db2iupgrade / db2ckupgrade failure due to SQL0551N

db2iupgrade / db2ckupgrade failure due to SQL0551N

Troubleshooting

Problem

db2iupgrade or db2ckupgrade fail due to SQL0551 database authorization error.

SQL0551N The statement failed because the authorization ID does not have the required authorization or privilege to perform the operation. Authorization ID: "DB2INST2". Operation: "EXECUTE". Object: "SYSPROC.ENV_GET_REG_VARIABLES". SQLSTATE=42501

Symptom

When db2iupgrade is executed, it will run db2ckupgrade to ensure each of the databases belonging to the DB2 instance can be upgraded. The example log is from v10.5 to v11.1 upgrade and confirms SAMPLE1 can be upgraded successfully, but it fails for SAMPLE2 so db2iupgrade fails.

db2iupgrade log
Version of DB2CKUPGRADE being run: VERSION "11.1"
Database: "SAMPLE1"
DBT5542I The db2ckupgrade utility has successfully put the database in upgrade pending state.
DBT5537I The db2ckupgrade utility has completed processing for database "SAMPLE1".

Database: "SAMPLE2"
[IBM][CLI Driver][DB2/AIX64] SQL0551N The statement failed because the authorization ID does not have the required authorization or privilege to perform the operation. Authorization ID: "DB2INST2". Operation: "EXECUTE". Object: "SYSPROC.ENV_GET_REG_VARIABLES". SQLSTATE=42501

Cause

The instance owner does not have EXECUTE authority. Normally instance owner does not have DBADM authority if it was not the original creator of the database. This often occurs when restoring database to another system with a different instance user id.

SQL0551N The statement failed because the authorization ID does not have the required authorization or privilege to perform the operation. Authorization ID: "DB2INST2". Operation: "EXECUTE". Object: "SYSPROC.ENV_GET_REG_VARIABLES". SQLSTATE=42501

Resolving The Problem

In this example we grant DBADM to instance owner since there may be other routines (stored procedures / user defined functions) which require EXECUTE or DBADM authority. The alternative is to issue "GRANT EXECUTE ON ... TO USER DB2INST2" from a user with DBADM authority then re-issue db2iupgrade or db2ckupgrade to see if SQL0551 is returned for a different routine.

db2 "connect to SAMPLE2"

db2 "select grantor, grantee, dbadmauth from syscat.dbauth"

db2 "connect reset"

This will show the user id which has DBADM authority in the GRANTEE column.

Then login as user id with dbadm authority to grant instance id "DB2INST2"

db2 "connect to SAMPLE2 user <DBADM userid>"

db2 "grant dbadm on database to user DB2INST2"

db2 "connect reset"

 

Then see if SQL0551 has been resolved.

<New version being upgraded to>/bin/db2ckupgrade SAMPLE2

Notes

• Always run db2ckupgrade from the version to be upgraded to. For example when upgrading from v10.5 to v11.5, run db2ckupgrade from v11.5 installation directory.
• Ensure root account running db2iupgrade is not sourcing  environment variables like $PATH, $LIBPATH (AIX), $LD_LIBRARY_PATH (Linux) from <DB2 instance>/sqllib/db2profile. In some cases, users do this so that root user can start, stop DB2 instance. But this will cause problems with db2iupgrade, since the environment variables will point to old version of DB2 instead of new version.

• ------------------------------------------------------------------------------------------
  如果你觉得文章有用，欢迎打赏

•