Oracle® Database Vault

1.1 Prerequisite Check for Oracle Database Vault Installation Fails

Bug 11783587

When you install Oracle Database Vault on SUSE Linux Enterprise Server 11, the prerequisite check may fail with an error message.

The recommended workaround is to run the Oracle Universal Installer using the ignoreSysPrereqs flag which causes the installer to skip the operating system check and continue with the installation:

./runinstaller -ignoreSysPrereqs

As a side effect, the installer also skips other checks during the installation.

If you do not use the ignoreSysPrereqs flag, then you may see the following error messages:

INFO: Expected result: 
One of redhat-3,redhat-4,SuSE-9,asianux-1,asianux-2,redhat-5,SuSE-10
Actual Result: SuSE-11
Check complete. The overall result of this check is: Failed
 

The workaround is to click continue to ignore the error and proceed with the installation.

1.2 Prerequisite Check for Kernel Version Fails

Bug 11847748

If you do not use the ignoreSysPrereqs flag when you install the 10.2.0.5 patch set, then the prerequisite check to validate the kernel version might fail.

If your system has any one of the following kernel versions (or later), the workaround is to ignore the error message and proceed with the installation.

Red Hat Enterprise Linux 4.0:
2.6.9-11.EL

Red Hat Enterprise Linux 5.0:
2.6.18

SUSE Linux Enterprise Server 9:
2.6.5-7.191-pseries64

SUSE Linux Enterprise Server 10:
2.6.16

SUSE Linux Enterprise Server 11:
2.6.27

1.3 Oracle Database Vault Administrator Web Application Fails to Start

Bug 9587181

Oracle Database Vault Administrator (DVA) link does not work after an upgrade from Oracle Database Vault 10.2.0.4 to 10.2.0.5.

You can use the following workaround steps:

1. Set the ORACLE_HOME, ORACLE_SID, and PATH environment variables.

2. Stop the Oracle Enterprise Manager Database Control process. Use the following command:

   $ORACLE_HOME/bin/emctl stop dbconsole
   

3. Edit the file, $ORACLE_HOME/oc4j/j2ee/OC4J_DBConsole_hostname_SID/config/server.xml. Enter the following line just before the last line that reads, </application-server>:

   <application name="dva" path="$ORACLE_HOME/dv/jlib/dva_webapp.ear" auto-start="true" />
   

   For example:

   <application name="dva" path="/home/oracle/product/10.2.0/db1/dv/jlib/dva_webapp.ear" auto-start="true" />
   

4. Edit the file, $ORACLE_HOME/oc4j/j2ee/OC4J_DBConsole_hostname_SID/config/http-web-site.xml. Enter the following line just above the last line that reads, </web-site>:

   <web-app application="dva" name="dva_webapp" root="/dva" />
   

5. Start the Oracle Enterprise Manager Database Control process. Use the following command:

   $ORACLE_HOME/bin/emctl start dbconsole
   

1.4 Array Index Out of Bounds Error Message in DVCA Install Log

Bug 6912225

When you install Oracle Database Vault for a database you may notice an array index out of bounds error message in the DVCA install log. The DVCA install log may contain the following error messages:

