|
The database (SQL Anywhere 17) is "attacked" by an unknown application. It does not reach the login_procedure, the message appears at the user/password verification stage. Whether there is an opportunity means of a DB to learn what user and what application tries to connect to a DB? ps I don't want to specify the number of failed login attempts, as it is suspected that a "good" user is using a "bad" password hidden in the application. |
|
You can get the userid by enabling auditing. See https://help.sap.com/docs/SAP_SQL_Anywhere/61ecb3d4d8be4baaa07cc4db0ddb5d0a/3bcea97f6c5f1014addcf626d6e456ce.html?q=audit_log. But I wouldn't log to the transaction log for the output as the tutorial suggests. Use an event file instead: https://help.sap.com/docs/SAP_SQL_Anywhere/61ecb3d4d8be4baaa07cc4db0ddb5d0a/812cbb736ce2101490b7fab431caa9ff.html?q=audit_log Unfortunately, auditing doesn't log the "appinfo" string which contains the client app executable name, etc. I'm not sure if it is available to the server that early in the connection attempt but, if it is, I think we should enhance auditing to record it. 4
Oh, wait. You can also create a ConnectFailed event. It will have access to the appinfo (and the user). Available event parameters for ConnectFailed: https://help.sap.com/docs/SAP_SQL_Anywhere/93079d4ba8e44920ae63ffb4def91f5b/81f7991d6ce21014b2ec94fdcb7db2ce.html?q=connectfailed
(17 Nov '22, 10:00)
John Smirnios
Thanks! Great opportunity!
(17 Nov '22, 10:31)
Ilia63
|
