Take the 2-minute tour ×
Geographic Information Systems Stack Exchange is a question and answer site for cartographers, geographers and GIS professionals. It's 100% free, no registration required.

We changed a password on an Oracle schema, but apparently we have some rogue SDE clients - probably old ArcGIS map services on a dev machine somewhere - attempting to connect with the old password. SDE is causing Oracle to lock out the schema because of the rapidfire attempts to connect with the bad password.

Is there any way to detect where the bad login attempts are coming from? I have turned on the ArcSDE intercept log, but I don't see anything related to connect attempts there.

We're using SDE 9.3.1.

share|improve this question
    
If you want to approach it from the Oracle side, you may want to on stackoverflow as they have lots of Oracle gurus who'll be able to tell you how to find it in the Oracle logs. –  GIS-Jonathan Oct 22 '12 at 14:27
    
@GIS-Jonathan: Oracle tells us everything it knows: that the local SDE user is the culprit. That doesn't tell us who is making requests to SDE. I have looked in every SDE log file available, and there is no reference to client IP addresses or hostnames. I actually ran across this very old forum post (forums.esri.com/Thread.asp?c=2&f=59&t=229449) indicating that you need to use netstat to get the info, but that didn't help me much. –  nw1 Oct 22 '12 at 14:32
    
Good point. I figured maybe that was specific to our Oracle/SDE setup but I guess its generic. –  GIS-Jonathan Oct 22 '12 at 14:51
    
The closest I can find is - help.arcgis.com/en/arcgisdesktop/10.0/help/index.html#//… - but reading the other related entries, it seems that ArcSDE logging is for other stuff rather than login attempts. The closest I can find is client-side: solutions.hans-eric.com/turn-on-arcsde-logging –  GIS-Jonathan Oct 22 '12 at 15:11
    
Create a new user and lock the old user in Oracle –  twisig Nov 7 '12 at 16:58
add comment

3 Answers 3

ArcSDE writes to two log files: giomgr_.log and sde_.log.

"The giomgr_.log file is an ASCII file that contains an entry for all giomgr process activities ( is the name of the ArcSDE service). Each time a user connects or attempts to connect to the ArcSDE service, a message is logged. When the user disconnects, another message is logged. The giomgr_.log file also captures the startup and shutdown procedures of the ArcSDE service. However, this file does not contain specific error messages; it just shows you the activity of the giomgr process."

http://webhelp.esri.com/arcgisserver/9.3/java/index.htm#geodatabases/troubl-1518919419.htm

Show all instances -

sdeservice -o list

show locks

sdemon -o info -I locks -i <servicename>

kill the service name

sdemon -o kill -t all -i <servicename>

http://gisprog.wordpress.com/2010/08/16/basicarcsd/

share|improve this answer
add comment

Normally you don't see any details of failed login attempts as a user normally has to be successfully logged in before they start populating the log files. Here's a way of logging all failed login attempts - be careful to tidy up afterwards though.

http://cglendenningoracle.blogspot.co.uk/2009/08/audit-logons-in-oracle.html

share|improve this answer
    
As I commented above, all Oracle is telling us is that the local SDE user is providing the bad credentials. This doesn't seem to tell us anything about who's connecting to SDE. –  nw1 Oct 22 '12 at 14:49
add comment
up vote 0 down vote accepted

So the best answer I could get from ESRI was:

Enable a firewall on the SDE host, set to permit all traffic, and log connection requests. Once you've determined who's trying to connect, go look at each host to determine where the problem lies.

Some solution, right?

share|improve this answer
    
So this worked? –  Chad Cooper Nov 7 '12 at 15:05
    
I didn't try it... I already knew which hosts were likely to be generating the traffic, so there was nothing to be gained by doing this. I was hoping there would be an SDE log to tell me exactly which host was providing bad credentials, but such info is apparently not logged anywhere. So I just looked over each host with a fine-tooth comb until I found all the map services with bad credentials. I also disabled Oracle's auto-lock behavior. –  nw1 Nov 7 '12 at 18:32
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.