Forum Discussion

Inabus's avatar
Inabus
Level 2
13 years ago

Problem with the Oracle VCS 5.1 resource and DetailMonitor = 1

Hi, I am attempting to configure the DetailMonitor = 1 option of the Oracle resource in a service group but am running into LogonUser failed error messages in the Oracle_A.txt file. The issue is wi...
Agents
Application monitoring
ApplicationHA
business continuity
Clustering
High availability
Installing
Service group
Troubleshooting
  • Satish_K__Pagar's avatar
    Satish_K__Pagar
    13 years ago

    1. Does anyone know what command is being run by VCS to connect to the database as its not shown in the log files?

    A. To see the output in the log files you can set the LogDbg for type Oracle value to DBG_1, this will start putting the more verbose debug logs in the log file. The agent uses a SQL script file (mentioned in attribute SQLFile ), which is executed during detail monitor. The agent creates a temporary script file using the script file mentioned in SQLFile  attribute. It will connect using sqlplus as sysdba before executing the temporary script file.

     

    2. My second question is does anyone know what I am doing wrong and what permissions will be required by the account VCS uses as I am in a highly locked down environment so have to work within the security framework.

    A. Can you provide the Windows error code mentioned in the log file with LogonUser failure? The agent uses the LogonUser API before executing the SQL script in that user’s context and the user must have the SE_INTERACTIVE_LOGON_NAME account right. Can you check again after changing the rights for the user?.

Satish_K__Pagar's avatar
Satish_K__Pagar
Level 5
13 years ago

Error 1326 indicates – Logon failure: unknown user name or bad password.

Description for same is –

ERROR_LOGON_FAILURE                Incorrect user name or password.

1326 (0x52E)                                    

It would help to know how was the service group created, was it through the wizard or was it done manually? If the wizard was used then it usually verifies credentials so that error can be ruled out. But if it was done manually then it would help to check all the following attributes –

Domain = "xxx.xxx.xxx.xxx"

UserName = xxxxxxxxxx

EncryptedPasswd = xxxxxxxxxxx

For the password encryption if the value is set using JAVA GUI then it will encrypt and set the password else you can execute following command to get the encrypted password –

vcsencrypt –agent

and then set the attribute using following commands sequence –

  1. haconf –makerw
  2. hares -modify <resourcename> EncryptedPasswd <output of vcsenrypt command>
  3. haconf –dump -makero

Although the error code here does not indicate this but sometimes if the machine time is not in sync with the domain controller, then it affectsthe LogonUser API. Can you also ensure that the machine time is in sync with that of the DC? Youcan execute the following command for same –

NET TIME /domain:<your_domain_name> /SET /Y