aud$定位错误用户密码登陆数据库的具体信息

最新推荐文章于 2023-10-31 10:59:54 发布

weixin_34087301

最新推荐文章于 2023-10-31 10:59:54 发布

阅读量632

点赞数

文章标签：数据库网络

本文详细解析了使用错误密码登录Oracle数据库的问题，包括审计日志中记录的失败登录信息，以及不同错误代码对应的含义和解决建议。通过查询特定时间段内的审计记录，定位到尝试使用错误密码的客户端及其机器，帮助管理员快速识别和解决问题。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

环境：Oracle 11.2.0.3

客户端使用错误的用户密码登陆数据库
查询最近1天由于密码错误登陆失败的信息
查询当前审计中有哪些returncode值

1. 客户端使用错误的用户密码登陆数据库

PS C:\Users\Administrator> sqlplus jingyu/ludan@jingyu

SQL*Plus: Release 11.2.0.1.0 Production on 星期一 9月 7 11:28:08 2015

Copyright (c) 1982, 2010, Oracle.  All rights reserved.

ERROR:
ORA-01017: invalid username/password; logon denied

2. 查询最近1天由于密码错误登陆失败的信息

select sessionid, userid, userhost, comment$text, spare1, ntimestamp#
  from aud$
 where returncode = 1017
   and ntimestamp# > sysdate - 1;

查询结果如下：

     22479 JINGYU                         WORKGROUP\WIN-3KBILBGK27B
Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=192.168.99.12)(PORT=49843))
Administrator                                                                                                                                              07-SEP-15 03.28.05.293986 AM

可以根据查询结果定位到是哪台机器使用错误的用户密码尝试登陆数据库。

3. 查询当前审计中有哪些returncode值

SQL> select distinct returncode from aud$;
 
RETURNCODE
----------
      2002
      1017
      1920
      1005
         0
     28009
     28000
 
7 rows selected

查询这些值对应的相关错误信息：

[oracle@JY-DB01 u01]$ oerr ora 28009
28009, 00000, "connection as SYS should be as SYSDBA or SYSOPER"
// *Cause:    connect SYS/<password> is no longer a valid syntax
// *Action:   Try connect SYS/<password> as SYSDBA or
//            connect SYS/<password> as SYSOPER
//
[oracle@JY-DB01 u01]$ oerr ora 28000
28000, 00000, "the account is locked"
// *Cause:   The user has entered wrong password consequently for maximum
//           number of times specified by the user's profile parameter
//           FAILED_LOGIN_ATTEMPTS, or the DBA has locked the account
// *Action:  Wait for PASSWORD_LOCK_TIME or contact DBA
[oracle@JY-DB01 u01]$ oerr ora 1017
01017, 00000, "invalid username/password; logon denied"
// *Cause:
// *Action:
[oracle@JY-DB01 u01]$ oerr ora 1920
01920, 00000, "user name '%s' conflicts with another user or role name"
// *Cause:  There is already a user or role with that name.
// *Action: Specify a different user name.
[oracle@JY-DB01 u01]$ oerr ora 1005
01005, 00000, "null password given; logon denied"
// *Cause:
// *Action:
[oracle@JY-DB01 u01]$ oerr ora 2002
02002, 00000, "error while writing to audit trail"
// *Cause:
// *Action: