Unlocking SAP* User in MAXDB

[Former Member]

Hi,

I am using MaxDB for my solution manager instance. I am not able to log in to the system as we have some license issues. Now I need to reset the password of user SAP* at the database level, how can I do this? I know how to do this is Oracle, but I am really new to MaxDB.

Can some one help me please.

Thanks

Anil

[Former Member]

Hi Markus,

bixidevzone02% more project

system:0::::

user.root:1::::

noproject:2::::

default:3::::

group.staff:10::::

SOD:200:SAP System SOD:sodadm,sqdsod::process.max-sem-nsems=(priv,2048,deny);project.max-sem-ids=(priv,1024,deny);project.max

-shm-ids=(priv,256,deny);project.max-shm-memory=(priv,18446744073709551615,deny)

bixidevzone02% more user_attr

#

1. Copyright 2007 Sun Microsystems, Inc. All rights reserved.

2. Use is subject to license terms.

#

1. /etc/user_attr

#

1. execution attributes for profiles. see user_attr(4)

#

#ident "@(#)user_attr 1.1 07/01/31 SMI"

#

#

adm::::profiles=Log Management

lp::::profiles=Printer Management

postgres::::type=role;profiles=Postgres Administration,All

root::::auths=solaris.*,solaris.grant;profiles=Web Console Management,All;lock_after_retries=no

Thanks

Anil

[markus_doehr2]

...this is your problem.

Since you don´t have the users in /etc/user_attr assigned to the project, the limits are not taken into account.

Please check again the given note and assign the users to the project.

Then stop everything (stopsap, x_server stop), logout and login again and start the system. Then you should be able to execute the sqlcli command to delete SAP*.

Markus

[former_member229109]

Hello Anil,

*****

Did you try the recommended Hint?

It is sufficient to temporarily set the login/no_automatic_user_sapstar

parameter to the value 0 on the application server < SAP note 68048>.

This application server should be restarted after the value of the profile

parameter was changed.

And you try to log on to this application server as user 000/SAP*/PASS.

SAP strongly recommends that you reset the profile parameter login/no_automatic_user_sapstar to value 1 afterwards.

****

-> What version of the database you have?

Please see the SAP notes 68048 and 2383.

In MaxDB Version 7.5 and higher you can use the "SQLStudio" or the command

line tool "sqlcli" to run the SQL statement, if you are logged on to the OS

as <sid>adm or user in the group sdba:

sqlcli -d <Database name> -u sap<sid>,<Password>

<enter>

"delete from usr02 where mandt='<Client>' and bname='SAP*'"

< You could run this SQL statement as schema user - SAP<SID> or SAPR3. >

!! Be careful with execution of this statement !!

=> I recommend to create the OSS message < SAP ticket >, if the recommended Hint didn't help.

After you delete the user in the Database level, please restart the

Application server and you can then logon to the system again with

the SAP* user and the password PASS.

Please see the SAP note 2383 for description of "super user" SAP*!!

Create a super user, allocate it to the SUPER group, and assign it the

SAP_ALL or S_A.SYSTEM authorization profile.

Then maintain the SAP* user and assign it a password.

***

"ERR 11277 IPC create_sem: semget error, No space left on device

-10709: Connection failed (RTE:cannot create communication semaphore) "

It's another issue.

Please see the SAP note if the operating system parameters set as recommended ::

628131 SAP DB / MaxDB operating system parameters under Unix

The following SAP notes are for your reference:

724713 parameter settings for Solaris 10

300464 Shared Memory Parameters in Solaris

As I saw above you posted '/etc/project' & that you didn't include the sdb user

in the project:

...

SOD:200:SAP System SOD:sodadm,sqdsod::process.max-sem-nsems=(priv,2048,deny);project.max-sem-ids=(priv,1024,deny);project.max

-shm-ids=(priv,256,deny);project.max-shm-memory=(priv,18446744073709551615,deny)

…..

-> What version of the database you have?

-> Please post /etc/opt/sdb file, check the owner in knldiag file.

As of MAXDB version 7.5 the default owner is sdb & all database processes started under this user.

==>

Please run::

projadd -p 102 -c "SAP System <SID>" \

-U sdb\

-K "project.max-sem-ids=(priv,5120,deny)" \

-K "process.max-sem-nsems=(priv,2048,deny)" \

-K "project.max-shm-ids=(priv,2048,deny)" \

-K "project.max-shm-memory=(priv, 1099511627775,deny)" \

MAXDB

&& let me know the results after that.

Thank you and best regards, Natalia Khlopina

[Former Member]

Hi Markus,

Thanks for the troubleshooting, it was very helpfull. But since I am very new to MaxDB, can you help me in increasing the database limits ? (With commands will be highly appreciated)

Thanks

Anil

[markus_doehr2]

This is not a MaxDB limit but an operating system (a SunOS) limit.

What´s the output of the following commands:

cat /etc/project
cat /etc/user_attr

Markus

[Former Member]

Hi Markus,

Our system was running for last 2 months, but when I tried to install the permenant licence key, we have a conflict. Error saying that license check failed. So I tried to login to 000 client with user SAP* (which is the only way left now) , but unfortunately SAP* is also locked. I need to unlock it , to login to the server and install the permenant license.

I have already set up projects at the OS level.

Thanks

Anil

[markus_doehr2]

Then your parameters don´t seem to be high enough.

The license check can fail because of that because the system imposed limit of semaphores is reached.

You first need to make sure you can work with the database by increasing the limits, then you can use the given command to delete SAP*.

Markus

[Former Member]

Hi,

We are on Solaris 10.

Thanks

Anil

[markus_doehr2]

Ok.

Did you set up a project file (/etc/project) for that instance? The parameters in /etc/system are no more valid.

check note 724713 - parameter settings for Solaris 10

If you don´t configure that, you system will not run.

Markus

[Former Member]

Hi,

I did the same, but getting the following error

============================================

ERR 11277 IPC create_sem: semget error, No space left on device

• -10709: Connection failed (RTE:cannot create communication semaphore)

=============================================

I have checked the OS level and found that enough space is available in the disks. Is this error about adding data files? If yes, how can I do this.

Please answer this as this is becoming a major escalation now.

Thanks

Anil

[markus_doehr2]

This is an operating system problem, you´re reaching the maximum amount of semaphores.

What OS are you using?

Markus

[markus_doehr2]

You can do something like

Login as <sid>adm

sqlcli -U DEFAULT
delete from usr02 where bname = 'SAP*' and mandt = 100

Markus

[former_member229109]

Hello Anil,

-> Please review the SAP note 862989 & 806819.

-> And SAP Note No. 68048 - eactivating the automatic SAP* user

-> "I am not able to log in to the system as we have some license issues."

What license issues do you have?

-> Please see the answer on your question at

Thank you and best regards, Natalia Khlopina