java.lang.ArrayIndexOutOfBoundsException: -1
at java.util.Vector.elementAt(Unknown Source)
at
oracle.sysman.oii.oiif.oiifp.OiifpConfigTablePanel$DetailsTextArea.scrollToTo
l(OiifpConfigTablePanel.java:1869)
at
oracle.sysman.oii.oiif.oiifp.OiifpConfigTablePanel.showDetails(OiifpConfigTal
ePanel.java:1487)
at
oracle.sysman.oii.oiif.oiifp.OiifpConfigTablePanel.rowSelected(OiifpConfigTal
ePanel.java:1554)
        at oracle.ewt.grid.Grid.processRowSelectEvent(Unknown Source)
        at oracle.ewt.grid.Grid.processEventImpl(Unknown Source)
        at oracle.ewt.lwAWT.LWComponent.redispatchEvent(Unknown Source)
        at oracle.ewt.lwAWT.LWComponent.processEvent(Unknown Source)
        at oracle.ewt.grid.Grid.fireRowEvent(Unknown Source)
        at oracle.ewt.grid.SingleRowSelection.setRowSelected(Unknown Source)
        at oracle.ewt.grid.SingleRowSelection.setCellSelected(Unknown Source)
        at oracle.ewt.grid.Grid.processNewFocusCell(Unknown Source)
        at oracle.ewt.grid.Grid._sendKeyToNavigator(Unknown Source)
        at oracle.ewt.grid.Grid._handleKeyPressed(Unknown Source)
        at oracle.ewt.grid.Grid.processKeyEvent(Unknown Source)
        at java.awt.Component.processEvent(Unknown Source)
        at java.awt.Container.processEvent(Unknown Source)
        at oracle.ewt.lwAWT.LWComponent.processEventImpl(Unknown Source)
        at oracle.ewt.grid.Grid.processEventImpl(Unknown Source)
        at oracle.ewt.lwAWT.LWComponent.redispatchEvent(Unknown Source)
        at oracle.ewt.lwAWT.LWComponent.processEvent(Unknown Source)
        at java.awt.Component.dispatchEventImpl(Unknown Source)
        at java.awt.Container.dispatchEventImpl(Unknown Source)
        at java.awt.Component.dispatchEvent(Unknown Source)
        at java.awt.KeyboardFocusManager.redispatchEvent(Unknown Source)
        at java.awt.DefaultKeyboardFocusManager.dispatchKeyEvent(Unknown
Source)
        at java.awt.DefaultKeyboardFocusManager.preDispatchKeyEvent(Unknown
Source)
        at java.awt.DefaultKeyboardFocusManager.typeAheadAssertions(Unknown
Source)
        at java.awt.DefaultKeyboardFocusManager.dispatchEvent(Unknown Source)
        at java.awt.Component.dispatchEventImpl(Unknown Source)
        at java.awt.Container.dispatchEventImpl(Unknown Source)
        at java.awt.Window.dispatchEventImpl(Unknown Source)
        at java.awt.Component.dispatchEvent(Unknown Source)
        at java.awt.EventQueue.dispatchEvent(Unknown Source)
        at java.awt.EventDispatchThread.pumpOneEventForHierarchy(Unknown
Source)
        at java.awt.EventDispatchThread.pumpEventsForHierarchy(Unknown
Source)
        at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
        at java.awt.EventDispatchThread.pumpEvents(Unknown Source)
        at java.awt.EventDispatchThread.run(Unknown Source) 

You can safely ignore this error as it does not affect either the database or Oracle Database Vault functionality.

1.5 Cannot Install Oracle Database Vault in a Data Guard Environment

Bug 5577503

The Oracle Database Vault installer fails to install Oracle Database Vault in an existing physical standby database.

You can create a new physical standby database by using the following steps:

1. Install Oracle Database Vault on the primary database.

2. Create a physical standby database using a hot backup of the primary database. This backup should include the Oracle home.

3. Set up communications between the primary and the physical standby database. Redo logs communicate changes from the primary database to the standby database.

1.6 Oracle Enterprise Manager Does Not Start Automatically

Bug 5613521

After installing Oracle Database Vault on a database, and running the postinstallation steps on the nodes, you get an error when trying to access Oracle Enterprise Manager.

Also, when you try to check the status of dbconsole using the emctl status dbconsole command, you get a message saying that Oracle Enterprise Manager daemon is not running even though the process is running.

The workaround is to manually restart the dbconsole process using the following commands:

$ORACLE_HOME/bin/emctl stop dbconsole
$ORACLE_HOME/bin/emctl start dbconsole

1.7 Unable to Log In to Oracle Enterprise Manager As the SYS User After Oracle Database Vault Installation

Bug 6630108

The SYS user cannot log in to Oracle Enterprise Manager after installing Oracle Database Vault on an Oracle database. The following error is encountered:

ORA-01031: insufficient privileges

You must regenerate the password file, using the orapwd utility, to reenable the SYS user to connect as SYSDBA. Use the following syntax to enable SYSDBA logins:

orapwd file=password_filename password=password [entries=users] force=y nosysdba=n

1.8 Database Instance and Listener Do Not Start Automatically on the Remote Node After Oracle Database Vault Installation

Bug 6630191

After you install Oracle Database Vault, the database instances and listeners on the remote nodes do not start automatically. You must start these manually.

This is expected behavior. The DVCA utility configures the local node, and starts the database instance and listener processes on the local node. You must start these processes manually on each of the remote nodes.

1.9 Cloned Oracle Database Vault Home Contains Invalid Objects

Bug 6658315

The following steps are used to create a cloned Oracle Database Vault instance:

1. Install Oracle Database Vault 10g Release 2 (10.2.0.5) in the first Oracle home.

2. Clone the first instance to create a second Oracle home.

3. Run Net Configuration Assistant (NetCA) and Oracle Database Configuration Assistant (DBCA) to configure a listener and database for the cloned instance.

4. Run DBCA again to configure Oracle Label Security (OLS) for the cloned instance.

5. Run Oracle Database Vault Configuration Assistant (DVCA) as follows:

   $ORACLE_HOME/bin/dvca -action option -oh oracle_home
   -jdbc_str jdbc_connection_string -sys_passwd SYS_password -owner_account
   DV_owner_account_name -owner_passwd DV_owner_account_password 
   -acctmgr_account DV_account_manager_account_name -acctmgr_passwd
   DV_account_manager_password -logfile ./dvca.log -nodecrypt
   

The following SQL statement shows that the cloned Oracle Database Vault instance contains invalid objects:

SQL> select count(*) from all_objects where status = 'INVALID';
 
  COUNT(*)
----------
        45 

The workaround is to run the utlrp.sql script. This script recompiles all PL/SQL modules that might be in an invalid state, including packages, procedures, and types. Use the following commands to run the utlrp.sql script:

cd $ORACLE_HOME/rdbms/admin
sqlplus SYS "AS SYSDBA"
Enter password:
SQL> @utlrp.sql

1.10 Error Occurs When Oracle Database Vault Security Is Configured on a Remote Node

Bug 6140164

After you add a second node to a single-node Oracle Real Application Clusters (Oracle RAC) installation, the following error occurs when you try to configure Oracle Database Vault security for the second node:

ORA-32001: write SPFILE requested but no SPFILE specified at startup

The following steps reproduce the bug:

1. Install Oracle Clusterware on a 2-node cluster.

2. Install Oracle Database Vault on the first node.

3. Run the addnode.sh script on the first node to add the second node.

4. Configure the database listener and database instance for the second node.

5. Run the following ALTER SYSTEM statements on the second node:

   ALTER SYSTEM SET AUDIT_SYS_OPERATIONS=TRUE SCOPE=SPFILE;
   ALTER SYSTEM SET OS_ROLES=FALSE SCOPE=SPFILE;
   ALTER SYSTEM SET RECYCLEBIN='OFF' SCOPE=SPFILE;
   ALTER SYSTEM SET REMOTE_LOGIN_PASSWORDFILE='EXCLUSIVE' SCOPE=SPFILE;
   ALTER SYSTEM SET SQL92_SECURITY=TRUE SCOPE=SPFILE;
   ALTER SYSTEM SET OS_AUTHENT_PREFIX='' SCOPE=SPFILE;
   

The workaround is to run the following steps before running the addnode.sh script in Step 3:

1. Shut down the database.

   $ORACLE_HOME/bin/srvctl stop database -d db_name
   

2. Start the database with the nomount option.

   $ORACLE_HOME/bin/srvctl start database -d db_name -o nomount
   

3. Connect to the database AS SYSDBA.

   sqlplus SYS "AS SYSDBA"
   Enter password:
   

4. Create a server parameter file (SPFILE) using the traditional initialization parameter file (PFILE). The initialization parameter file is usually located at $ORACLE_HOME/admin/db_name/pfile for Optimal Flexible Architecture compliant databases.

   For example:

   SQL> CREATE SPFILE='SHARED_LOCATION/spfileORACLE_SID.ora'
        FROM 'PFILE=ORACLE_HOME/admin/db_name/pfile/initORACLE_SID.ora'
   

   This statement reads the text initialization parameter file to create a server parameter file. You must have the or SYSOPER system privilege to run the CREATE SPFILE statement.

5. Shut down the database.

   $ORACLE_HOME/bin/srvctl stop database -d db_name
   

6. Clear the current contents of the initialization parameter file. Add the server parameter file location in the initialization parameter file:

   SPFILE = 'SHARED_LOCATION/spfileORACLE_SID.ora'
   

7. Restart the database.

   For example:

   $ORACLE_HOME/bin/srvctl start database -d db_name
   

1.11 Swap Space Requirement Prerequisite Test Fails

Bug 7506215

Oracle Database Vault installer swap space requirement test may fail in some cases even when enough swap space is available.

The swap space required for installation should not exceed 16 GB. In case the required swap space is shown as more than 16 GB, this warning can be safely ignored.

1.12 Errors Generated by catmac.sql When Upgrading Oracle Database Vault

Bug 9888841

Oracle Database Vault Installation Guide includes instructions to upgrade a previous version of Oracle Database Vault to Oracle Database Vault 10.2.0.5. One of the upgrade steps requires the user to run the catmac.sql script. Oracle Database Vault installation guide advises the user to spool the output of this script into a file to look for errors.

The spooled output file may include the following errors:

ORA-01920: user name 'DVSYS' conflicts with another user or role name
ORA-01920: user name 'DVF' conflicts with another user or role name
SP2-0310: unable to open file catmaca.sql
ORA-01952: system privileges not granted to 'DBA'
ORA-00955: name is already used by an existing object
ORA-02260: table can have only one primary key

You can safely ignore these error messages.

1.13 DVCA Error During Oracle Database Vault Installation

Bug 10033496

An ORA-01031: insufficient privileges error may be generated during the Lock DVSYS phase of Oracle Database Vault installation process. This may be caused by a low shared pool size.

The workaround is to increase the shared pool size to a larger value. To set the shared pool size, use the following SQL statement:

ALTER SYSTEM SET SHARED_POOL_SIZE=VALUE;

2.1 Accounts with DV_OWNER, DV_ADMIN, or DV_SECANALYST Role Cannot Use the ALTER USER Command

Bug 5161953

Accounts with the DV_OWNER, DV_ADMIN, or DV_SECANALYST role cannot run the following command:

ALTER USER user QUOTA UNLIMITED ON tablespace

The workaround is to REVOKE the role from the account, run the ALTER USER command, and then GRANT back the role to the account. This works if the account is not the DV_OWNER account that was created during installation. If the account is the DV_OWNER account created during installation, then you must use the following steps:

1. Disable Oracle Database Vault command rule for the ALTER USER command.

2. Run the ALTER USER command.

3. Re-enable Oracle Database Vault command rule for the ALTER USER command.

2.2 CREATE SESSION Privilege Is Controlled by the Data Dictionary Realm

Use the following steps to grant the CREATE SESSION privilege:

1. Temporarily disable the data dictionary realm.

2. Log in as the SYSTEM user.

3. Grant the CREATE SESSION privilege.

4. Enable the data dictionary realm.

4.1 Snapshots and Materialized Views

The keyword SNAPSHOT is supported in place of MATERIALIZED VIEW for backward compatibility.

4.2 JOB_QUEUE_PROCESSES Initialization Parameter

The JOB_QUEUE_PROCESSES initialization parameter specifies the maximum number of processes that can be created for the execution of jobs. It specifies the number of job queue processes per instance.

This parameter must have a non-zero value. The default value for JOB_QUEUE_PROCESSES is 10.