SA components fail to start with "account is locked" error

  • KM03762410
  • 11-Nov-2020
  • 29-Apr-2021

Summary

When starting Server Automation, one or more components can fail to start. Looking in the component logfile shows the error "ORA-28000: the account is locked" at the time the component tries to start.

Error

When attempting to start/restart Server Automation on a SA core server, one or more SA components will not start up.  Looking in the component log files (found in /var/log/opsware/<component> ) the following error message is seen at the time the component attempts to start.

ORA-28000: the account is locked

Cause

One or more of the database users that SA uses to connect to the Oracle database has become locked. 

Fix

To check the database users to see if any are locked, issue the following commands from the console of the main SA core server (the INFRA)

/opt/opsware/support/bin/sql "select username, expiry_date, account_status from dba_users"

(if the /opt/opsware/support/bin/sql command is not found, ask for and install the latest OPSWtools rpm from MicroFocus Support).

Output like the following will be seen (this example is from a healthy core)

 

Query #1 on Facility_id 1 (SA1070):
USERNAME EXPIRY DATE ACCOUNT_STATUS
AAA_USER None OPEN
AAA None OPEN
OPSWARE_ADMIN None OPEN
SPIN None OPEN
ORACLE_OCM <Date/Time> EXPIRED & LOCKED
GCADMIN None OPEN
OJVMSYS <Date/Time> EXPIRED & LOCKED
SYSKM <Date/Time> EXPIRED & LOCKED
XS$NULL <Date/Time> EXPIRED & LOCKED
TRUTH None OPEN
GSMCATUSER <Date/Time> EXPIRED & LOCKED
SYSBACKUP <Date/Time> EXPIRED & LOCKED
DIP <Date/Time> EXPIRED & LOCKED
SYSDG <Date/Time> EXPIRED & LOCKED
TWIST None OPEN
GSMUSER <Date/Time> EXPIRED & LOCKED
AUDSYS <Date/Time> EXPIRED & LOCKED
OPSWARE_PUBLIC_VIEWS None OPEN
VAULT None OPEN
LCREP None OPEN
DBSNMP <Date/Time> EXPIRED & LOCKED
APPQOSSYS <Date/Time> EXPIRED & LOCKED
GSMADMIN_INTERNAL <Date/Time> EXPIRED & LOCKED
ANONYMOUS <Date/Time> EXPIRED & LOCKED
XDB <Date/Time> EXPIRED & LOCKED
OUTLN <Date/Time> EXPIRED & LOCKED
SYSTEM None OPEN
SYS None OPEN

 

In the example above, all of the entries showing "OPEN" for the ACCOUNT_STATUS need to be in this state for a healthy SA core server (the USERNAMEs showing "EXPIRED & LOCKED" in the example above can be ignored as they are non-SA users present in the Oracle DB).   If any of the USERNAMEs in the list above (that have OPEN for the ACCOUNT_STATUS) instead show a status of "EXPIRED & LOCKED", then the following SQL can be performed by a Oracle DBA to unlock them..

SQL> alter user <LOCKED_USERNAME> account unlock;

for example

SQL> alter user TRUTH account unlock;

After all of the DB users are in the correct state, restart SA using the command "/etc/init.d/opsware-sas restart".  Its not recommended to restart individual SA components as several are reliant on other components and all need to be restarted at the same time to work properly.