Oracle ZFS Storage Appliance: Audit log has many "logged in/logged out" messages for the 'oracle

Asset ID:	1-72-1913159.1
Update Date:	2016-08-19
Keywords:

Solution Type Problem Resolution Sure

Solution 1913159.1 : Oracle ZFS Storage Appliance: Audit log has many "logged in/logged out" messages for the 'oracle_agent' user

Applies to:

Sun ZFS Storage 7320 - Version All Versions to All Versions [Release All Releases]
Sun Storage 7110 Unified Storage System - Version All Versions to All Versions [Release All Releases]
Sun Storage 7410 Unified Storage System - Version All Versions to All Versions [Release All Releases]
Sun Storage 7310 Unified Storage System - Version All Versions to All Versions [Release All Releases]
Sun Storage 7210 Unified Storage System - Version All Versions to All Versions [Release All Releases]
7000 Appliance OS (Fishworks)

Symptoms

The ZFS Storage Appliance audit log is observed to be populated with many login and logout messages for the oracle_agent user:

Tue Jul 4 00:00:01 2014
nvlist version: 0
        address = 10.10.10.10
        host = 10.10.10.10
        annotation =
        user = oracle_agent
        class = audit.ak.xmlrpc.system.login_success
        payload = (embedded nvlist)
        nvlist version: 0
                iscli = 0
        (end payload)

Tue Jul 4 00:01:08 2014
nvlist version: 0
        address = 10.10.10.10
        host = 10.10.10.10
        annotation =
        user = oracle_agent
        class = audit.ak.xmlrpc.system.logout
        payload = (embedded nvlist)
        nvlist version: 0
                iscli = 0
        (end payload)

Cause

The Oracle Enterprise Manager plugin for the ZFS Storage Appliance needs to collect performance statistics from the ZFS Storage Appliance and hence it logs into it frequently.

Some customers have configured multiple agents monitoring the ZFS Storage Appliance.

Solution

The Enterprise Manager ZFS plugin versions 12.1.0.4.0 and newer reduces the login frequency by re-using the existing session. Please download it from the Self-Update page and apply it.

It is not recommended to have multiple agents monitoring a ZFS Storage Appliance as this can result in Time Out errors on the Enterprise Manager.

While one agent is collecting the data from the ZFS, the other agent would wait for its turn - which can cause the session cookies to expire.

When the session cookies expire, Enterprise Manager establishes a new session and show up as a new login event in the ZFS Storage Appliance audit log.

References

<BUG:18800892> - ORAGLE_AGENT LOGINS FLOODING THE ZFS SA APPLIANCE LOG
<BUG:18498789> - REQUEST FOR ABILITY TO FILTER ORACLE_AGENT LOGIN/LOGOUT FROM AUDIT.AK
<BUG:15472148> - SUNBT6687352 LOG VIEWERS SHOULD PROVIDE TIME, DATE, AND TEXT-BASED SEARCH AND FI

Attachments

This solution has no attachment