Oracle查看被锁定用户登录端信息以及获取登录端IP地址

 

测试库用户总被锁定，下面内容是查看登录失败客户端信息，以及获取登录失败的客户端IP

--使用sys身份登录
--1.查看用户状态，到期时间，锁定时间等
 select username,lock_date,profile,EXPIRY_DATE from dba_users order by EXPIRY_DATE desc;
--2.查看默认策略配置
select * from dba_profiles where profile='DEFAULT';
--3.查看登录失败数
select lcount from user$ where name='HSP';
--4.查看审计信息（包含登录用户，客户端等）
select sessionid,userid,userhost,comment$text,spare1,to_char(ntimestamp#+1/3,'yyyy-mm-dd hh24:mi:ss') from aud$
where returncode=1017 order by ntimestamp# desc;

---------------------创建触发器捕获登录用ip等信息-------------
--1. 设置会话客户的id号；
BEGIN
    DBMS_SESSION.set_identifier(SYS_CONTEXT('USERENV', 'IP_ADDRESS'));
END;

--2.创建触发器
CREATE OR REPLACE TRIGGER  logon_trigger
after logon on database
begin
      dbms_application_info.set_client_info(sys_context( 'userenv', 'ip_address' ) );
end;
--3.查看连接Oracle的IP信息
SELECT USERNAME,
       PROGRAM,
       MACHINE,
       CLIENT_INFO,
       SYS_CONTEXT('userenv', 'ip_address') AS IPADD
  FROM V$SESSION S
 WHERE USERNAME IS NOT NULL ORDER BY USERNAME, PROGRAM, MACHINE;
--4.创建触发器，记录连接失败信息
 
CREATE OR REPLACE TRIGGER logon_to_alert
AFTER servererror ON DATABASE
DECLARE
message VARCHAR2(168);
ip VARCHAR2(15);
v_os_user VARCHAR2(80);
v_module VARCHAR2(50);
v_action VARCHAR2(50);
v_pid VARCHAR2(10);
v_sid NUMBER;
v_program VARCHAR2(48);
BEGIN
IF(ora_is_servererror(1017)) THEN
IF upper(sys_context('userenv', 'network_protocol')) = 'TCP' THEN
ip := sys_context('userenv', 'ip_address');
END IF;
SELECT sid INTO v_sid FROM sys.v_$mystat WHERE rownum < 2;
SELECT p.spid, v.program
INTO v_pid, v_program
FROM v$process p, v$session v
WHERE p.addr = v.paddr
AND v.sid = v_sid;
v_os_user := sys_context('userenv', 'os_user');
dbms_application_info.read_module(v_module, v_action);
message := to_char(SYSDATE, 'YYYYMMDD HH24MISS') ||
' logon denied from ' || nvl(ip,'localhost') || ' ' ||
v_pid || ' ' || v_os_user || 'with ' || v_program || ' – ' ||
v_module || ' ' || v_action;
sys.dbms_system.ksdwrt(2, message);
END IF;
END;

--5.查看文件位置（参考）
select tracefile from v$process;

/data/oracle/diag/rdbms/orcl/orcl/trace/alert_orcl.log --(参考位置)
--失败内容（参考）

Fatal NI connect error 12170.

  VERSION INFORMATION:
 TNS for Linux: Version 11.2.0.1.0 - Production
 Oracle Bequeath NT Protocol Adapter for Linux: Version 11.2.0.1.0 - Production
 TCP/IP NT Protocol Adapter for Linux: Version 11.2.0.1.0 - Production
  Time: 13-DEC-2020 17:46:45
  Tracing not turned on.
  Tns error struct:
    ns main err code: 12535
   
TNS-12535: TNS:operation timed out
    ns secondary err code: 12606
    nt main err code: 0
    nt secondary err code: 0
    nt OS err code: 0
  Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=192.168.72.1)(PORT=52256))
WARNING: inbound connection timed out (ORA-3136)

 

参考链接1：http://blog.itpub.net/31519308/viewspace-2717885/

参考链接2：http://blog.itpub.net/29487349/viewspace-1102744/