3330395 - Frequently failed logins of the user sapsa reported by Auditing - SAP ASE for BS

• ASE auditing parameter "audit trail type" is enabled to syslog.
• Failed logins from the user sapsa are being reported in the OS syslog file (ie /var/log/secure file), coming from the application server.
   
  Example event:
  Feb 23 13:31:01 <server_app_host> SAP_ASE_AUDIT: <SID>| 45 | 2 | 0 | Feb 23 2023  1:31PM | 1 | 0 | 1 |  |  | sapsa | master |  |  | sa_role sybase_ts_role replication_role mon_role js_admin_role; ; ; ; <ASE_host>, <IP_adress>, network password rsa encryption with nonce, 4067.14.1; ; sapsa/ase;  |
  
  Note: 45 is event column = login , 4067.14.1 = where error is 4067 "Login failed because an incorrect password was supplied"  <Error number.Severity.State> - more information in the "Audit table - values in Event and Extrainfo columns" documentation.
  
  
• The command "/usr/sap/hostctrl/exe/saphostctrl -function LiveDatabaseUpdate -dbname <SID> -dbtype syb -updateoption TASK=VALIDATE_SEC_STORES " is returning "invalid" status for the user reported in the event:
  
  ASE_USER_STORE_NAME=<ASE_host>
  ASE_SAPSA=invalid
  
  

• SAP Adaptive Server Enterprise (ASE) 16.0 for Business Suite
• SAP Netweaver (All versions)

ASE, user store, login failed, syslog, event, audit , KBA , BC-DB-SYB , Business Suite on Adaptive Server Enterprise , Problem