Oracle® Database Vault

1.1 DVCA Fails If the SID Is Longer than 8 Characters

Bug 5258820

Running Database Vault Configuration Assistant (DVCA) manually, after creating a new database in the Database Vault home, fails if the Oracle System Identifier (SID) for the database is longer than 8 characters.

The following steps reproduce the bug:

1. Use Database Configuration Assistant (DBCA) to create a new database in an existing Database Vault home.

2. Run DVCA on the newly created database:

   C:\> ORACLE_HOME\bin\dvca -action option -oh oracle_home -jdbc_str jdbc_connection_string -sys_passwd SYS_password -owner_account DV_owner_account_name -owner_passwd DV_owner_account_password [-acctmgr_account DV_account_manager_account_name] [-acctmgr_passwd DV_account_manager_password] [-logfile ./dvca.log] [-silent] [-nodecrypt][-lockout] [-languages {["en"],["de"],["es"],["fr"],["it"],["ja"],["ko"],["pt_BR"],["zh_CN"],["zh_TW"]}]
   

The reason for the bug is that the Oracle Net service name in the tnsnames.ora (ORACLE_HOME\network\admin\tnsnames.ora) file is truncated to 8 characters.

The workaround for the bug is to change the truncated Net service name in the tnsnames.ora file to it's correct value. For example, say the SID for the database is ORACLEDB90, and the entry in tnsnames.ora appears as:

ORACLEDB = (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST ....

Replace the truncated entry in the tnsnames.ora file with the correct entry:

ORACLEDB90 = (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST ....

1.2 DVCA Fails to Deploy the Database Vault Administrator Web Application

Bug 5617850

DVCA fails to deploy the Database Vault Administrator application during the DEPLOY_DVA step. DVCA shows the following error:

Error executing task 
DEPLOY_DVA:java.io.FileNotFoundException: 
D:\ORACLE\PRODUCT\10.2.0\DB_1\oc4j\j2ee\OC4J_DBConsole_wptgjqa07_ORCL\config\server.xml (Specified PATH not found)

You can use the following workaround steps:

1. Set the ORACLE_HOME, ORACLE_SID, and PATH environment variables.

2. Stop the Enterprise Manager Database Control process. Use the following command:

   C:\> ORACLE_HOME\bin\emctl stop dbconsole
   

3. Edit the file, ORACLE_HOME\oc4j\j2ee\OC4J_DBConsole_hostname_SID\config\server.xml. Enter the following line just before the last line that reads, </application-server>:

   <application name="dva" path="ORACLE_HOME\dv\jlib\dva_webapp.ear" auto-start="true" />
   

   For example:

   <application name="dva" path="C:\oracle\product\10.2.0\db1\dv\jlib\dva_webapp.ear" auto-start="true" />
   

4. Edit the file, ORACLE_HOME\oc4j\j2ee\OC4J_DBConsole_hostname_SID\config\http-web-site.xml. Enter the following line just above the last line that reads, </web-site>:

   <web-app application="dva" name="dva_webapp" root="/dva" />
   

5. Start the Enterprise Manager Database Control process. Use the following command:

   C:\> ORACLE_HOME\bin\emctl start dbconsole
   

1.3 Cannot Install Oracle Database Vault in a Data Guard Environment

Bug 5577503

The Database Vault installer fails to install Database Vault in an existing physical standby database.

You can create a new physical standby database by using the following steps:

1. Install Database Vault on the primary database.

2. Create a physical standby database using a hot backup of the primary database. This backup should include the Oracle home.

3. Set up communications between the primary and the physical standby database. Redo logs communicate changes from the primary database to the standby database.

1.4 Enterprise Manager Does Not Start Automatically

Bug 5623404

Enterprise Manager does not start automatically after installing Database Vault.

The workaround is to restart the process manually using the following commands:

C:\> ORACLE_HOME\bin\emctl stop dbconsole
C:\> ORACLE_HOME\bin\emctl start dbconsole

1.5 Enterprise Manager Does Not Start Automatically on the Remote Nodes

Bug 5654876

After installing Database Vault on a Real Applications Cluster (RAC) database, and running the dvca -action optionrac command on the remote nodes, Enterprise Manager does not start automatically on the remote nodes.

