Troubleshooting: The monitoring account password expires

Applies to: Opslogix Oracle Management Pack (V26.11.4544.0 and later)
Last updated: November 2026 · Latest version: 26.11.4544.0

The Oracle Management Pack connects to each instance with the monitoring account that you entered in the Oracle IMP Configuration Dashboard. When the password of that account expires, Oracle refuses the logon and monitoring of the instance stops. The Monitoring Account Password Expiry monitor warns you in time.

What the monitor checks

Runs every hour on primary databases.
Warning: the password expires in less than 14 days.
Critical: the password has expired and the account is in its grace period. It can still log on, but only until the grace period ends.
Healthy: the password expires in 14 days or more, or never.

The alert "Oracle monitoring account password expires" names the account, the instance, the expiry date and the account status. The monitor reads the account's own row in USER_USERS, so it needs no extra grant.

SYSDBA connections stay Healthy: Oracle checks SYSDBA logons against the password file, not against the expiry date of the account.
Standby databases: a physical standby has the same accounts as its primary, so the monitor on the primary covers it.

Why the password expires

The setup script for the monitoring account creates the account with the DEFAULT profile. In the DEFAULT profile, Oracle expires passwords after 180 days (PASSWORD_LIFE_TIME), followed by 7 days of grace (PASSWORD_GRACE_TIME). Check the profile of the account, and the password limits of that profile:

SELECT username, profile, account_status, expiry_date FROM dba_users WHERE username = 'OPSLOGIX';

SELECT resource_name, limit FROM dba_profiles
WHERE profile = 'DEFAULT' AND resource_name LIKE 'PASSWORD%';

Replace OPSLOGIX with the name of your monitoring account, and DEFAULT with its profile.

Change the password

Set a new password in Oracle:
ALTER USER opslogix IDENTIFIED BY "new_password";
Update the password of the instance in the Oracle IMP Configuration Dashboard, or with Add-SCOMOracleConnection of the PowerShell module, which adds or updates a connection. See KB: Automate the adding / removing / updating of a Oracle connection.
The alert closes at the next check, within an hour.

In a multitenant database, a common account (C##) has one password for all containers; change it in the CDB root. A local account in a PDB has its own password; change it in that PDB.

Stop the password from expiring

If the security policy of your organization allows it, give the monitoring account its own profile with an unlimited password life time. Set the password once more, so that the new limit applies:

CREATE PROFILE opslogix_monitoring LIMIT PASSWORD_LIFE_TIME UNLIMITED;
ALTER USER opslogix PROFILE opslogix_monitoring;
ALTER USER opslogix IDENTIFIED BY "new_password";

If your policy requires regular password changes, keep the profile and change the password when the monitor warns. To get the warning earlier or later, override HealthyThreshold of the monitor (in days, default 14).

When monitoring has already stopped

When the grace period has ended, or the account is locked, the account cannot log on. The Password Expiry monitor cannot run then; the Instance connection monitor raises an alert with the Oracle error, for example ORA-28001 (the password has expired) or ORA-28000 (the account is locked). Set a new password, unlock the account if needed, and update the password in the Oracle IMP Configuration Dashboard:

ALTER USER opslogix IDENTIFIED BY "new_password" ACCOUNT UNLOCK;

See Troubleshooting: Instance connection alerts and common ORA errors.