WARNING: inbound connection timed out (ORA-3136)

yuansy

*
*時(shí)間：2009-09-29
*環(huán)境：Redflag linux Server 5  Oracle10.2.0.1g
*WARNING: inbound connection timed out (ORA-3136)連接超時(shí)問題
*/
1、alter_postdb1.log日志:
Tue Sep 29 04:15:12 2009
WARNING: inbound connection timed out (ORA-3136)
Tue Sep 29 04:30:12 2009
WARNING: inbound connection timed out (ORA-3136)
Tue Sep 29 04:45:12 2009
WARNING: inbound connection timed out (ORA-3136)
Tue Sep 29 05:00:12 2009
WARNING: inbound connection timed out (ORA-3136)
Tue Sep 29 05:15:12 2009
WARNING: inbound connection timed out (ORA-3136)
Tue Sep 29 05:30:13 2009
WARNING: inbound connection timed out (ORA-3136)
Tue Sep 29 05:45:13 2009
WARNING: inbound connection timed out (ORA-3136)
Tue Sep 29 06:00:13 2009
WARNING: inbound connection timed out (ORA-3136)
Tue Sep 29 06:15:13 2009
WARNING: inbound connection timed out (ORA-3136)
Tue Sep 29 06:30:13 2009
WARNING: inbound connection timed out (ORA-3136)
Tue Sep 29 06:45:13 2009
WARNING: inbound connection timed out (ORA-3136)
Tue Sep 29 07:00:14 2009
WARNING: inbound connection timed out (ORA-3136)
Tue Sep 29 07:15:14 2009
WARNING: inbound connection timed out (ORA-3136)
Tue Sep 29 07:30:14 2009
WARNING: inbound connection timed out (ORA-3136)
Tue Sep 29 07:45:14 2009
WARNING: inbound connection timed out (ORA-3136)
Tue Sep 29 08:00:14 2009
WARNING: inbound connection timed out (ORA-3136)
Tue Sep 29 08:15:21 2009
WARNING: inbound connection timed out (ORA-3136)
Tue Sep 29 08:30:21 2009
WARNING: inbound connection timed out (ORA-3136)
Tue Sep 29 08:45:28 2009
WARNING: inbound connection timed out (ORA-3136)
2、sqlnet.log日志
Fatal NI connect error 12170.
VERSION INFORMATION:
TNS for IBM/AIX RISC System/6000: Version 10.2.0.1.0 - Production
TCP/IP NT Protocol Adapter for IBM/AIX RISC System/6000: Version 10.2.0.1.0 - Production
Oracle Bequeath NT Protocol Adapter for IBM/AIX RISC System/6000: Version 10.2.0.1.0 - Production
Time: 09-MAR-2009 02:32:29
Tracing not turned on.
Tns error struct:
    ns main err code: 12535
    TNS-12535: TNS:operation timed out
    ns secondary err code: 12606
    nt main err code: 0
    nt secondary err code: 0
    nt OS err code: 0
Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=192.168.4.36)(PORT=3663))
3、參考官方說明關(guān)于該警告的說明：
Note:465043.1
The "WARNING: inbound connection timed out (ORA-3136)" in the alert log indicates that the client was not able to complete it's authentication within the period of time specified by parameter SQLNET.INBOUND_CONNECT_TIMEOUT.
You may also witness ORA-12170 without timeout error on the database
server
sqlnet.log file.
This entry would also have the clinet address which failed to get authenticated. Some applications or JDBC thin driver applications may not have these details.
可能的原因：
1.網(wǎng)絡(luò)攻擊，例如半開連接攻擊
Server gets a connection request from a malicious client which is not supposed to connect to the database ,
in which case the error thrown is the correct behavior. You can get the client address for which the error was thrown via sqlnet log file.
2.Client在default 60秒內(nèi)沒有完成認(rèn)證
The server receives a valid client connection request but the client takes a long time to authenticate more than the default 60 seconds.
3.DB負(fù)載太高
The DB server is heavily loaded due to which it cannot finish the client logon within the timeout specified.
WARNING: inbound connection timed out (ORA-3136)
這個(gè)錯(cuò)誤跟 oracle 監(jiān)聽的一個(gè)參數(shù)有關(guān)：SQLNET.INBOUND_CONNECT_TIMEOUT
這個(gè)參數(shù)從9i開始引入，指定了客戶端連接服務(wù)器并且提供認(rèn)證信息的超時(shí)時(shí)間，如果超過這個(gè)時(shí)間客戶端沒有提供正確的認(rèn)證信息，服務(wù)器會(huì)自動(dòng)中止該連接請(qǐng)求，同時(shí)會(huì)記錄試圖連接的IP地址和ORA-12170: TNS:Connect timeout occurred錯(cuò)誤。
這個(gè)參數(shù)的引入，主要是防止DoS攻擊，惡意攻擊者可以通過不停的開啟大量連接請(qǐng)求，占用服務(wù)器的連接資源，使得服務(wù)器無法提供有效服務(wù)。在10.2.0.1起，該參數(shù)默認(rèn)設(shè)置為60秒
但是，這個(gè)參數(shù)的引入也導(dǎo)致了一些相關(guān)的bug。比如：
Bug 5594769 - REMOTE SESSION DROPPED WHEN LOCAL SESSION SHARED AND INBOUND_CONNECT_TIMEOUT SET
Bug 5249163 - CONNECTS REFUSED BY TNSLSNR EVERY 49 DAYS FOR INBOUND_CONNECT_TIMEOUT SECONDS
該參數(shù)可以通過設(shè)置為0來禁用，在服務(wù)媏
設(shè)置sqlnet.ora文件：SQLNET.INBOUND_CONNECT_TIMEOUT＝0
設(shè)置listener.ora文件: INBOUND_CONNECT_TIMEOUT_listenername＝0
然后reload或者重啟監(jiān)聽
這是由于連接超時(shí)所產(chǎn)生的問題，在10.2.0.1.0版本中sqlnet.inbound_connect_timeout參數(shù)默認(rèn)為60秒，即如果連接時(shí)間超過60秒則提示超時(shí)，而在其他
10G
版本中這兩個(gè)參數(shù)默認(rèn)為0，即無限制。
如何操作：
一、查看
數(shù)據(jù)庫
中l(wèi)istener.ora中的inbound_connect_timeout參數(shù)值
1、進(jìn)入lsnrctl，
LHXXDBS01:oraoms> lsnrctl
2、查看inbound_connect_timeout參數(shù)：
LSNRCTL> show inbound_connect_time
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=LHXXDBS)(PORT=1568)))
LISTENER parameter "inbound_connect_timeout" set to 0
The command completed successfully
如果inbound_connect_timeout參數(shù)值不為0，則可以修改為0
修改：
LSNRCTL> set inbound_connect_time 0
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=LHXXDBS)(PORT=1568)))
LISTENER parameter "inbound_connect_timeout" set to 0
The command completed successfully
二、修改/oracle/oms/102_64/network/admin/sqlnet.ora
SQLNET.INBOUND_CONNECT_TIMEOUT = 0
三、重新載入listener
LSNRCTL> reload
Connecting to (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=LHXXDBS)(PORT=1568)))
The command completed successfully
第二天觀察沒有出現(xiàn)WARNING: inbound connection timed out (ORA-3136)連接超時(shí)的現(xiàn)象了。


本文來自ChinaUnix博客，如果查看原文請(qǐng)點(diǎn)：http://blog.chinaunix.net/u/16239/showart_2066048.html