The business requirements to be able to get hands on clones of production databases are nowadays countless:

• developer agility (needing separate and isolated databases),
• production-like shared environment providing same model and code but with a smaller footprint,
• test databases for software update testing,
• data sharing,
• point-in-time reporting, what-if scenario modeling or data audit.

For environments with big databases (tens of terabytes and more), Exascale is very well suited to do the job, with the following main features and advantages:

• source database flexibility: you can now clone read-write and read-only 23/26ai databases, at the PDB and CDB level
• no upstream dependencies: unlike ASM, Exascale no longer requires a test-master read-only copy
• storage reclamation is automatically performed by Exascale for extents no longer referenced by a file
• redirect-on-write techniques enable quick clone creation and maintenance with unprecedented space efficiency
• and last but not least, clone/snapshot is independent of source, which can be dropped without impacting clone

Before going through the details on how to make clones and snapshots, let’s remind what clones and snapshots are.

Snapshot

A snapshot is a read-only point-in-time copy of a file. Possible sources for snapshot creation are regular files, clones or another snapshot.

Clone

A clone is a read-write point-in-time copy of a file, possibly created from a regular file, another clone or a snapshot.

There are actually two types of clones: thin (space efficient) or full (byte-for-byte copy of source).

Cloning implicitly creates snapshots.

How do we create clones or snapshots of PDBs ?

This is where database kernel and Exascale integration really shines: physical storage operations are encapsulated in single SQL commands, thus there is no need to learn new tricky commands and clauses to leverage Exascale cloning and snapshoting capabilities. You use SQL commands you are already familiar with:

CREATE|ALTER PLUGGABLE DATABASE

Creating PDB snapshots

To create a read-only point-in-time reference to a PDB, use:

ALTER PLUGGABLE DATABASE pdb_name SNAPSHOT pdb_snapshot_name;

Remember that snapshots are inconsistent by default (which precisely makes quick creation possible); so cloning a snapshot triggers recovery based on redo data before the new clone can be opened read-write. Thus, required redo data has to be retained or restored from backup.

The DBA_PDB_SNAPSHOTS dictionary view is available to display snapshots information.

Creating PDB thin clones

A PDB thin clone is a space-efficient clone of an existing PDB. You need to use the SNAPSHOT COPY clause like in the following syntax:

CREATE PLUGGABLE DATABASE pdb_name FROM source_pdb_name SNAPSHOT COPY;

Thin cloning a PDB

CREATE PLUGGABLE DATABASE thin_clone_pdb_name FROM source_pdb_name SNAPSHOT COPY;
ALTER PLUGGABLE DATABASE thin_clone_pdb_name OPEN INSTANCES=ALL;

Thin cloning a PDB snapshot

CREATE PLUGGABLE DATABASE thin_clone_pdb_name FROM source_pdb_name USING SNAPSHOT pdb_snapshot_name SNAPSHOT COPY;
ALTER PLUGGABLE DATABASE thin_clone_pdb_name OPEN INSTANCES=ALL;

Creating PDB full clones

As already mentioned, a full clone is a byte-for-byte copy of an existing PDB and therefore takes the same storage space than source PDB. The command to be used is a simple:

CREATE PLUGGABLE DATABASE … FROM …

The missing SNAPSHOT COPY clause directs the database to create a complete block-for-block copy of the PDB.

CREATE PLUGGABLE DATABASE full_clone_pdb_name FROM source_pdb_name;
ALTER PLUGGABLE DATABASE full_clone_pdb_name OPEN INSTANCES=ALL;

Existing snapshots or thin clones can also be referenced as a source in the preceding commands.

What about cloning an entire container database ?

Space-efficient clones of an entire container database are possible thanks to the powerful gDBClone utility written by Ruggero Citton, to whom we owe other great utilities ODABR (consistent and incremental backup and restore for Oracle Database Appliance nodes), KVMBR (backup and restore of KVM domains) or more recently DSCM & DSCMREST (deployment of Oracle database containers with efficient storage snapshots).

The gDBClone utility enables:

• End-to-end thin and full cloning of a CDB with all its PDB
• File clone operations
• RMAN calls to make cloned files consistent
• Instance related files (such as password, spfile or TDE wallet files) creation
• GI registration

Here are some simple examples to respectively thin clone and full clone an entire CDB:

gDBClone.bin snap –sdbname source_db_name –tdbname target_db_name

gDBClone.bin clone –sdbname source_db_name –tdbname target_db_name

More on this powerful tool in Exascale documentation and Oracle Support KB145187 article.

Performance

Thin cloning a 2.4 TB PDB takes less than 12 seconds while opening the new thin clone on a two instances cluster database takes another 11 seconds, for a total elapsed time of the entire operation under 30 seconds !!!

Additional details can be found in this Alex Blyth blog post.

Conclusion

By leveraging state-of-the-art redirect-on-write technologies, Exascale is a leap forward and game changing technology when it comes to clone and snapshot features and capabilities. It is CI/CD friendly and the ideal tool to address the business requirements for test and qualification environments by letting DBAs provide very quickly space efficient copies of production or standby databases or PDBs.

Give it a try to be definitely convinced.

L’article Exascale new clone and snapshot capabilities est apparu en premier sur dbi Blog.

Setting up oci-cli

If you are already connected to your OCI tenancy with the command line, you can skip this part. Otherwise, let’s begin.

The first step is to install and configure the oci-cli utility. The full list of installation steps is available in the documentation and depends on the platform from which you want to administer OCI.

On macOS, just run this command:

brew install oci-cli

Some Linux distributions (like OEL 7 or 8) come with the utility already installed. Otherwise, you can run the following command.

bash -c "$(curl -L https://raw.githubusercontent.com/oracle/oci-cli/master/scripts/install/install.sh)"

Once this is installed, you need the connection information from your OCI account. You can finish the setup either by running the oci setup config command, which will ask for all the information needed, or by doing the following if you are not sure about the information required.

• Log in the OCI interface, and go in your Profile > User settings

• In the User settings tab, click on Tokens and keys, and Add API key

• Here, you have the option to generate a new key pair or to register an existing public key. Make sure to save the private key if you generate a new pair.

• After clicking on Add key, OCI will provide a configuration file that you can use.

• Edit this configuration file with the location of your private key and place it at ~/.oci/config

> cat ~/.oci/config
[DEFAULT]
user=<user_ocid>
fingerprint=<fingerprint>
tenancy=<tenancy_ocid>
region=<your_region>
key_file=/path/to/private_key.pem

And that’s it ! To test the connection, run the oci iam region list command. It should return a JSON document containing all the available regions.

> oci iam region list
{
  "data": [
    {
      "key": "AMS",
      "name": "eu-amsterdam-1"
    },
    ...
    {
      "key": "ZRH",
      "name": "eu-zurich-1"
    }
  ]
}

Creating your first VM with the oci CLI

An OCI virtual machine is always created within a specific set of cloud components, for which you will have to retrieve the OCIDs.

• Compartment: it can be the root compartment or any other compartment, but the user defined in the .oci/config file should have access to it
• Availability domain: depending on your OCI setup, you will have access to specific availability domains. We’ll see how to retrieve the correct one.
• Subnet: public subnet in which the VM will be available.
• Shape: shape of the VM.
• Image: the OS image used to create the VM.

Retrieve your compartment OCID

For the compartment, you can retrieve the list of all compartments with the following command:

> oci iam compartment list --all
{
  "data": [
    {
      "compartment-id": "compartment_ocid",
      "defined-tags": {
        "Oracle-Tags": {
          "CreatedBy": "...",
          "CreatedOn": "..."
        }
      },
      "id": "compartment_ocid",
      "inactive-status": null,
      "is-accessible": null,
      "lifecycle-state": "ACTIVE",
      "name": "compartment_name",
      "time-created": "..."
    },
    ...
}

If you know the name of the compartment you want to retrieve, you can get the OCID with this command. Just replace the compartment_name.

> oci iam compartment list --compartment-id-in-subtree true --all --query "data[?name=='compartment_name'].id" --raw-output
[
  "ocid.compartment..."
]

Choose an availability domain

If you don’t know it already, you can easily retrieve the availability domains available with the compartment OCID.

> oci iam availability-domain list --compartment-id ocid1.compartment.oc1... --query 'data[].name' --raw-output
[
  "AlWD:EU-ZURICH-1-AD-1"
]

Retrieve the subnet OCID

In a basic configuration, you should use the OCID of the only public subnet available. Let’s display the subnet names and OCID to help you choose the correct one.

> oci network subnet list --compartment-id ocid1.compartment.oc1... --query "data[].{name:\"display-name\", ocid:id}" --output table
+--------------------+---------------------+
| name               | ocid                |
+--------------------+---------------------+
| private subnet-vcn | ocid1.subnet.oc1... |
| public subnet-vcn  | ocid1.subnet.oc1... |
+--------------------+---------------------+

Select the desired shape

You can list the available shapes with the oci compute shape list command. Because it contains a lot of useless information for us, we will filter it. Below is a display of all available shapes and whether they are resizable. Indeed, some shapes cannot be resized and come with specific CPU/memory settings.

> oci compute shape list --compartment-id ocid1.compartment.oc1... --query  "data[].{name:shape,resizable:\"is-flexible\"}" --output table
+------------------------+-----------+
| name                   | resizable |
+------------------------+-----------+
| BM.Standard.E5.192     | False     |
| BM.Standard.A1.160     | False     |
| BM.Standard3.64        | False     |
| BM.Standard2.52        | False     |
| BM.Optimized3.36       | False     |
| BM.Standard.E4.128     | False     |
| BM.Standard.E3.128     | False     |
| BM.Standard.E2.64      | False     |
| BM.DenseIO2.52         | False     |
| VM.Optimized3.Flex     | True      |
| VM.Standard.E4.Flex    | True      |
| VM.Standard.E3.Flex    | True      |
| VM.Standard.A1.Flex    | True      |
| VM.Standard2.1         | False     |
| VM.Standard2.2         | False     |
| VM.Standard2.4         | False     |
| VM.Standard2.8         | False     |
| VM.Standard2.16        | False     |
| VM.Standard2.24        | False     |
| VM.Standard.E2.1       | False     |
| VM.Standard.E2.2       | False     |
| VM.Standard.E2.4       | False     |
| VM.Standard.E2.8       | False     |
| VM.Standard.E2.1.Micro | False     |
| VM.Standard3.Flex      | True      |
| VM.DenseIO2.8          | False     |
| VM.DenseIO2.16         | False     |
| VM.DenseIO2.24         | False     |
| VM.Standard.E5.Flex    | True      |
+------------------------+-----------+

Choose a specific image

Use the oci compute image list command to retrieve the available images inside your compartment. You might already have a name shape in mind, so just find the one you are interested in.

> oci compute image list --compartment-id ocid1.compartment.oc1... --query "data[].{name:\"display-name\",ocid:id}" --all --output table
+----------------------------------+--------------------+
| name                             | ocid               |
+----------------------------------+--------------------+
| Windows-Server-2025-...          | ocid1.image.oc1... |
| Oracle-Linux-9.7-2026.01.29-0    | ocid1.image.oc1... |
| Oracle-Linux-8.10-2026.01.29-0   | ocid1.image.oc1... |
| CentOS-8-Stream-2024.04.25-0     | ocid1.image.oc1... |
| custom_image                     | ocid1.image.oc1... |
+----------------------------------+--------------------+

Build your first virtual machine

You now have all the necessary information to create your own VM from the CLI ! Combine it together with the following flags, and you’re good to go:

• --display-name: Name of the virtual machine
• --assign-public-ip: Whether to assign a public IP.
• --metadata: Useful to add an ssh key to the default user.
• --shape-config: If the shape you selected can be customized, you can select its attributes here, like ocpus or memoryInGBs.

At the end, we have the following command:

oci compute instance launch \
    --compartment-id ocid1.compartment.oc1... \
    --availability-domain "EiFV:EU-ZURICH-1-AD-1" \
    --shape "VM.Standard.E5.Flex" \
    --shape-config '{"ocpus":1,"memoryInGBs":4}' \
    --subnet-id ocid1.subnet.oc1... \
    --image-id ocid1.image.oc1... \
    --display-name "vm_dbi" \
    --assign-public-ip true \
    --metadata '{"ssh_authorized_keys": "ssh-rsa ssh_key_content== user@host"}'

Of course, there are other options that you could use:

• --wait-for-state: useful if you want to wait for the VM to be RUNNING before ending the command. It is very useful in combination with the --query 'data.id' option, which will give you the OCID of the newly created VM, that you can then use to retrieve its IP, among other things.
• --user-data-file: this is especially useful if you want to add a custom cloud-init.yaml file for the VM setup.
• --boot-volume-size-in-gbs: size of the boot volume, in GB.

With this, you have everything you need for a basic VM creation in OCI.

L’article Creating an Oracle Cloud Infrastructure VM Using the CLI est apparu en premier sur dbi Blog.

In response to this, Oracle (and others) use a not-so-native adaptation of SQL to query JSON documents. And if you’ve ever had to deal with these SQL-based JSON queries, you may have found yourself thinking (in hindsight) that querying JSON documents with MQL (MongoDB Query Language) wasn’t that painful after all. And rightly so : JSON documents are very different from relational tables, and there is no easy way to continue using SQL without learning some new syntax.

Oracle likely came to the same conclusion, and offers an API dedicated to MongoDB natives. The idea is simple : to ease the work of developers and database administrators when deciding to migrate from MongoDB to Oracle (and the other way around ?…)

On Oracle Cloud Infrastructure (OCI), this means being able to connect to Autonomous Databases (ADB). As a reminder, you have two of them included in the Always Free Tier of OCI, so you can play around with this feature for free before deciding to migrate to the cloud.

Setting up the Oracle MongoDB API on OCI

When creating an Autonomous Database, you can decide on multiple workloads types, including a JSON workload. However, the MongoDB API does not strictly require the JSON workload type to work.

However, the network access setting of your Autonomous Database must be non-default with one of the following options enabled :

• Secure access from allowed IPs and VCNs only
• Private endpoint access only

For instance, when using the Secure access from allowed IPs and VCNs only option, you can add any IP address to the Access Control List (ACL), including your own.

After creating the ADB (Autonomous Database), you can check in the Tool configuration tab the MongoDB API is enabled (it should be, by default).

Then you can go in Database actions > Database Users to either create a user or modify an existing one, with the following privileges : CREATE SESSION, CREATE RESOURCE (default), and the SODA_APP role. After creation, you should enable REST as shown below. This will allow the API to work on that particular schema.

Back on the Tool configuration tab of your ADB instance, you’ll find the Public access URL. Copy it, this will be your connection string when using the API.

Connection String Example

For this to work, you have to replace the user and password in the connection string. For instance, if your user is called USER_DB, and your password is userpwd, then you would use this connection string (without the brackets). Make sure to escape any special character in the password when doing so (see documentation).

mongodb://user_db:userpwd@A49E7CHE9B320E6-PCCVX8PAE2NZPVBQ.adb.eu-zurich-1.oraclecloudapps.com:27017/user_db?authMechanism=PLAIN&authSource=$external&ssl=true&retryWrites=false&loadBalanced=true'

Use this connection string with mongosh or any tool provided by MongoDB. With mongosh, you would connect with this command :

mongosh 'mongodb://user_db:userpwd@A49E7CHE9B320E6-PCCVX8PAE2NZPVBQ.adb.eu-zurich-1.oraclecloudapps.com:27017/adb_admin?authMechanism=PLAIN&authSource=$external&ssl=true&retryWrites=false&loadBalanced=true'

You are now connected to the Oracle ADB instance through the mongosh utility.

Viewing Oracle tables with the API

If you connect to an existing schema with tables, you will notice that running show collections (or show tables) doesn’t return anything. In Oracle 19c, only collections/tables created through the API appear in this list. Standard tables create with a CREATE TABLE SQL statement won’t be displayed.

Included and excluded features in the API

Once connected, you can query the different databases (schemas, in Oracle terms) of your instance. However, unlike in MongoDB, you can’t administer the instance through mongosh.

You can look at the documentation to check the features included in the API, but here is an extract of the most notable changes :

• All the most basic aggregated pipelines are available in the API, but more complex ones like $currentOp or $merge are not yet supported.
• Other aggregation operators, like $bucket, $documents or $sample are only available starting with Oracle 23ai.
• db.dropDatabase() doesn’t drop the Oracle schema. In fact, it doesn’t even deletes everything in the schema. It only deletes all real collections inside of it. So if you have a traditional table that is not a considered as a collection (not shown in show collections), it will not be deleted by this command.

Troubleshooting MongoServerError: Database connection unavailable

You might encounter the following error :

MongoServerError: Database connection unavailable. Ensure that the user exists and the schema is enabled for use with Oracle REST Data Services. A schema can be enabled by calling the PL/SQL procedure ORDS.ENABLE_SCHEMA

If you see this message, you can either follow the procedure or remember to enable REST directly on the OCI Database Actions panel, as shown above.

In short, Oracle’s MongoDB API provides an interesting bridge between the relational and document worlds. Even though some MongoDB features are supported yet, the API offers a straightforward way to connect MongoDB and Oracle Autonomous Database. It makes it ideal for testing, for migration or even for hybrid setups. For developers used to MQL, it can significantly ease the transition to Oracle’s ecosystem.

L’article Using Oracle API for MongoDB on OCI est apparu en premier sur dbi Blog.

Let’s quickly check what is required to achieve this together.

What is required to create a refreshable ?

Well, to create a remote (refreshable) clone you need at least a database link (whatever you are cloning from a single instance, Oracle RAC and/or Oracle Data Guard standby database). ideally, created though an isolated database user with appropriate CREATE SESSION and CREATE PLUGGABLE DATABASE system privileges.

To be more precise until Oracle RDBMS 19.27 a PUBLIC database link was even required because of

Bug 34723488  PDB REFRESH USING A NON-PUBLIC DB LINK FAILING WITH ERROR "ORA-04054"

Before you, ask … Yes, the database link is required even if you clone locally within the same container (formerly called a loopback database link) but this is not the subject for today’s post 🙂

How to provision a (refreshable) clone from standby?

This post does not replace the Oracle manuals! But tries to summarize some challenges we faced over the past years with this Oracle features.
Please refer to https://www.dbi-services.com/blog/managing-refreshable-clone-pluggable-databases-with-oracle-21c/ for for conceptual details about the refreshable clone feature.

Provisioning (or refreshing) a refreshable clone from a single-instance, RAC works out-of-the-box as long as you run it from primary database. However, when started on a standby it fails:

CREATE PLUGGABLE DATABASE PDB_TMR_001P FROM PDB_APP_001P@"CDB999_19e1298295ca4e68460d28d0cc00304a@CDB999_SITE2"
KEYSTORE IDENTIFIED BY "…#secret#..." INCLUDING SHARED KEY
PARALLEL 8
SERVICE_NAME_CONVERT=('PDB_APP_001P','PDB_TMR_001P')
REFRESH MODE MANUAL
STANDBYS=NONE"
 
PY-4011: the database or network closed the connection
ORA-00600: internal error code, arguments: [kcffo_init_df_hdr:badfuzzysrcfile], [262], [6010], [], [], [], [], [], [], [], [], []

According, to Oracle support we are trying to clone while an “hot backup” is running as explained by following article:

ORA-00600 [kcffo_init_df_hdr:badfuzzysrcfile] On Create Pluggable Database (Doc ID 2878586.1)

As we are cloning from an Oracle Data Guard Active standby, with ongoing recovery process all our database files are “FUZZY” except PDB$SEED as of it’s “immutable” state which correlates with the ORA-00600 first argument.

This can be verified through Oracle data dictionary dynamic performance view V$DATAFILE_HEADER:

SQL> SELECT database_role, open_mode FROM v$database;

DATABASE_ROLE		             OPEN_MODE
------------------------------ ------------------------------
PHYSICAL STANDBY	             READ ONLY WITH APPLY

SQL> SELECT con_id, fuzzy, checkpoint_change# FROM v$datafile_header;


    CON_ID FUZZY      CHECKPOINT_CHANGE#
---------- ---------- ------------------
         1 YES                   39212441
         1 YES                   39212441
         1 YES                   39212441
         1 YES                   39212441
         2 NO                    1683111
         2 NO                    1683111
         2 NO                    1683111
         3 YES                   39212441
         3 YES                   39212441
         3 YES                   39212441
         3 YES                   39212441
         3 YES                   39212441
         3 YES                   39212441

So. let’s try to cancel the recovery process using Data Groker command “SET STATE”

EDIT DATABASE 'CDB999_SITE2" SET STATE='APPLY-OFF'

Cancelling recovery process, leaves the database files in a consistent state

2025-08-18T09:20:46.148023+00:00
ALTER DATABASE RECOVER MANAGED STANDBY DATABASE CANCEL
2025-08-18T09:20:46.149836+00:00
PR00 (PID:90495): MRP0: Background Media Recovery cancelled with status 16037
2025-08-18T09:20:46.149938+00:00
Errors in file /u01/app/oracle/diag/rdbms/cdb999_site/CDB999/trace/CDB999_pr00_90495.trc:
ORA-16037: user requested cancel of managed recovery operation
PR00 (PID:90495): Managed Standby Recovery not using Real Time Apply
Recovery interrupted!
Recovered data files to a consistent state at change 39213769
Stopping change tracking
2025-08-18T09:20:46.290601+00:00
Errors in file /u01/app/oracle/diag/rdbms/cdb999_site/CDB999/trace/CDB999_pr00_90495.trc:
ORA-16037: user requested cancel of managed recovery operation
2025-08-18T09:20:47.406889+00:00
Background Media Recovery process shutdown (CDB999)
2025-08-18T09:20:48.151897+00:00
Managed Standby Recovery Canceled (CDB999)
Completed: ALTER DATABASE RECOVER MANAGED STANDBY DATABASE CANCEL

From now on, the database files are consistent as visible in V$DATAFILE_HEADER

SQL> SELECT con_id, fuzzy, checkpoint_change# FROM v$datafile_header;

    CON_ID FUZZY      CHECKPOINT_CHANGE#
---------- ---------- ------------------
         1 NO                   39213769
         1 NO                   39213769
         1 NO                   39213769
         1 NO                   39213769
         2 NO                    1683111
         2 NO                    1683111
         2 NO                    1683111
         3 NO                   39213769
         3 NO                   39213769
         3 NO                   39213769
         3 NO                   39213769
         3 NO                   39213769
         3 NO                   39213769

As per the attached evidences the database datafiles are consitent as of Oracle System Change Number 39213769 (alert*log “Recovered data files to a consistent state at change 39213769”) which matches (V$DATAFILE_HEADER.CHECKPOINT_CHANGE#)

From now on, any cloning tentative to provision a fresh clone from Oracle Data Guard Active standby database works. However, it requires comprehensive measures to disable and re-active recovery process.

As alternative; Daniel Overby Hansen proposes to convert the standby database to a snapshot standby. but this may not work to start a refresh at later stage (not tested).

How to refresh the refreshable clone ?

Well, same story as for provision a clone from standby, except that the error message is a bit more silly

ALTER PLUGGABLE DATABASE RCLON_TMR_002I REFRESH

ORA-65345: cannot refresh pluggable database

Alert*log snipped records recovery attempt but not “real error” message to identify the root cause:

Pluggable database PDB_TMR_001P closed
2025-08-18T10:01:20.246104+00:00
Applying media recovery for pdb-4099 from SCN 39285930 to SCN 39286036
Remote log information: count-1
thr-1,seq-294,logfile-+RECO/CDB999_SITE2/ARCHIVELOG/2025_08_18/thread_1_seq_294.396.1209463231,los-39285484,nxs-39285931,maxblks-9107
PDB_TMR_001P(18):Media Recovery Start
2025-08-18T10:01:20.249993+00:00
PDB_TMR_001P(18):Serial Media Recovery started
PDB_TMR_001P(18):max_pdb is 27
2025-08-18T10:01:20.341597+00:00
PDB_TMR_001P(18):Media Recovery Log +RECO/CDB999_SITE2/ARCHIVELOG/2025_08_18/thread_1_seq_294.396.1209463231
2025-08-18T10:01:20.638622+00:00

Actually, it took me a while to understand that the requested recovery SCN 39286036 (line “Applying media recovery for pdb-4099 from SCN 39285930 to SCN” ) was not available on standby database.
Indeed, Oracle expects to get this transaction “already” on the standby archived redo log.

This can be easily reproduced on a LAB by querying V$ARCHIVED_LOG on the as follows:

SELECT sequence#, first_change#, next_change# 
  FROM v$archived_log 
WHERE &scn BETWEEN first_change# AND next_change#
     AND standby_dest='NO';

So, we can’t start an “ALTER PLUGGABLE DATABSE <PDB_NAME> REFRESH” from Oracle Active Data Guard standby database as of Oracle database piggy backing feature and lazzy checkpoints :=).
Indeed, Oracle has no feature to force a log switch on primary while being connected to standby site.

Workarround: Force log switch on Oracle Active Data Guard primary database:

ALTER SYSTEM ARCHIVE LOG CURRENT

Wrap-up

Well, after all Oracle documented the behavior 🙂 IMHO, this issue deserved more than 3 lines in a Oracle support article:

Force log switch to Avoid ORA-65345 When Refreshing PDB Sourced From Active Data Guard Standby (Doc ID 2765472.1)

Oracle is working on an enhancement request to “fix” that

"32709955 - NEED TO REFRESH THE REFRESHABLE PDB FROM THE PHYSICAL STANDBY"

Last one but not least, the current functionality with aforementioned workaround appplied is only viable as long as you do not require the “auto-refresh” feature. Indeed, who wants to disable Oracle Data Guard broker LogApply/recovery process, force a log switch on primary database and manage to get the monitoring in-line ?

L’article Creating&Refreshing a refreshable PDB (from a Standby Database) est apparu en premier sur dbi Blog.

What are our options with dbaascli?

Well, we can simply go ahead and apply single changes one by one.

time sudo dbaascli database modifyParameters --dbname CDBZ001T  --setParameters _fix_control="23473108:off"

DBAAS CLI version 25.1.2.0.0

Executing command database modifyParameters --dbname CDBZ001T --setParameters _fix_control=23473108:off<br><br>Job id: c5f5e1ba-39b6-4ab1-a5fa-c7f1211c037a
Session log: /var/opt/oracle/log/CDBZ001T/database/modifyParameters/dbaastools_2025-06-03_09-15-44-PM_220508.log

Loading PILOT...
Session ID of the current execution is: 18947<br><br>Log file location: /var/opt/oracle/log/CDBZ001T/database/modifyParameters/pilot_2025-06-03_09-15-48-PM_220935
-----------------
Running Plugin_Initialize job
Completed Plugin_Initialize job
-----------------
Running Validate_Parameters job
Completed Validate_Parameters job
-----------------
Running Apply_Dynamic_Parameters_Changes job
Completed Apply_Dynamic_Parameters_Changes job
-----------------
Running Apply_Static_Parameters_Changes job
Completed Apply_Static_Parameters_Changes job

dbaascli execution completed

real    0m20.481s
user    0m0.007s
sys     0m0.008s

What a lucky test, we just set a single hidden parameter without any database restart. But hold on, more then 20 seconds to run a simple ALTER SYSTEM that’s okay but not pretty fast. A database restart was even unnecessary for this testcase.

Well, the best is always to check the Oracle documentation first. Especially, the section about “dbaascli database modifyParameters”

dbaascli database modifyParameters --dbname <value> --setParameters <values>| --resetParameters <values> | --responseFile
[--backupPrepared]
[--instance]
[--allowBounce]

--responseFile specifies the absolute location of the response JSON file to modify the database parameters 

We Oracle DBA folk do certainly understand what is meant when there is a mention about a responseFile 🙂

Where is the –reponseFile option gone?

Well, at the time of writing this article we are using the latest Oracle CloudToolings version available (RPM: dbaastools_exa-1.0-25.1.2.0.0_250505.1725.x86_64) but the option isn’t referenced in the command-line synoposis

# dbaascli database modifyParameters --help
DBAAS CLI version 25.1.2.0.0
Executing command database modifyParameters --help
    database modifyParameters - modifies or resets initialization parameters for a given Oracle database.

      Usage: dbaascli database modifyParameters --dbname <value>
        {
            --setParameters <value> [--instance <value>] [--backupPrepared] [--allowBounce]
            | --resetParameters <value> [--instance <value>] [--backupPrepared] [--allowBounce]
        }
        [--waitForCompletion <value>]

      Where:
        --dbname - Oracle database name.
        --setParameters | --resetParameters
        --setParameters - comma separated list of parameters to be modified with new values. For blank values use ''. E.g. parameter1=valueA,parameter2='',etc.
            [--instance - name of the instance on which the parameters will be processed. If not specified, the operation will be performed at the database level.]
            [--backupPrepared - flag to acknowledge that a proper database backup is in place prior to modifying critical or sensitive parameters.]
            [--allowBounce - flag to grant permission to bounce the database in order to reflect the changes on applicable static parameters.]
        --resetParameters - comma separated list of parameters to be reset to their corresponding default values. E.g. parameter1,parameter2,etc.
            [--instance - name of the instance on which the parameters will be processed. If not specified, the operation will be performed at the database level.]
            [--backupPrepared - flag to acknowledge that a proper database backup is in place prior to modifying critical or sensitive parameters.]
            [--allowBounce - flag to grant permission to bounce the database in order to reflect the changes on applicable static parameters.]
        [--waitForCompletion - specifies false to run the operation in background. Valid values : true|false.]

How to use the JSON file?

Well, here due to the inaccurate information and misleading Synopsis we had to strike back with Oracle support. Indeed, How shall the JSON being formatted ? Which combination are required to “–setParameters” or “–resetParameters” a parameter.

Finally, after some internal research the Oracle support came back (after a while) with the expected JSON format

{
"setParameters":"param1=value,param2=value,param3=value"
}

Sounds pretty logic if you omit all information from Oracle documenation and “dbaascli database modifyParameters” command synopsis.

dbaascli option “–allowBounce”

Changing sequentially static database parameters and restarting the the container database may drastically increase the configuration of (container) database depending on the amount of parameters to modify.

As such, the combination between the dbaascli “–responseFile” and –allowBounce” is an excellent comprise to apply them all at once (batch processing).

And indeed, Oracle executes in background an “ALTER SYSTEM … SCOPE=SPFILE” for all static parameters which requires are database restart. Of course, the restart occurs only once.

Are we obligated to use dbaascli ?

Luckily not, but they are a lot of automation running in background. For instance, if you do not the by yourself the Oracle System Global Area (aka. SGA) anytime you reshape the VMcluster memory, the Oracle SGA will be implicitly reshaped too.

You can check all of them by using following command

# sudo dbaascli database getDetails --dbname CDBZ001T

<snipped truncated for readability>
  "dbName" : "CDBZ001T",
  "dbUniqueName" : "CDBZ001T_SITE2",
  "dbDomain" : "jewlab.ch",
  "dbId" : 3776747013,
  "cpuCount" : 12,
  "sgaTarget" : "8192MB",
  "pgaAggregateTarget" : "5000MB",
  "dbSize" : "7141GB",

<snipped truncated for readability>

Knowing, this you may think about some basic configuration-as-code techniques to manage database parameters.

