How to find User disconnection root cause at particular time.?

UNIX Solaris
1

Hi Guys,

I need to find out User disconnection cause at particualr time 08:50:49 CET . from various site(Location) on one Server.

My Server is :- Solaris 10 64BIt Sparc.

below is only log I found at /var/adm/message

I er started by mfg on batch. (4281)
Dec 12 08:47:49 server68 login: [ID 376080 auth.crit] change password failure: Authentication token manipulation error
Dec 12 08:50:52 localhost loganalyzer[27624]: Th0850: _u02_db_eB2_196_prod_mfgprod.lg: ALERT: (Incorrect MFG session ending) 08:50:49 Usr 27: Begin transactio
n backout. (2252)
Dec 12 08:52:56 localhost loganalyzer[27624]: Th0852: _u02_db_eB2_196_prod_mfgprod.lg: ALERT: (Incorrect MFG session ending) 08:52:55 Usr 27: Begin transactio
n backout. (2252)
Dec 12 09:20:50 localhost loganalyzer[26777]: Th0920: _u01_mfg_eB2_SP6_qad_qps_logs_255prodQPS_manexport.log: ALERT: (MFG CRIT-MAIL SERVER68 QPS error #5772
) ERROR: MESSAGE_# 5772.
Dec 12 09:20:52 localhost loganalyzer[26777]: Th0920: _u01_mfg_eB2_SP6_qad_qps_logs_255prodQPS_manexport.log: ALERT: (MFG CRIT-SYSTEM) X-NODEREF or X-DOCUMENT
LOAD got an error: FATAL ERROR: file 'MEMPTR', line '1', column '1', message 'Invalid document structure'. (9082)
-bash-3.2$

The Users were able to login to Server but after that the second login page to databse did not appear.

So,

How do I check oad on the Server for particular time? I did use sar -u which showed:-

       %usr    %sys    %wio   %idle
08:00:00      12       3       0      85
08:05:00      19       6       0      75
08:10:00      15       4       0      81
08:15:00      16       6       0      78
08:20:00      19       6       0      74
08:25:00      16       5       0      79
08:30:00      17       4       0      79
08:35:01      26       7       0      67
08:40:00      24       4       0      72
08:45:00      12       3       0      84
08:50:00       8       2       0      90
08:55:00      18       9       0      74
09:00:00      16       5       0      79

Where can I check the databse logs on Solaris 10?

Please Guide.

Thanks.

2

You have tried pretty much what there is. Disconnects usually happen because of:

  1. hardware errors - you appear have none
  2. network errors -
  3. code / users that do bad / stupid things or are configured wrong <-- I vote for this.

If it is just one one user, #3 is the likely issue. If it is several users working in the same department, try the problem code scenario. In other words, invoke script in those users .profile in order to log sessions. Then see what they were doing when things went South.