vCenter 5.5 DB account locked out frequently

[RajuVCP]

Hi All,

From past few days am facing the vCenter DB account locked out issues.

Am using vCenter 5.5 version and first we found the vCenter service is not starting and when checked the logs it says DB account locked.

We have seperate team for DB, we went to db they checked the logs and states that due to repeated bad password attempt the db account is locked.

Am surprised as db account is configured only in ODBC. How come it gets locked due to bad password attempts.(For your information we recently changed vCenter db account password and changed the same in all VC by following change vCenter db password methods from vmware)

Need help from anyone where am going wrong.. which service or application is lockign the account.

Thanks a ton in advance

[RajuVCP]

Just want to update we have changed the DB password following the KB article. Not sure why still db account keep getting locked.

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=100648...

[Alistar]

Hi there,

I suggest checking with your Active Directory Team if they can find out the source from which the account was locked out.As for me - perhaps a password change was forgotten or wrongly input on one of the servers interacting with the Database. Try double-checking for yourself.

[RajuVCP]

Hi Alister,

The DB account is not a AD usere, we are using vCenter DB as local sql account.

[luderitz]

Hi Raju,

I would start by having your SQL team check the SQL Server Logs to identify the client IP that is locking you out. I'll bet it's not your vCenter server.

The error should look like "Login failed for user 'vpxuser'. Reason: Password did not match that for the login provided. [CLIENT: xxx.xxx.xxx.xxx]"

Best of luck!
Matt

[RajuVCP]

Hi Matt,

I have checked with SQL team and got logs from them, the the logs says the account got locked from the ip x.x.x.x. which is my vCenter IP.

[luderitz]

Any issues with VUM lately? Assuming it's installed on your vCenter server, you should have a 32-bit ODBC source configured also. Did you test both DSN connections in the ODBC administrator? 

What about vCenter/vRealize Orchestrator? I believe that is configured separate from your ODBC configurations.

[RajuVCP]

Hi Matt,

I didnt see any issue with VUM, i have issue of DB account lock only with vCenter Service.

Yes my VUM is installed on vCenter server only, yes VUM have 32 bit ODBC and vCenter have 64 bit ODBC and yes i tried testing the DSN connection for both VUM and vCenter it was successfull.(for vCenter DSN it was successfull only when i ask DB team to unlock vCenter DB account, if vCenter DB acccount is locked and when i test ODBC DSN connection it gives message as db account locked).

We are not using Orchestrator.

Thanks..

[RajuVCP · Accepted solution]

The issue is solved now.

We just rebooted the vCenter which we have changed DB password.

Once the DB password is changed and we made changes in VC , but forgot to restart VC .. It will still hold the old DB credentials with the DB access it. When ever the patch installation happened on VC or on DB server.

It gets rebooted., Then the VC will try to connect the DB with old credentails. DB server sees VC db trying to connect from old password with more number of attempts. Then DB server will lock the account.

Simple solution is to restart VC the moment you changed DB password.