The workaround is to set the correct value for the ORACLE_SID variable in the ORACLE_HOME\bin\dvca.bat file on the remote node. The ORACLE_SID variable needs to be changed from the local node SID to the remote node SID on the remote node. You can then run DVCA on the remote node.

Alternatively, you can manually restart the dbconsole process using the following commands:

C:\> ORACLE_HOME\bin\emctl stop dbconsole
C:\> ORACLE_HOME\bin\emctl start dbconsole

1.6 Unable to Log In to Enterprise Manager As the SYS User After Database Vault Installation

Bug 6630108

The SYS user is unable to log in to Enterprise Manager after installing Database Vault on an Oracle database. The following error is encountered:

ORA-01031: insufficient privileges

You need to regenerate the password file, using the orapwd utility, to reenable the SYS user to connect as SYSDBA. Use the following syntax to enable SYSDBA logins:

C:\> ORACLE_HOME\bin\orapwd file=password_filename password=password [entries=users] force=y nosysdba=n

1.7 Database Instance and Listener Do Not Start Automatically on the Remote Node After Database Vault Installation

Bug 6630191

After you install Database Vault, the database instances and listeners on the remote nodes do not start automatically. You must start these manually.

This is expected behavior. The DVCA utility configures the local node, and starts the database instance and listener processes on the local node. You need to start these processes manually on each of the remote nodes.

1.8 Error When Installing Database Vault for a Database That Does Not Have Enterprise Manager Configured

Bugs 6640232 and 6640203

When you install Database Vault for a database that does not have Enterprise Manager configured, you may notice error messages in the DVCA install log. The DVCA install log may contain the following error messages:

DVCA_ERROR:java.io.IOException: java.io.IOException:
...
Error executing task DEPLOY_DVA:java.io.IOException:
...

You may also see error files containing the following errors:

java.lang.NullPointerException
        at javax.swing.LayoutComparator.compare(Unknown Source)
        at java.util.Collections.indexedBinarySearch(Unknown Source)
        at java.util.Collections.binarySearch(Unknown Source)
        at javax.swing.SortingFocusTraversalPolicy.getComponentAfter(UnknownSource)
        at javax.swing.LayoutFocusTraversalPolicy.getComponentAfter(UnknownSource)
        at java.awt.Component.nextFocusHelper(Unknown Source)
        at java.awt.Container.nextFocusHelper(Unknown Source)
        at java.awt.Component.nextFocus(Unknown Source)
        at java.awt.Component.transferFocus(Unknown Source)
        at oracle.ewt.lwAWT.LWComponent.processFocusEvent(Unknown Source)
        at oracle.ewt.lwAWT.AbstractButton.processFocusEvent(Unknown Source)
        at oracle.ewt.button.PushButton.processFocusEvent(Unknown Source)
        at java.awt.Component.processEvent(Unknown Source)
        at java.awt.Container.processEvent(Unknown Source)
        at oracle.ewt.lwAWT.LWComponent.processEventImpl(Unknown Source)
        at oracle.ewt.button.PushButton.processEventImpl(Unknown Source)
        at oracle.ewt.lwAWT.LWComponent.redispatchEvent(Unknown Source)
        at oracle.ewt.lwAWT.LWComponent.processEvent(Unknown Source)
        at java.awt.Component.dispatchEventImpl(Unknown Source)
        at java.awt.Container.dispatchEventImpl(Unknown Source)

You can safely ignore these errors if you do not wish to deploy Enterprise Manager and Database Vault Administrator (DVA) for your Database Vault instance.

1.9 Cloned Database Vault Home Contains Invalid Objects

Bug 6658315 and 6729227

Invalid objects are seen in a cloned Database Vault instance. Invalid objects are also seen when you install Database Vault over a custom database.

