Login information

[Former Member]

Hi Experts,

In one of our production system, a weekly restart happens every weekend through crontab scripts.Last weekend system didn't came up and try to restart.Wecame to know that someone has tried to login as pbpadm ..wich inturn caused systemstartup problems.DBA team has unlocked the user and we manually started the system with startsap .(please find the log and return codes below)

prosap14:orapbp 110> pg ora_11735.aud.222008

Audit file /audit/PBP/ora_11735.aud

Oracle Database 10g Enterprise Edition Release 10.2.0.2.0 - 64bit Production

With the Partitioning and Data Mining options

ORACLE_HOME = /oracle/PBP/102_64

System name: HP-UX

Node name: prosap14

Release: B.11.11

Version: U

Machine: 9000/800

Instance name: PBP

Redo thread mounted by this instance: 1

Oracle process number: 68

Unix process pid: 11735, image: oracle@prosap14

Sat Mar 21 22:18:46 2009

SESSIONID: "2043388" ENTRYID: "1" STATEMENT: "1" USERID: "SAPPBP" USERHOST: "prosap32" ACTION: "100" RETURNCODE: "1017" COMMENT$TEXT: "Authenticated by: OS; Cli

ent address: (ADDRESS=(PROTOCOL=tcp)(HOST=10.1.16.134)(PORT=51349))" OS$USERID: "pbpadm"

Note:

Returncode= 1017 (means invlalid user/ password)

Returncode= 28000( Account locked

Thanks,

Ramprasad

[markus_doehr2]

Check

Note 951167 ORA-28000: the account is locked

Markus

[Former Member]

Hi Experts,

Can i have some information on how to find out from whcih terminal a logon was happend.

DBA team was saying its from SAP or OS level nned to be traced out, to fing the from whcich terminal(person)was an attempt was made

Thans in Advance

Tahnsk,Ramprasad