'ERROR:=0AORA-01017: Invalid username/password; logon denied' or 'ERROR:=0AORA-28000: The account is locked' error when running a CCS data collection on Oracle assets

Products

• Control Compliance Suite Standards Server
• Control Compliance Suite

Issue/Introduction

Control Compliance Suite (CCS)

In CCS, during a data collection or CER (Collection-Evaluation-Reporting) job for an Oracle Agent-based asset, you see the following error(s) 

“Failure occurred in query execution.  ERROR:=0AORA-01017: Invalid username/password; logon denied=0A=0A=oASP2-0751: Unable to connect to Oracle.  Exiting SQL*Plus-0A=0A.”

OR

Failure occurred in query execution. ERROR:=0AORA-28000: The account is locked.=0A=0A=0ASP2-0751: Unable to connect to Oracle.  Exiting SQL*Plus=0A=0A. Scope is database 'DBName' on server 'AssetName'

Environment

Agent-based Oracle data collection.

CCS 12.6.1

CCS 12.7

CCS 12.8

Cause

This happens when using local agent-based Oracle credentials such as the CCSDBA/C##CCSDBA user account for the Oracle data collection.

The Oracle asset was originally set up to use Service Name option in CCS using the 'ccsorasetup -s DBNAME' option, but then the ccsorasetup utility was run again at a later date with the 'ccsorasetup -a all' option.  The '-a all' option configures the database incorrectly as SID and creates a new .dat file with the new password while the old .dat file for Service Name does not get updated.

Resolution

On the CCS Agent that is reporting this issue, re-run the 'ccsorasetup' utility as shown below to configure it to use the Service Name instead of a SID.

/esm/bin/dcmodules/Linux/ORCL/bin/ccsorasetup -s DB_NAME

NOTE: Replace the DB_NAME above with the database name that is reporting the invalid username/password error in the CCS Console.

Also make sure in the CCS console that 'Service Name' is selected for the 'Database Name Type' dropdown option in the Asset-type Properties for that Oracle asset: