CUCM database replication failed

[samhopealpha]

Hi everybody,

I was trying to add a subscriber to the publisher, but fail

- when checking the database replication state, it says the replication status are OFF-LINE

- when checking the informix database, it says Password Validation for user failed

(shown as below)

Is there anything wrong in here?

DB and Replication Services: ALL RUNNING

Cluster Replication State: N/A

DB Version: ccm8_6_2_20000_2

Number of replicated tables: 0

Cluster Detailed View from PUB (2 Servers):

                                           PING                          REPLICATION          REPL.          DBver&           REPL.          REPLICATION SETUP

SERVER-NAME          IP ADDRESS            (msec)          RPC?          STATUS               QUEUE          TABLES           LOOP?          (RTMT) & details

-----------          ------------          ------          ----          -----------          -----          -------          -----          -----------------

CUCM-PUB          10.10.10.1          0.033          Yes          Off-Line          N/A              match          N/A            (0) PUB

CUCM-SUB          10.10.10.2          0.124          Yes          Off-Line          N/A              match          N/A            (0) N/A     

#######################################################################################################

file view activelog cm/log/informix/ccm.log

19:27:09  Password Validation for user [dbdbl] failed!

19:27:09  Check for password aging/account lock-out.

19:27:09  listener-thread: err = -952: oserr = 0: errstr = dbdbl@CUCM-SUB[CUCM-SUB]: User (dbdbl@CUCM-SUB[CUCM-SUB])'s password is not correct for the database server.

19:27:10  Password Validation for user [dblpm] failed!

19:27:10  Check for password aging/account lock-out.

19:27:10  listener-thread: err = -952: oserr = 0: errstr = dblpm@CUCM-SUB[CUCM-SUB]: User (dblpm@CUCM-SUB[CUCM-SUB])'s password is not correct for the database server.

19:27:11  Password Validation for user [dbris] failed!

19:27:11  Check for password aging/account lock-out.

19:27:11  listener-thread: err = -952: oserr = 0: errstr = dbris@CUCM-SUB[CUCM-SUB]: User (dbris@CUCM-SUB[CUCM-SUB])'s password is not correct for the database server.

19:27:12  Password Validation for user [dbauditlog] failed!

19:27:12  Check for password aging/account lock-out.

19:27:12  listener-thread: err = -952: oserr = 0: errstr = dbauditlog@CUCM-SUB[CUCM-SUB]: User (dbauditlog@CUCM-SUB[CUCM-SUB])'s password is not correct for the database server.

19:27:15  Password Validation for user [dbtvs] failed!

19:27:15  Check for password aging/account lock-out.

19:27:15  listener-thread: err = -952: oserr = 0: errstr = dbtvs@CUCM-SUB[CUCM-SUB]: User (dbtvs@CUCM-SUB[CUCM-SUB])'s password is not correct for the database server.

Thanks 

[Rob Huffman · Accepted solution]

Hi Sam,

I was looking at your previous thread with the related Sub build-out

and I believe you may be hitting this (these) bug(s);

CSCua09290 - CLI "set password user security" did not set the correct apps password

Description

Symptom:
DB Connection to Pub will fail due to incorrect database password error in ccm.log  ; Replication may
not setup
Conditions:
The defect is valid in the following two scenario:
Scenario 1:
1) Reset password on the Publisher, and reboot
2) Fresh install the Sub with the new security password
3) After the Sub completed the installation
3a) cluster manager on both pub and sub should have all servers authenticated, verify from cli (show
network cluster) ( If this is not the case, the problem is different)
3b) Local database connection is valid, to verify, execute from root (idblj -e "select * from
processnode") on both servers, data should return ( If this is not the case, the problem is different)
3c) Replication will not be setup, ccm.log on Publisher should report -952 Error code.
Scenario 2:
1) Fresh install a Publisher.
2) Run 'utils import config' to change the hostname, password and
security password.
3) Fresh install a Subscriber using the same security password set in
Step 2.
4) Once the Subscriber install is finished, the Informix logs show that
the database passwords do not match:
08:15:12 Password Validation for user [dbauditlog] failed!
08:15:12 Check for password aging/account lock-out.
08:15:12 listener-thread: err = -952: oserr = 0: errstr =
dbauditlog@nw16-vm217: User (dbauditlog@nw16-vm217)'s password is not
correct for the database server.
Additional Info:
Even with the fix for this defect, there is another issue in 8.6(2) that will cause the passwords to be out
of sync (CSCts10778).  The workaround is to run "utils os secure permissive" prior to changing the
security passphrase.