The following steps are used to create a cloned Database Vault instance:

1. Install Oracle Database Vault 10g Release 2 (10.2.0.4) in the first Oracle home.

2. Clone the first instance to create a second Oracle home.

3. Run Net Configuration Assistant (NetCA) and Database Configuration Assistant (DBCA) to configure a listener and database for the cloned instance.

4. Run DBCA again to configure Oracle Label Security (OLS) for the cloned instance.

5. Run Database Vault Configuration Assistant (DVCA) as follows:

   C:\> ORACLE_HOME\bin\dvca -action option -oh oracle_home
   -jdbc_str jdbc_connection_string -sys_passwd SYS_password -owner_account
   DV_owner_account_name -owner_passwd DV_owner_account_password 
   -acctmgr_account DV_account_manager_account_name -acctmgr_passwd
   DV_account_manager_password -logfile .\dvca.log -nodecrypt
   

The following SQL statement shows that the cloned Database Vault instance contains invalid objects:

SQL> select count(*) from all_objects where status = 'INVALID';
 
  COUNT(*)
----------
        45 

The workaround is to run the utlrp.sql script. This script recompiles all PL/SQL modules that might be in an invalid state, including packages, procedures, and types. Use the following commands to run the utlrp.sql script:

sqlplus SYS "AS SYSDBA"
Enter password:
SQL> @?\rdbms\admin\utlrp.sql

1.10 Incorrect Installer Warning for Non-English Locales

Bug 6645805

The Database Vault installer displays the following warning for non-English locales after you select the details in the Specify Installation Details screen:

Note that OS authentication will be turned off for all databases in the
selected Oracle Home. It is recommended that Oracle Database Vault be
installed into an Oracle Home with only one database in it.

Operating system (OS) authentication is not turned off after you install Oracle Database Vault 10g Release 2 (10.2.0.4). However, the recommendation to install Oracle Database Vault in it's own Oracle home still holds true.

1.11 Error Log Created After Database Vault Installation

Bug 6692032

After you install Database Vault for an Oracle database that has Enterprise Manager configured, an error file containing the following error gets generated:

load(error):java.sql.SQLException: ORA-12541: TNS:no listener

You can safely ignore this error.

1.12 Additional Steps Required When Cloning an Oracle Real Application Clusters Node

After creating a cloned RAC node, and before running DVCA (dvca -action option) manually on the cloned node, you need to set the correct values for the ORACLE_HOME and ORACLE_SID variables in the ORACLE_HOME\bin\dvca.bat file on the cloned node.

If you are using the lockout option with the dvca command, then to successfully lockout SYSDBA connections, you also need to add the following values to your Microsoft Windows registry under HKEY_LOCAL_MACHINE\SOFTWARE\ORACLE\KEY_ORACLE_HOME_NAME:

1.13 Incorrect Registry Entry on Remote Node

Bug 5663098

When installing Database Vault for a RAC database, the following registry entry needs to be corrected on the remote node before running DVCA (dvca -action optionrac) on the remote node:

HKEY_LOCAL_MACHINE\SOFTWARE\ORACLE\KEY_ORACLE_HOME_NAME\ORA_instance_name_PWFILE

The instance_name in the remote node registry should be the database instance name for the remote node, and not the database instance name for the local node.

The value for this key should be the complete path to the password file on the remote node. For example:

C:\ORACLE\PRODUCT\10.2.0\DB_1\dbs\orapwORCL2

1.14 iSQL*Plus Error Encountered When DVCA Is Run

Bug 6743410

When you run Database Vault Configuration Assistant (DVCA) with the action -option switch after adding a new database into an existing Database Vault home on Windows Vista, iSQL*Plus service related errors are generated.

You can safely ignore these error messages. Alternatively, turn off the iSQL*Plus related Windows Service (OracleOracleHomeNameiSQL*Plus) before running the dvca command.

1.15 Database Vault Installer Does Not Report DVCA Error

Bug 6675866

The Database Vault installer incorrectly reports a successful installation, even if the Database Vault Configuration Assistant (DVCA) fails to run successfully.

