Alert日志报了一个WARNING: inbound connection timed out (ORA-3136)。

经过查询得知，看字面意思是数据库超时，造成连接中断。

同时在sqlnet.log中记录了，

Fatal NI connect error 12170.

VERSION INFORMATION:
TNS for Linux: Version 10.2.0.2.0 - Production
Oracle Bequeath NT Protocol Adapter for Linux: Version 10.2.0.2.0 - Production
TCP/IP NT Protocol Adapter for Linux: Version 10.2.0.2.0 - Production
Time: 19-JUL-2006 11:25:26
Tracing not turned on.
Tns error struct:
ns main err code: 12535
TNS-12535: TNS:operation timed out
ns secondary err code: 12606
nt main err code: 0
nt secondary err code: 0
nt OS err code: 0
Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=192.168.1.123)(PORT=58147))

可以看出那台机器连接中断。

解决办法：

set INBOUND_CONNECT_TIMEOUT_ =0 in listener.ora
2. set SQLNET.INBOUND_CONNECT_TIMEOUT = 0 in sqlnet.ora of server.
3. stop and start both listener and database.
4. Now try to connect to DB and observe the behaviour

数据库客户端连接数据库服务后会有一个认证，这个参数就是指认证的时间。默认60s，如果为0，则关闭参数，就不认证了。当认证时间超过客户端没有通过认证，则报这个警告。

其中SQLNET.INBOUND_CONNECT_TIMEOUT是客户端连接数据库服务认证的时间长，单位是秒，oracle 10默认此参数为60秒。如果到了认证时间，客户端建立连接失败了，数据库服务将终止连接。并将会在sqlnet。Log中记录日志。客户端讲接到ORA-12547: TNS:lost contact or an 和ORA-12637: Packet receive failed error message

没有这个参数，客户端连接到数据库服务器可以打开不需要认证，如果连接不需要认证，可能遭到攻击，有很多链接练到数据库上，消耗数据库的连接数。

为了保护数据库和监听，oracle推荐设置参数INBOUND_CONNECT_TIMEOUT_listener_name在监听文件中，这是一个特殊的参数，考虑下一下建议，设置所有的参数为最小值。设置INBOUND_CONNECT_TIMEOUT_listener_name小于SQLNET.INBOUND_CONNECT_TIMEOUT

如果为0则关闭此功能，就是没有不认证，直接连接。这样貌似不安全，连载数据库上的进程会越来越多。

SQLNET.INBOUND_CONNECT_TIMEOUT
Purpose
Use the SQLNET.INBOUND_CONNECT_TIMEOUT parameter to specify the time, in seconds, for a client to connect with the database server and provide the necessary authentication information.

If the client fails to establish a connection and complete authentication in the time specified, then the database server terminates the connection. In addition, the database server logs the IP address of the client and an ORA-12170: TNS:Connect timeout occurred error message to the sqlnet.log file. The client receives either an ORA-12547: TNS:lost contact or an ORA-12637: Packet receive failed error message.

Without this parameter, a client connection to the database server can stay open indefinitely without authentication. Connections without authentication can introduce possible denial-of-service attacks, whereby malicious clients attempt to flood database servers with connect requests that consume resources.

To protect both the database server and the listener, Oracle Corporation recommends setting this parameter in combination with the INBOUND_CONNECT_TIMEOUT_listener_name parameter in the listener.ora file. When specifying values for these parameters, consider the following recommendations:

Set both parameters to an initial low value.
Set the value of the INBOUND_CONNECT_TIMEOUT_listener_name parameter to a lower value than the SQLNET.INBOUND_CONNECT_TIMEOUT parameter.
For example, you can set INBOUND_CONNECT_TIMEOUT_listener_name to 2 seconds and INBOUND_CONNECT_TIMEOUT parameter to 3 seconds. If clients are unable to complete connections within the specified time due to system or network delays that are normal for the particular environment, then increment the time as needed.

See Also: