Skip to Main Content
  • Questions
  • Warning Event: <hostname.domain name>: <db name> DB - Failed logon attempts

Breadcrumb

Question and Answer

Connor McDonald

Thanks for the question, Shravan.

Asked: November 04, 2017 - 2:25 pm UTC

Last updated: November 06, 2017 - 1:53 am UTC

Version: 12.1.0.2

Viewed 1000+ times

You Asked

OS_USER HOST_NAME TERMINAL USERID Login Date CLIENT_PROGRAM_NAME Error massage
oracle hostname.domain name SYSTEM 11-02-2017 14:54:05 sqlplus@hostname.domain name (TNS V1-V3) ORA-1017:invalid username/password; logon denied

[oracle@<hostname> ~]$ crontab -l
#Incremental backup TRITONS database
#0 4 * * * /home/oracle/cronjobs/rman_incr_backup.sh
#Backup archieve logs TRITONS database by every six hours
#0 */6 * * * /home/oracle/cronjobs/archivelog_backup.sh
#Clear all archive logs of TritonS DB by every four hours
#0 */4 * * * /home/oracle/cronjobs/archivelog_clear.sh
#BackUp Usage Statistic
#0 8 * * * /home/oracle/scripts/mgt_dump/stat_usage_dump.sh
[oracle@<hostname> ~]$

As you can see..all my cron jobs are commented out

Any ideas? This error occurs every day at the same time

and Connor said...

Well...*something* is trying to logon :-)

Since it happens at the same time every day, I'd be looking at the scheduler. Remember that scheduler jobs can be *external* programs (such as SQL Plus).

Even dbms_job could be used to fire off a Java proc when then calls out to SQL Plus.

And if you have any trusted authentication, then that request could be coming from *anywhere* in your network, eg "host1" does:

ssh oracle@hostname "sqlplus system...."

Hope this helps.

Is this answer out of date? If it is, please let us know via a Comment

More to Explore

Security

All of the vital components for a secure database are covered in the Security guide.