Wrap-up & Caveats

Using JSON to manage database parameters is quite cool as it can be the starting to point for any kind of configuration as code and even enable documentation-as-code techniques.

Imagine maintaining all your database parameters over a simple YAML file.

  - name: "db_files"
    value: "8192"
    bounce_db: true
    description: "Oracle Bug 33888381 - ORA-1152 after Flashback Pluggable Database (Doc ID 33888381.8)"

As usual, we have always exceptions with Oracle 😉

• dbaascli expect a list of comma separated parameters.
  
  --setParameters specifies a comma-delimited list of parameters to modify with new values. For example: parameter1=valueA,parameter2=valueB, and so on. For blank values use parameter1=valueA,parameter2=”,etc.
  
  As such, you can’t apply with dbaascli parameter with multiple values such as hidden parameter “_fix_control”, but this applies to parameters like event, db_file_name_convert, aso …
  
• dbaascli can’t apply multiple times the same modification at least for parameter db_domain it fails (all the other we tested ran fine)
  
  Running Validate_Parameters job
  Execution of Validate_Parameters failed
  [FATAL] [DBAAS-70154] The modification of the following parameter is not allowed: db_domain.
     ACTION: Verify the requested parameter and try again.
  *** Executing jobs which need to be run always… ***
  
  

Enjoy!

L’article ExaCC/CS: modify database parameters in batch mode using dbaascli est apparu en premier sur dbi Blog.

What’s wrong with the Materialization?

At a first look, nothing! it’s a straightforward command as easy as creating a PDB using “CREATE PLUGGABLE DATABASE .. FROM …”. Except that it takes time…

below some “fun facts”:

Indeed, we have set a “fixed” degree of parallelism to “constraint” the resources (CPU, IO) used by all kind of cloning activities.

Nevertheless, the “ALTER PLUGGABLE DATABASE MATERIALIZE” is at least 5 times slower compared to the creation of a full PDB clone when copying all database block onto SPARSE diskgroup.

Why does it take so much time?

A simple check in the database alert*log provides some insights:

2025-05-25T09:02:46.980450+02:00

Moving datafile +SPRC4/AVQD001T_SITE1/35F11D075E0FB991E0631A1FA10A6291/DATAFILE/data_000014750.2483.1202028085 (2967) to +DATAC4

Indeed, we get flooded by “ALTER DATABASE MOVE DATAFILE” commands. A quick session tracing activity confirmed that Oracle performs sequentially online database move operations. Last one but not least, this operations runs all database server (VMcluster node).

*** 2025-05-22T21:22:52.961911+02:00 (CDB$ROOT(1))

Moving datafile +SPRC4/AVQD001T_SITE1/360EA26B7CE6F135E0631A1FA10A00C8/DATAFILE/data_000011575.2664.1202154873 (6656) to +DATAC4

kcffo_mv_prepare: the secondary file +DATAC4/AVQD001T_SITE1/360EA26B7CE6F135E0631A1FA10A00C8/DATAFILE/data_000011575.2015.1202162415 is created with size 216

kcffo_mv_domove: Blocks copied for file +DATAC4/AVQD001T_SITE1/360EA26B7CE6F135E0631A1FA10A00C8/DATAFILE/data_000011575.2015.1202162415 size 216

Move operation committed for file +DATAC4/AVQD001T_SITE1/360EA26B7CE6F135E0631A1FA10A00C8/DATAFILE/data_000011575.2015.1202162415

Are we able to monitor the “materialize” process ?

Yes, of course as usual operations which last for more than 6 seconds we can query GV$SESSION_LONGOPS:

> SELECT sid, serial#, opname, sofar, totalwork,
                 ROUND(sofar/totalwork*100,2) PCT_COMPLETE
     FROM   V$SESSION_LONGOPS
   WHERE TOTALWORK != 0
        AND    SOFAR != TOTALWORK
 ORDER BY 1

      SID   SERIAL# OPNAME                                               SOFAR     TOTALWORK   PCT_COMPLETE
------- ---------- ---------------------------- ----------------- ----------------- -----------------
   2228      30474  Online data file move                  4796186624       8615100416                    55.67

1 row selected.

Can we parallelize “ALTER PLUGGABLE DATABASE” process?

Actually, IMHO Oracle shall provide through any kind of “magic” parameters. Unfortunately, researches on https://oradiff.oracle.com as of Oracle 19.27 were unfruitful.

Luckily, we did all scripting with #python using #cx_oracle driver and such quickly develop the necessary function to iterate over all pluggable database datafiles using parallel task execution with conurrent.futures module.

The optimized process using 8 database sessions, all moving database files in parallel was worth; The runtime for materializing the sparse clone is equal (or even less) to the time required to create a full PDB clone.

Wrap-up

For those, who already are confident with Exadata sparse clone (& Exadata sparse ASM diskgroup) you might have spotted the we moved the database into the DATA diskgroup. This can be achieved by setting DB_CREATE_FILE_DEST parameter at pluggable database level before starting to materialize the datafiles. So, Materializing the PDB sparse cloning into DATA diskgroup is only 2 times slower compared to copying all blocks to SPARSE diskgroup.

Oracle Exadata Exascale & Oracle 23ai will definitively bring more flexibility to Exadata PDB sparse clones, at least the known limitations for Oracle19c will be from the past as communicated by Oracle.
However, the whole materialization remains uncovered so far.

At the time of writing this post the Oracle “Cloud” support team has been informed.

Last one but not least, from time to time we need to cleanup some leftovers from ASM sparse diskgroup (subject to another Oracle Service request).

2025-05-25T09:02:35.623108+02:00
WARNING: Cannot delete old file +SPRC4/AVQD001T_SITE1/35F11D075E0FB991E0631A1FA10A6291/DATAFILE/data_000014770.1000.1202028085 left after datafile move
2025-05-25T09:02:35.623248+02:00
Errors in file /u02/app/oracle/diag/rdbms/avqd001t_site1/AVQD001T1/trace/AVQD001T1_ora_203496.trc:

ORA-15028: Oracle Automatic Storage Management (Oracle ASM) file '+SPRC4/AVQD001T_SITE1/35F11D075E0FB991E0631A1FA10A6291/DATAFILE/data_000014770.1000.1202028085' not dropped; currently being accessed

Keep you posted!