The workaround is to check the installation log files, ORACLE_HOME\cfgtoollogs\dvca_install.log and ORACLE_HOME\cfgtoollogs\oui\installActionsInstallDate.log, for any possible errors.

1.16 DVCA Log Files Show Errors After Database Vault Upgrade

Bug 6742694

When upgrading from Oracle Database Vault 10g Release 2 (10.2.0.3) to Oracle Database Vault 10g Release 2 (10.2.0.4), you need to run the Database Vault Configuration Assistant (DVCA) to reconfigure Database Vault. You might see the following error in the DVCA log file:

Executing task ACCOUNT_CREATE_OWNER
01/10/08 06:37:06 Error executing task
ACCOUNT_CREATE_OWNER:java.sql.SQLException: ORA-01920: user name 'MACSYS'
conflicts with another user or role name
01/10/08 06:37:06 Executing task GRANT_CONNECT_OWNER
*******
01/10/08 06:37:06 Executing task ACCOUNT_CREATE_MANAGER
01/10/08 06:37:06 Error executing task
ACCOUNT_CREATE_MANAGER:java.sql.SQLException: ORA-01920: user name 'MACAUTH'
conflicts with another user or role name
01/10/08 06:37:06 Executing task GRANT_CONNECT_MANAGER

These errors can be safely ignored.

2.1 Accounts with DV_OWNER, DV_ADMIN, or DV_SECANALYST Role Cannot Use the ALTER USER Command

Bug 5161953

Accounts with the DV_OWNER, DV_ADMIN, or DV_SECANALYST role cannot run the following command:

ALTER USER user QUOTA UNLIMITED ON tablespace

The workaround is to REVOKE the role from the account, run the ALTER USER command, and then GRANT back the role to the account. This works if the account is not the DV_OWNER account that was created during installation. If the account is the DV_OWNER account created during installation, then you would need to use the following steps:

1. Disable the Database Vault command rule for the ALTER USER command.

2. Run the ALTER USER command.

3. Re-enable the Database Vault command rule for the ALTER USER command.

2.2 Command Rule SELECT Not Found for SYSADM.%

Bug 5508407

The following error is displayed when you try to update the owner or the rule set for the SELECT command rule:

Command Rule SELECT not found for schema.%

After the update has failed, you are not allowed to delete the command rule. You can use the following workaround steps:

1. Login to SQL*Plus using the SYSTEM account. Run the following command:

   SQL>ALTER SYSTEM FLUSH SHARED_POOL;
   

2. Delete the command rule.

3. If you were trying to update the command rule, then re-create the command rule with the new parameters.

4. Repeat Step 1 for the new command rule to take effect.

2.3 CREATE SESSION Privilege Is Controlled by the Data Dictionary Realm

Use the following steps to grant the CREATE SESSION privilege:

1. Temporarily disable the data dictionary realm.

2. Log in as the SYSTEM user.

3. Grant the CREATE SESSION privilege.

4. Enable the data dictionary realm.

2.4 Incorrect Version and Copyright Information for Non-English Locales

Bug 6660620

The Database Vault Administrator (DVA) application displays incorrect version and copyright year information in the About Oracle Database Vault Administrator page, for non-English locales. The version numbers for Database Vault and Oracle Database are erroneously mentioned as 10.2.0.3.0. The correct version numbers should be as follows:

• Oracle Database Vault Administrator: 10.2.0.4.0

• Supported Target Databases: 10.2.0.4.0

The copyright year is incorrectly mentioned as follows:

Copyright © 1996,2006, Oracle. All rights reserved.

This should be:

Copyright © 1996, 2008, Oracle. All rights reserved.

5.1 Snapshots and Materialized Views

The keyword SNAPSHOT is supported in place of MATERIALIZED VIEW for backward compatibility.

5.2 JOB_QUEUE_PROCESSES Initialization Parameter

The JOB_QUEUE_PROCESSES initialization parameter specifies the maximum number of processes that can be created for the execution of jobs. It specifies the number of job queue processes per instance.

This parameter must have a non-zero value. The default value for JOB_QUEUE_PROCESSES is 10.