Symantec Privileged Access Management

Hi Team,

I am not able to fix the problem to one of the server:

problem is I am not able to fix the logs

gotsap217:~ # seaudit -a -sd today |grep "D "
CA ControlMinder seaudit  v12.81.0.2265 - Audit log lister
Copyright (c) 2013 CA. All rights reserved.
29 Jan 2018 14:23:39 D LOGIN        ftpsapxi              69  2 gotsap217.got.volvocars.net VFTP

User is getting this error:

[29-01-2018 18:54] KAPDOSKAR, ROHIT:

gotsap217:~ # ftp gotsap217.got.volvocars.net

Connected to gotsap217.got.volvocars.net.

220 (vsFTPd 2.0.7)

Name (gotsap217.got.volvocars.net:rkapdosk): ftpsapxi

331 Please specify the password.

Password:

500 OOPS: not a normal exit in vsf_sysutil_wait_get_exitcode

ftp: Login failed.

ftp>

this is the issue in gotsap217

500 OOPS: not a normal exit in vsf_sysutil_wait_get_exitcode

Please , help me on this

Thanks

LokeshReddy

The denial code 69, which you can see in the seaudit output, means that there is no rule to allow access. This could mean either there is no rule set up to allow login or the default access of the rule is to deny login and the user has not been authorized to log in. Please collect the following information and create a support case so we can troubleshoot this issue further for you.

1- Get a trace of the issue

# secons -tc -t+

((reproduce the issue))

# secons -t-

2- Collect a support tar to gather the trace and selang rules

# cd /opt/CA/AccessControl/lbin

# ./support.sh -all ((this will cause PIM daemons to recycle))

The support tar will be located in /opt/CA/AccessControl

Hi Brain Rehder,

Thank you for your support its working fine now

Thanks

LokeshReddy

Hi Brain Rehder/ Team

Still its not fixed

gotsap217:~ # seaudit -a -sd today |grep "D "
CA ControlMinder seaudit  v12.81.0.2265 - Audit log lister
Copyright (c) 2013 CA. All rights reserved.
30 Jan 2018 13:01:08 D LOGIN        ftpsapxi              69  2 gotsap217.got.volvocars.net VFTP

same error is coming again

please do need ful

Thanks

Lokeshreddy

Hi team

Please assist me on above issue

Thanks

Lokeshreddy

If the issue is still occurring, please collect the following information and create a support case so we can troubleshoot this issue further for you. The issue you are experiencing is too in depth to be worked on in a Communities post.

1- Get a trace of the issue

# secons -tc -t+

((reproduce the issue))

# secons -t-

2- Collect a support tar to gather the trace and selang rules

# cd /opt/CA/AccessControl/lbin

# ./support.sh -all ((this will cause PIM daemons to recycle))

The support tar will be located in /opt/CA/AccessControl