L’article Optimize materialization of Exadata PDB sparse clones est apparu en premier sur dbi Blog.

YaK core Multi-Platform open source Automation Tool simplifies the deployment of Ansible playbooks through a clean UI and API. It offers an intuitive interface where users can upload playbooks, configure parameters, and deploy them seamlessly across various platforms, and all managed through a centralized inventory stored in a PostgreSQL database. With YaK Core, developers can focus on writing application code without worrying about infrastructure setup or management.

YaK consists of two parts: YaK Core, which is open source, and YaK Components, which can be installed on top. These YaK Components are platform-agnostic service packages (e.g., PostgreSQL, Oracle DB, MongoDB, Kubernetes, etc.), written in Ansible by experts. They provide essential operational features such as backup, patching, upgrades, and high availability. If you’d like to learn more about the available YaK components, feel free to contact us!

But that’s not all. YaK Core also lets you create your own YaK Components . Once created, your component becomes immediately available for deployment across all platforms supported by YaK Core.

In this blog, I’ll show you how easy it is to create your own YaK Component using Ansible, upload it to YaK Core, and deploy it across any supported platform.

YaK Demo platform provisioning

To get started with YaK Core Multi-Platform open source solution, visit https://yak4all.io and provision your own YaK demo environment (take 5 minutes to be ready).

Build your YaK Component

To build a YaK Component, you need to declare at least the following three files

1. playbooks/create_linux_users.yml
2. manifest.yml
3. yak_variables_specifications/basic_variables_specifications.yml

1. The Ansible Playbook

playbooks/create_linux_users.yml
This file is simply your Ansible playbook, nothing more. The only requirement is that the code uses variables, which will be exposed in the UI for configuration. The example playbook below will create a user and optionally grant them sudo privileges.

---
- name: Create Linux users
  hosts: linux_hosts
  become: true
  gather_facts: true

  tasks:
    - debug:
        var: user

    - name: Create users
      ansible.builtin.user:
        name: "{{ item.username }}"
        create_home: "{{ item.create_home | default(true) }}"
        state: present
      loop: "{{ user }}"

    - name: Add users to sudoers
      community.general.sudoers:
        name: "yak-sudoer-{{ item.username }}"
        user: "{{ item.username }}"
        commands: ALL
        state: present
      loop: "{{ user }}"
      when: item.is_sudoer
        
  post_tasks:
    - name: Update component state
      delegate_to: localhost
      yak.core.yak_component_state_update:
        component_state_name: 'deployed'
...

2. Manifest file

manifest.yml
This file contains the basic information about your component and specifies which playbooks can be executed.

name: linux_users

version:
  major: 1
  minor: 0
  patch: 0

sub_component_types:
  - display_label: Linux users
    name: create_linux_users
    features:
      - display_label: Create Linux users
        name: create_linux_users
        playbook_name: playbooks/create_linux_users.yml

    inventory_maps:
      - group_name: linux_hosts
        group_nicename: Linux hosts
        group_description: Host on which the users will be created
        group_min_hosts: 1
        group_max_hosts: 100
        type: host
        os_type: Linux

3. Variable specification file

yak_variables_specifications/basic_variables_specifications.yml
Now you can define and provide all the specifications for the variables you want to make configurable, with all the required settings .

- variableName: user
  niceName: Users to create
  dataType: array
  children:
    - variableName: username
      niceName: Username
      dataType: string
      mandatory: true
      defaultValue: yak
      isOneOffSetting: false
      usage: Name of the user to create

    - variableName: create_home
      niceName: Create Home directory
      dataType: boolean
      mandatory: true
      defaultValue: true
      isOneOffSetting: false
      usage: Tick the box if you want to create a Home directory for the user (/home/<username>)

    - variableName: is_sudoer
      niceName: Grant sudo privileges
      dataType: boolean
      mandatory: true
      defaultValue: true
      isOneOffSetting: false
      usage: Tick the box if you want to grant "ALL" privileges escalation to the user

That’s it! You now have all the necessary files for your first YaK Component. Next, create a ZIP package and upload it to your deployed YaK Demo environment.

To make things easier, I’ve created a ZIP file that you can upload directly. : create_linux_user.zip

Setup a Server

For this task, simply follow the documentation below up to Step 4: Deploy your server https://dbi-services.gitbook.io/yak-user-doc/introduction/yak-demo

Declare and deploy your Component

You’re now ready to declare and deploy your component!

1. Declare

YaK UI -> Components -> Declare -> Component_type : linux_users -> Save

2 Deploy

YaK UI -> Components -> Select LinuxUser -> Action -> Create Linux User -> Confirm

Conclusion

This component can now be deployed on any cloud platform or integrated on On-Premises environment using the YaK UI, and can also be deployed in parallel on up to 100 servers, as specified in your Manifest file.

With this solution, you can provide your colleagues with an intuitive and efficient way to work with Ansible playbooks, enhancing their overall experience .

For more Information about YaK see the blogs available here : https://www.dbi-services.com/blog/yak

L’article YaK Core – The Holy Grail for Deploying Ansible Code Everywhere est apparu en premier sur dbi Blog.

A couple of days ago, we have been asked a by an IT architect to have a look at some SHELL scripts & C programs executed on a database server by database processes; It all began with “strange” UNIX file permissions such as:

[oracle@svl-oat ~]$ ls -l /opt/oracle_scripts/run_prog.sh
-rwxr-sr-x 1 oracle oinstall 68 Mar 12 19:28 /opt/oracle_scripts/run_prog.sh

Interesting isn’t it ? SETUID & SETGID have been set on the scripts to probably gain elevated privileges ? But, for which purpose?

Which methods do we have to start external jobs from Oracle (pluggable) database?

Before moving into all the beloved technical details and reverse engineering. Let’s quickly summarize all options Oracle RBDMS offers.

DBMS_SCHEDULER jobs

According to the DBMS_SCHEDULER sub-program CREATE_JOB. Oracle supports several types for calling external programs:

Please refer to the DBMS_SCHEDULER package for details.

Java Stored procedure

Indeed, Oracle RBDMS can spawn a dedicated server process on the database server using Java stored procedure and call a SHELL script.