Details

First Found in:                          (1)

9.0(0.99101.22)

Status:

Fixed

Last Modified:

Jan 25,2013

Fixed in:                          (9)

9.1(1.10000.11),9.0(1.98000.42),9.0(1.98000.12)

9.0(1.11003.1),8.6(2.22900.9),8.6(2.22900.4)

8.6(2.22043.2),1.0(0.98000.42),1.0(0.98000.16)

Less

Product:

Cisco Unified Communications Manager (CallManager)

Platform:

Dependent

Severity:

3 - moderate

CSCuc09996 : Replication fails after deploying CUCM using "New Identity process"

Symptom:
After deploying CUCM using "New Identity process"  we could see below symptoms.
++ Replication status would be "off-Line" in all the servers with in cluster.
++ admin:file view activelog /cm/log/informix/ccm.log
14:32:09  Password Validation for user [dbmon] failed!
14:32:09  Check for password aging/account lock-out.
14:32:09   listener-thread: err = -952: oserr = 0: errstr = dbmon@dc1-nssl2cm2:  User (dbmon@dc1-nssl2cm2)'s password is not correct for the database  server.
14:32:11  Password Validation for user [dbmon] failed!
14:32:11  Check for password aging/account lock-out.
14:32:11   listener-thread: err = -952: oserr = 0: errstr = dbmon@dc1-nssl2cm2:  User (dbmon@dc1-nssl2cm2)'s password is not correct for the database  server.
14:32:13  Password Validation for user [dbris] failed!
14:32:13  Check for password aging/account lock-out.
14:32:13   listener-thread: err = -952: oserr = 0: errstr = dbris@dc1-nssl2cm2:  User (dbris@dc1-nssl2cm2)'s password is not correct for the database  server.
14:32:17  Password Validation for user [dbtvs] failed!
14:32:17  Check for password aging/account lock-out.
14:32:17   listener-thread: err = -952: oserr = 0: errstr = dbtvs@dc1-nssl2cm2:  User (dbtvs@dc1-nssl2cm2)'s password is not correct for the database  server.
14:32:17  Password Validation for user [dbdbl] failed!
14:32:17  Check for password aging/account lock-out.
14:32:17   listener-thread: err = -952: oserr = 0: errstr = dbdbl@dc1-nssl2cm2:  User (dbdbl@dc1-nssl2cm2)'s password is not correct for the database  server.
Conditions:
++ Customer is using New Identity process for installing the CUCM servers.
++ He does this by copying the existing CUCM VM to a VM Template.
++  New server would be cloned using VM Template and he will import the  platformconfig.xml (generated from "Answer file generator") for changing  parameters (like IP_Address, User ID, password e.t.c.,).
++ DB replication gets failed after proceeding with above mentioned install.
Workaround:
The  workaround for the defect is to set the os security to permissive prior  to running the set password or import config commands

Cheers!

Rob

EDIT: it looks like this bug supercedes CSCuc09996

CSCts10778 - Denials thrown for security Password Recovery procedure

Description

Symptom:
Denials thrown for security Password Recovery procedure
Conditions:
8.6.2.10000.5
Workaround:
Set os security mode to permissive prior to changing the password.
Additional Information:
In 8.6(2), the fix for CSCua09290 is also required in order for the passwords not to get out of sync.

Details

First Found in:                          (2)

8.6(2.10000.5),8.6(2.21900.5)

Status:

Fixed

Last Modified:

Jan 25,2013

Fixed in:                          (6)

9.0(1.10000.37),9.0(1.10000.15),8.6(2.98000.7)

8.6(2.98000.16),8.6(2.23050.1),1.0(0.98000.42)

Product:

Cisco Unified Communications Manager (CallManager)

Platform:

Dependent

Severity:

3 - moderate

"Clocks go slow in a place of work
Minutes drag and the hours jerk" 

-The Clash

[samhopealpha]

Thanks for the quick respond, but I'm not really understand about the workaround...

does it mean i have to go CUCM console, and run

> utils os secure permissive

but then set password ? does it mean set the security password again?

thanks

[Rob Huffman · Accepted solution]

Hey Sam,

You are most welcome my friend

That is exactly right;

The workaround is to run "utils os secure permissive" prior to changing the

security passphrase.

So set it via cli as you nicely noted and then re-do the password.

Cheers!

Rob

"Clocks go slow in a place of work
Minutes drag and the hours jerk" 

-The Clash

[samhopealpha]

thanks for the clear instruction, i will try it on monday