In this Document
PurposeTroubleshooting StepsReferences
Applies to:
Oracle Net Services - Version 10.2.0.1.0 to 11.2.0.1 [Release 10.2to 11.2]
Information in this document applies to any platform.
Purpose
Troubleshooting guide for "ORA-3136 WARNINGinbound connection timed out" seen in the alert log.
Troubleshooting Steps
The "WARNING: inbound connection timed out (ORA-3136)" in thealert log indicates that the client was not able tocomplete the authenticationprocess within the period of time specified by the parameterSQLNET.INBOUND_CONNECT_TIMEOUT.
You might also see the errors ORA-12170 or TNS-12535 in thesqlnet.log that is generated on the server.
Check $ORACLE_HOME/network/log for this file. This entry should contain client address from which the timeoutoriginated and may be helpful in determining how to troubleshootthe issue. Some applications or JDBC thin driverapplications may not have these details. Thesqlnet.log file is not generated by default in11g and newer.
From 10.2.0.1 onwards the default setting for the parameterSQLNET.INBOUND_CONNECT_TIMEOUT is 60 seconds. Ifthe client is not able to authenticate within 60 seconds, thewarning would appear in the alert log and the client connectionwill be terminated.
Note: This timeout restriction wasintroduced to combat Denial of Service (DoS) attack wherebymalicious clients attempt to flood database servers with connectrequests that consumes resources.
The following are the most likely reasons for this error-
- Server gets a connection request from a malicious client whichis not supposed to connect to the database. Inthis case the error thrown would be the expected and desirablebehavior. You can get the client address for whichthe error was thrown in the sqlnet.log file that is local to thedatabase.
- The server receives a valid client connection request but theclient takes a long time to authenticate more than the default 60seconds.
- The DB server is heavily loaded due towhich it cannot finish the client logon within thetimeout specified.
To understand what is causing this issue, followingchecks can be done
The default value of 60 seconds is good enough in mostconditions for the database server to authenticate a clientconnection. If it is taking longer, then it's worth checking thefollowing items before implementing the workaround:
1. Check whether local connection on the database server issuccessful & quick.
2. If local connections are quick ,then check for underlyingnetwork delay with the help of your network administrator.
3. Check whether your Database performance has degraded inanyway.
4. Check alert log for any critical errors for eg, ORA-600 orORA-7445 and get them resolved first.
These critical errors might have triggered the slowness of thedatabase server.
It is often necessary to increase the values for INBOUND CONNECTTIMEOUT at both the listener and the database inorder to resolve thisissue. It isusually advisable to set the database (sqlnet.ora) value slightlyhigher than the listener(listener.ora). The authentication process is more demanding for the database thanthe listener.
To set these parameters to use values higher than the default of 60seconds, follow these instructions and restart thelistener. There is no need to restartOracle:
Edit the server side sqlnet.ora file and add this parameter:
SQLNET.INBOUND_CONNECT_TIMEOUT= Where is thevalue in seconds.
E.g.:
SQLNET.INBOUND_CONNECT_TIMEOUT = 120
Edit the listener.ora file and add thisparameter:
INBOUND_CONNECT_TIMEOUT_ = Again, where isthe timeout value in seconds.
For example if the listener name is LISTENER then use:
INBOUND_CONNECT_TIMEOUT_LISTENER = 110
From Oracle version 10.2.0.1 onwards thedefault value of INBOUND_CONNECT_TIMEOUT_ is 60seconds. For previous releases it is zero or OFF by default.
How to check whether inbound timeout is active forthe listener and database server:
For example, INBOUND_CONNECT_TIMEOUT_ =110
You can check whether the parameter is active or not by simplydoing telnet to the listener port.
$ telnet
for eg.
$telnet 123.23.23.23 1521
The telnet session should disconnect after 110 seconds whichindicates that the inbound connection timeout for the listener isactive.
Alternatively, check at the LSNRCTL prompt using:
LSNRCTL>set current_listener
LSNRCTL>show inbound_connect_timeout
To check whether database server SQLNET.INBOUND_CONNECT_TIMEOUT isactive:
Eg.
SQLNET.INBOUND_CONNECT_TIMEOUT=120
a. For Dedicated server setup, enable the support level sqlnetserver tracing will show the timeout value as below:
niotns: Enabling CTO, value=120000 (milliseconds) <== 120seconds
niotns: Not enabling dead connection detection.
niotns: listener bequeathed shadow coming to life...
b. For shared Server setup,
$ telnet
Example.
$telnet 123.23.23.23 51658
The telnet session should disconnect after 120 seconds whichindicates that the sqlnet.inbound_connect_timeout is active.
If you have further questions regarding thisissue then please create a Service Request in My Oracle Support andprovide the following information:
a. Client and matching server traces generated at supportlevel.
Note395525.1 How to Enable Oracle NetClient,Server,Listener,Kerberos and External procedure Tracing fromNet Manager (netmgr):
Note 374116.1 How to Match Oracle Net Client and Server TraceFiles
b. Upload sqlnet.ora, listener.ora Sqlnet.log, & Alert_.logfrom database server
转到底部
