"USER does not have the proper authority to monitor the DB2 instance. A minimum of SYSMON authority is required." (4372755)

"USER does not have the proper authority to monitor the DB2 instance. A minimum of SYSMON authority is required."

When adding a DB2 agent, the installer fails with the following message.

"User USERNAME does not have the proper authority to monitor the DB2 instance. A minimum of SYSMON authority is required."

The user already has the SYSMON authority.

The AUTH_LIST_AUTHORITIES_FOR_AUTHID indicated that the SYSMON group name was not being applied.

The SQL below is used by the DB2 installer to check if a named user has SYSMON or higher authorization or higher authorization. The DB2 Foglight cartridge cannot work with out minimum SYSMON authorization.

Run the following SQL statement in the DB2 instance after replacing USERNAME with the foglight account name.

select sum(case when d_group = 'Y' then 1 else 0 end) from  table(AUTH_LIST_AUTHORITIES_FOR_AUTHID(cast('USERNAME' as varchar(128)),'U'))
    where authority in ('SYSMON','SYSCTRL','SYSMAINT','SYSADM')

The result will be a 0 (zero) if user does not have the valid authorization or a number greater than 0 (zero) if the user has sufficient authorization.

In Windows, add the sysmon_group to the user instead of relying on just the active directory group.

The following query can also be used to confirm the userid membership in the SYSMON group. Replace the USERNAME value with the DB2 account used by Foglight. A "Y" in the D_GROUP column next  to either 'SYSMON','SYSCTRL','SYSMAINT','SYSADM' will confirm which group membership the user account has that is sufficient for monitoring. A "Y" in the D_PUBLIC group will confirm that the necessary Public group privileges are available for the user.

select substr(AUTHORITY,1,30) as Authority
    , D_GROUP
    , D_PUBLIC
from table(auth_list_authorities_for_authid('USERNAME','U'))

-------------

To grant SYSMON authority to a user

1. Create a user group on the operating system where the DB2 server is installed (for example, "DB2Users").
2. Create a user on the operating system (for example, "DB2ADMIN") and add this user to the group you just defined.
3. Open a DB2 command window and issue a command to grant the SYSMON privilege to the group created in Step 1.

    

   db2 update dbm cfg using sysmon_group <os_group>

   For example, to grant the SYSMON privilege to the DB2Users group in our example, issue the following command so that the users in the specified group are granted the proper authority to perform data collection.

   db2 update dbm cfg using sysmon_group DB2Users

   Then, restart the DB2 instance by issuing the following commands, one after another:

   db2stop force
   
   db2start
   
   
   

 

NOTE: All users are a member of the group PUBLIC and should be provided CONNECT and BINDADD privileges through membership of this group.