SAP connect to database fails


Curious problem this morning.
SAP instance was failing to start because R3trans could not connect to the database.
Checking trans.log revealed the following error:

4 ETW000 R3trans version 6.25 (release 741 - 29.01.15 - 20:15:01).
4 ETW000 unicode enabled version
4 ETW000 ===============================================
4 ETW000
4 ETW000 date&time   : 21.09.2015 - 06:01:56
4 ETW000 control file: <no ctrlfile>
4 ETW000 R3trans was called as follows: R3trans -d
4 ETW000  trace at level 2 opened for a given file pointer
4 ETW000  [     dev trc,00000]  Mon Sep 21 06:01:56 2015                                                  82  0.000082
<snip>
4 ETW000  [     dev trc,00000]  *** ERROR in DB6Connect[/bas/741_REL/src/dbs/db6/dbdb6.c, 1896] CON = 0 (BEGIN)
4 ETW000                                                                                                  93  0.799390
4 ETW000  [     dev trc,00000]  &+     DbSlConnectDB6( SQLConnect ): [IBM][CLI Driver] SQL30082N  Security processing failed with reason "42" ("ROOT CAPA
4 ETW000                                                                                                  20  0.799410
4 ETW000  [     dev trc,00000]  &+     BILITY REQUIRED").  SQLSTATE=08001

I happened to know that some maintenance work had been happening on the DB2 database server.
This work should not have affected file permissions but for whatever reason the sticky bit on two files involved in password processing had been lost.

# cd /db2/db2sid/sqllib/security
[security]# ls -l db2c?pw
-r-x--x--x 1 root dbsidadm   29205 May 14 09:00 db2chpw
-r-x--x--x 1 root dbsidadm 4592410 May 14 09:00 db2ckpw

The fix was to simply add sticky bit back and restart DB2.

[security]# chmod u+s db2c?pw
[security]# ls -l db2c?pw
-r-s--x--x 1 root dbsidadm   29205 May 14 09:00 db2chpw
-r-s--x--x 1 root dbsidadm 4592410 May 14 09:00 db2ckpw

Following the DB2 restart R3trans successfully connected to the instance and SAP started.

Comment on this article using form below. Requires email login only for authentication. HTML forbidden, Markdown only.