******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
*******************************************************************************
Forum Note: Use "Reply" to post a response in the discussion forum.
Pam, the owner is root. The problem is only for one user, and not everyone.
I'm 99% sure I hit a very similar issue last year with AIX 6 and IDS
11.50.FC6. I raised a PMR and it turned out there was a bug in IDS which was
only apparent when certain security configurations were set up on the AIX OS.
I can't remember specifically what and unfortunately I no longer have details
of the PMR and APAR (having changed jobs since) so it might be worth raising a
call with IBM support or taking the latest version of 11.50. Apologies for
being so vague.
Regards
Stuart
---
Ardenta Ltd is a company registered in England and Wales. Registered number:
4181041. Registered office: Saxon House, Downside, Sunbury on Thames,
Middlesex, TW16 6RT.
-----Original Message-----
From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of Pamela
Ekstrand
Sent: 17 April 2012 15:56
To: ids@iiug.org
Subject: RE: 952 errors [26725]
Check the permissions of the oninit binary. If the owner is not root, you
can get the -952 error when the database must do explicit validation of
the password.
Pam Ekstrand
Database Administrator
email: ekstrand@us.ibm.com
Home Office: 727-729-8210
Cell: 727-365-3781
From:
"Alexandre Marini" <alexandre@briug.org>
To:
ids@iiug.org
Date:
04/17/2012 10:40 AM
Subject:
RE: 952 errors [26724]
Sent by:
ids-bounces@iiug.org
Hello.
If you can log into the server using the user and password, you might
check
for:
1) remote connection (what´s the output from @somewhere section printed in
online.log file)?
If it´s another machine, check for authentication - eg: host.equiv file -
the
source connection machine must not be granted on target machine
2) if it´s an application running, it´s harder to debug, try to active an
onmode -I 952, and try to get more information from a network trace...you could consider upgrading to 11.70, new resources on that version
indicate
the name of the external program trying to access your engine ;)
Hope this helps.
Best regards.
Alexandre Marini
IBM Informix Certified Professional v10 / v11.50 / v11.70
IBM Information Management Informix Technical Professional
IBM Infosphere DataStage Technical Professional
Database Administrator
> To: ids@iiug.org
> From: john.callicotte@ottawa.edu
> Subject: 952 errors [26723]
> Date: Tue, 17 Apr 2012 10:07:09 -0400
>
> For some reason we are getting -952 errors for a particular user over
and
over
> in the log. I can login as the user just fine, and access the database.
We
are
> running AIX 6 and IDS 11.50.FC6. Any ideas on how to stop the messages
or
> figure out why they're coming in?
>
> 09:05:48 Password Validation for user [xxxxxxx] failed!
> 09:05:48 Check for password aging/account lock-out.
> 09:05:48 listener-thread: err = -952: oserr = 0: errstr =
xxxxxxx@somewhere:
> User (xxxxxxx@somewhere)'s password is not correct for the database
server.
>
>
>
*******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
*******************************************************************************
Forum Note: Use "Reply" to post a response in the discussion forum.
*******************************************************************************
Forum Note: Use "Reply" to post a response in the discussion forum.
Your online.log file should be on the location of this output:
onstat -c |grep MSGPATH
The onmode -I only starts a trace output for the desired sql / isam code error,
so the next time a 952 sql error is found, the engine will generate an af
file, on the location of the variable DUMPDIR is configured.
Alexandre Marini
IBM Informix Certified Professional v10 / v11.50 / v11.70
IBM Information Management Informix Technical Professional
IBM Infosphere DataStage Technical Professional
Database Administrator
> To: ids@iiug.org
> From: john.callicotte@ottawa.edu
> Subject: Re: RE: 952 errors [26726]
> Date: Tue, 17 Apr 2012 11:07:44 -0400
>
> Pam, the owner is root. The problem is only for one user, and not everyone.
>
>
>
*******************************************************************************
> Forum Note: Use "Reply" to post a response in the discussion forum.
>
I have had this error heaps. Often happens when client pases incorrect connection string to the server which contains login/passwd. Could it also be batch running regularly with wrong connection string ? Have experinced it a lot with OAT related connections