6

We changed a password on an Oracle schema, but apparently we have some rogue SDE clients - probably old ArcGIS map services on a dev machine somewhere - attempting to connect with the old password. SDE is causing Oracle to lock out the schema because of the rapidfire attempts to connect with the bad password.

Is there any way to detect where the bad login attempts are coming from? I have turned on the ArcSDE intercept log, but I don't see anything related to connect attempts there.

We're using SDE 9.3.1.

Improve this question
5
  • If you want to approach it from the Oracle side, you may want to on stackoverflow as they have lots of Oracle gurus who'll be able to tell you how to find it in the Oracle logs.
    – GIS-Jonathan
    Oct 22, 2012 at 14:27
  • @GIS-Jonathan: Oracle tells us everything it knows: that the local SDE user is the culprit. That doesn't tell us who is making requests to SDE. I have looked in every SDE log file available, and there is no reference to client IP addresses or hostnames. I actually ran across this very old forum post (forums.esri.com/Thread.asp?c=2&f=59&t=229449) indicating that you need to use netstat to get the info, but that didn't help me much.
    – nw1
    Oct 22, 2012 at 14:32
  • Good point. I figured maybe that was specific to our Oracle/SDE setup but I guess its generic.
    – GIS-Jonathan
    Oct 22, 2012 at 14:51
  • The closest I can find is - help.arcgis.com/en/arcgisdesktop/10.0/help/index.html#//… - but reading the other related entries, it seems that ArcSDE logging is for other stuff rather than login attempts. The closest I can find is client-side: solutions.hans-eric.com/turn-on-arcsde-logging
    – GIS-Jonathan
    Oct 22, 2012 at 15:11
  • Create a new user and lock the old user in Oracle
    – user3120
    Nov 7, 2012 at 16:58

2 Answers 2

Reset to default
1

ArcSDE writes to two log files: giomgr_.log and sde_.log.

"The giomgr_.log file is an ASCII file that contains an entry for all giomgr process activities ( is the name of the ArcSDE service). Each time a user connects or attempts to connect to the ArcSDE service, a message is logged. When the user disconnects, another message is logged. The giomgr_.log file also captures the startup and shutdown procedures of the ArcSDE service. However, this file does not contain specific error messages; it just shows you the activity of the giomgr process."

http://webhelp.esri.com/arcgisserver/9.3/java/index.htm#geodatabases/troubl-1518919419.htm

Show all instances - 

sdeservice -o list

show locks

sdemon -o info -I locks -i <servicename>

kill the service name

sdemon -o kill -t all -i <servicename>

http://gisprog.wordpress.com/2010/08/16/basicarcsd/

Improve this answer
0

Normally you don't see any details of failed login attempts as a user normally has to be successfully logged in before they start populating the log files. Here's a way of logging all failed login attempts - be careful to tidy up afterwards though.

http://cglendenningoracle.blogspot.co.uk/2009/08/audit-logons-in-oracle.html

Improve this answer
1
  • As I commented above, all Oracle is telling us is that the local SDE user is providing the bad credentials. This doesn't seem to tell us anything about who's connecting to SDE.
    – nw1
    Oct 22, 2012 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.