DB2的一个用户由于被频繁的错误密码重试造成失败，但是db2diag.log里面并没有显示客户端数据库连接失败的IP地址及其他详细信息，没法定位是来自哪个IP地址的连接尝试造成的。
2020-04-01-07.20.14.418243-300 I659550E481 LEVEL: Error
PID : 31215 TID : 139835100620544 PROC : db2ckpwd 0
INSTANCE: db2inst1 NODE : 000
HOSTNAME: xxx.xxx.xxx.xxx
EDUID : 2 EDUNAME: db2wdog 0 [db2inst1]
FUNCTION: DB2 UDB, oper system services, sqlo_validate_pwd, probe:99
MESSAGE : crypt() returned NULL
DATA #1 : Hexdump, 4 bytes
0x00007F2DE57D1D30 : 1600 0000 ….
2020-04-01-07.20.14.419077-300 I660032E498 LEVEL: Warning
PID : 31207 TID : 139642481403648 PROC : db2sysc 0
INSTANCE: db2inst1 NODE : 000 DB : BIDB
APPHDL : 0-12187
HOSTNAME: xxx.xxx.xxx.xxx
EDUID : 325 EDUNAME: db2agent (BIDB) 0
FUNCTION: DB2 UDB, bsu security, sqlexLogPluginMessage, probe:20
DATA #1 : String with size, 65 bytes
Password validation for user biuser failed with rc = -2029059891
解决办法
db2 connect to BIDB
db2 "create audit policy fl categories validate status both error type normal"
db2 "audit database using policy fl"
db2audit start
等待…发现db2diag.log中出现了新的 Password validation 错误消息
db2audit flush
db2audit archive database BIDB to /tmp/audit
db2audit extract delasc to /tmp/audit from files /tmp/audit/db2audit.db.BIDB.log.0.xxxxxx
生成了 validate.del 文件，这个文件中 显示了客户端的IP地址和客户端用的user
