Security Compliance

Logon Failed. Database Vendor Code: -1301 in SEM

This article describes how to resolve an issue in which you are unable to run SEM reports using the reports console and you get the following error message: Login failed. Details: [Database Vendor Code: -1301 ] Error code: -2147189176.

First published date

10/11/2018 5:25 PM

Last published date

8/22/2022 8:05 PM

Overview

You are unable to run reports using the Security Event Manager (formerly Log & Event Manager) reports console and you get the following error message:

Logon failed.
Details: [Database Vendor Code : -1301 ]

Product section

Security Event Manager

Cause

This error is typically caused by a networking issue between SEM and the Reports Console. It may also be due to problems authenticating over TLS if you have that option enabled.

Resolution

  1. Verify network connectivity from the machine with the Reports Console installed to SEM.
    1. From the Reports Console, open Configure > Managers - Credentials and Certificates view.
    2. For Manager name verify the host name/IP entered for SEM is correct.
      • Verify that the host name resolves via DNS by pinging it.
      • TLS, DNS host name of SEM is required.
    3. Create a "reports" local user in SEM and assign it the Reports role.  Use this User for the credentials.
    4. If you use the Test Connection button here it will attempt to ping SEM.
      • Note that this is a TCP Ping and blocked by most routers and may fail even though a valid connection can still be made.
  2. If you are able to successfully ping the host name/IP of SEM, verify the port is open.
    1. SEM Reports uses port 9001 to contact SEM.
    2. Run the PowerShell command  
      • TNC -ComputerName <SEM-IP/hostname> -Port 9001

Output:

ComputerName     : <SEM-IP>
RemoteAddress    : <SEM-IP>
RemotePort       : 9001
InterfaceAlias   : Ethernet0
SourceAddress    : <Source Machine IP> 
TcpTestSucceeded : True
    3. If the connection is refused something is blocking the port.
  3. Verify that SEM is not blocking a connection from that IP address via IP Restriction. NOTE: if you run a netstat on port 9001 and see only SYN_SENT as a status when trying a Powershell tnc test or running reports, this step might resolve it.
    1. Open a PuTTY session to SEM manager and logon as cmc. cmc is the CMC account user name. .
    2. Enter service to access the Service menu.
    3. Enter unrestrictreports to remove any restrictions. The restrictreports command allows you to create a list of computers that are allowed to access SEM using the reports application. Follows the prompts to create a list of computers that can use Reports to access SEM
  4. Ensure TLS and the Certificate is configured:  Use TLS communication in the Reports Console