ALERT日志中常见监听错误：ORA-3136错误的排查

【现象】

*********************************************************************** Fatal NI connect error 12170.   VERSION INFORMATION:        TNS for Linux: Version 12.1.0.2.0 - Production        Oracle Bequeath NT Protocol Adapter for Linux: Version 12.1.0.2.0 - Production        TCP/IP NT Protocol Adapter for Linux: Version 12.1.0.2.0 - Production  Time: 21-MAR-2018 14:01:26  Tracing not turned on.  Tns error struct:    ns main err code: 12535   TNS-12535: TNS:operation timed out    ns secondary err code: 12606    nt main err code: 0    nt secondary err code: 0    nt OS err code: 0  Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=192.168.1.81)(PORT=52933))Wed Mar 21 14:01:26 2018WARNING: inbound connection timed out (ORA-3136)Wed Mar 21 14:01:26 2018  ***********************************************************************

【原因】

1.DoS***，大量恶意连接，此时报错并终止客户端连接是正确的。

2.正常连接，但是未在SQLNET.INBOUND_CONNECT_TIMEOUT值=60秒内完成登陆验证。

3.数据库服务器负载高，类似HANG住。

【解决方法】

（1）查看当前sqlnet.ora

[oraprod@erpdb PROD_erpdb]$ cat sqlnet.ora################################################################# Do not edit settings in this file manually. They are managed# automatically and will be overwritten when AutoConfig runs.# For more information about AutoConfig, refer to the Oracle# E-Business Suite Setup Guide.##$Header: NetServiceHandler.java 120.28.12020000.8 2016/03/30 11:22:32 kmandal ship $################################################################ NAMES.DIRECTORY_PATH=(TNSNAMES, ONAMES, HOSTNAME)SQLNET.EXPIRE_TIME= 10SQLNET.INBOUND_CONNECT_TIMEOUT =60SQLNET.ALLOWED_LOGON_VERSION_SERVER=8

（2）查看当前listener的INBOUND_CONNECT_TIMEOUT_PROD：

LSNRCTL> show inbound_connect_timeoutConnecting to (ADDRESS=(PROTOCOL=tcp)(HOST=)(PORT=1521))LISTENER parameter "inbound_connect_timeout" set to 60The command completed successfully

（3）Oracle建议是sqlnet.ora INBOUND_CONNECT_TIMEOUT的值大于listener.ora--中的INBOUND_CONNECT_TIMEOUT_PROD的值。

例如：

sqlnet.oraSQLNET.INBOUND_CONNECT_TIMEOUT = 120

listener.oraINBOUND_CONNECT_TIMEOUT_PROD = 119

验证：

LSNRCTL>show inbound_connect_timeout