Shulou(Shulou.com)06/01 Report--

A user of DB2 failed because he was frequently retried with an incorrect password, but the db2diag.log does not show the IP address and other details of the failed connection to the client database, so it is impossible to locate the connection attempt from which IP address.

2020-04-01-07.20.14.418243-300 I659550E481 LEVEL: Error

PID: 31215 TID: 139835100620544 PROC: db2ckpwd 0

INSTANCE: db2inst1 NODE: 000

HOSTNAME: xxx.xxx.xxx.xxx

EDUID: 2 EDUNAME: db2wdog 0 [db2inst1]

FUNCTION: DB2 UDB, oper system services, sqlo_validate_pwd, probe:99

MESSAGE: crypt () returned NULL

DATA # 1: Hexdump, 4 bytes

0x00007F2DE57D1D30: 1600 0000....

2020-04-01-07.20.14.419077-300 I660032E498 LEVEL: Warning

PID: 31207 TID: 139642481403648 PROC: db2sysc 0

INSTANCE: db2inst1 NODE: 000 DB: BIDB

APPHDL: 0-12187

HOSTNAME: xxx.xxx.xxx.xxx

EDUID: 325 EDUNAME: db2agent (BIDB) 0

FUNCTION: DB2 UDB, bsu security, sqlexLogPluginMessage, probe:20

DATA # 1: String with size, 65 bytes

Password validation for user biuser failed with rc =-2029059891

Solution.

Db2 connect to BIDB

Db2 "create audit policy fl categories validate status both error type normal"

Db2 "audit database using policy fl"

Db2audit start

Wait. A new Password validation error message was found in db2diag.log

Db2audit flush

Db2audit archive database BIDB to / tmp/audit

Db2audit extract delasc to / tmp/audit from files / tmp/audit/db2audit.db.BIDB.log.0.xxxxxx

A validate.del file is generated, which shows the client's IP address and the client's user

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.