The following Java program source code has been merged from two different code base:

• https://oracle-base.com/articles/8i/shell-commands-from-plsql
• https://innerlife.io/oracle-db-cmd-java

CREATE OR REPLACE AND COMPILE JAVA SOURCE NAMED "JavaExecHostCmd" AS
import java.io.*;
public
class JavaExecHostCmd {
 public
  static String executeCommand(String command) {
    String buff = null;
    String output = "";
    try {
      String[] finalCommand;
      finalCommand = new String[3];
      finalCommand[0] = "/bin/bash";
      // finalCommand[0] = "";
      finalCommand[1] = "-c";
      finalCommand[2] = command;

      // Execute the command...
      final Process pr = Runtime.getRuntime().exec(finalCommand);

      // Capture output from STDOUT...
      BufferedReader br_in = null;
      try {
        br_in = new BufferedReader(new InputStreamReader(pr.getInputStream()));
        output = output + "STDOUT: " + "\n";
        while ((buff = br_in.readLine()) != null) {
          // System.out.println("stdout: " + buff);
          output = output + buff + "\n";
          try {
            Thread.sleep(100);
          } catch (Exception e) {
          }
        }
        br_in.close();
      } catch (IOException ioe) {
        // System.out.println("Error printing process output.");
        output = output + "Error printing process output." + "\n";
        // ioe.printStackTrace();
      } finally {
        try {
          br_in.close();
        } catch (Exception ex) {
        }
      }

      // Capture output from STDERR...
      BufferedReader br_err = null;
      try {
        br_err = new BufferedReader(new InputStreamReader(pr.getErrorStream()));
        output = output + "\n" + "STDERR: " + "\n";
        while ((buff = br_err.readLine()) != null) {
          // System.out.println("stderr: " + buff);
          output = output + buff + "\n";
          try {
            Thread.sleep(100);
          } catch (Exception e) {
          }
        }
        br_err.close();
        return output;
      } catch (IOException ioe) {
        // System.out.println("Error printing execution errors.");
        output = output + "Error printing execution errors." + "\n";
        // ioe.printStackTrace();
      } finally {
        try {
          br_err.close();
        } catch (Exception ex) {
        }
      }
    } catch (Exception ex) {
      output = output + ex.getLocalizedMessage() + "\n";
    }
    return output;
  }
};
/

Basically, the program executes a “/bin/bash -c <Command>” and returns its result.

To interface the Java program a simple PL/SQL function is required:

CREATE OR REPLACE FUNCTION run_shell_cmd_with_java (p_command  IN  VARCHAR2) 
   RETURN  VARCHAR2 
   AS LANGUAGE JAVA 
   NAME 'JavaExecHostCmd.executeCommand (java.lang.String) return String';
/

Finally, we need to grant access to the Oracle OJVM for desired database schema:

DECLARE
   l_schema VARCHAR2(30) := 'JEW'; -- Adjust as required.
BEGIN
   DBMS_JAVA.grant_permission(l_schema, 'java.io.FilePermission', '<<ALL FILES>>', 'read ,write, execute, delete');
   DBMS_JAVA.grant_permission(l_schema, 'SYS:java.lang.RuntimePermission', 'writeFileDescriptor', '');
   DBMS_JAVA.grant_permission(l_schema, 'SYS:java.lang.RuntimePermission', 'readFileDescriptor', '');
END;
/

Safe Harbor statement: Please ensure you do not blindly apply the same java.io.FilePermission which basically allows to run anything on the database server 🙂

External C/C++ programs aka “extproc”

That’s probably one of the least known option but as old as the Oracle JVM both introduced in 1999 with Oracle 8i.

The following source code was mostly generated with the support of a LLM but slightly adapted to mimic the behavior as the Java program:

cat <<EOF_> /opt/oracle_scripts/c_extproc.c
// Source: ChatGPT
#include <stdio.h>
#include <stdlib.h>
#include <string.h>  // Include the string.h header to use strcpy and strlen

#define MAX_BUFFER 1024

// Function to execute a Linux command and return the output
char* execute_command(const char *command) {
    FILE *fp;
    char *output = (char*)malloc(MAX_BUFFER * sizeof(char));  // Allocate memory for the output
    if (output == NULL) {
        perror("malloc failed");
        return NULL;
    }

    fp = popen(command, "r");  // Open a pipe to the command
    if (fp == NULL) {
        perror("popen failed");
        free(output);
        return NULL;
    }

    // Buffer to accumulate the command output
    char buffer[MAX_BUFFER];
    size_t output_size = 0;

    // Read the output line by line and accumulate it in 'output'
    while (fgets(buffer, sizeof(buffer), fp) != NULL) {
        size_t len = strlen(buffer);

        // Reallocate memory if necessary
        if (output_size + len >= MAX_BUFFER) {
            output = realloc(output, output_size + len + 1);  // Add space for the new content
            if (output == NULL) {
                perror("realloc failed");
                fclose(fp);
                return NULL;
            }
        }

        // Append the line to the output
        strcpy(output + output_size, buffer);
        output_size += len;
    }

    fclose(fp);
    return output;
}
EOF_

Compile the source using GNU compiler and finally resolve the library dependencies (combine links):

gcc -fPIC -c /opt/oracle_scripts/c_extproc.c -o /opt/oracle_scripts/c_extproc.o
ld -shared -o /opt/oracle_scripts/c_extproc.so /opt/oracle_scripts/c_extproc.o

In our case, the program does not contain any “call to the function – aka. main progtam”, as such it’s just a library.

In the same way as we interfaced the Java program, we need to bind the external library with a PL/SQL function:

CREATE OR REPLACE LIBRARY shell_c_lib is '/opt/oracle_scripts/c_extproc.so';
/
CREATE OR REPLACE FUNCTION run_shell_cmd_with_c (command IN VARCHAR2)  
 RETURN  VARCHAR2  
 AS  EXTERNAL
 NAME "execute_command"  
 LIBRARY  shell_c_lib  
 LANGUAGE C  
 PARAMETERS (command string, RETURN string);  
/

Hold on a second, for Java we had to allow the Oracle JVM to access the file sytem to execute an Operating System command. Is anything required for external C/C++ programs ?

Yes, usually ISVs recommend to configure EXTPROC_DLLS parameter within the Oracle Listener. However, in our Oracle Cloud LAB we used an unsafe shortcut which consists to whitelist any library present on the database server filesystem by editing following Oracle Home configuration file:

[oracle@svl-ora-t ~]$ grep '^SET EXTPROC_DLLS=ANY' ${ORACLE_HOME}/hs/admin/extproc.ora
SET EXTPROC_DLLS=ANY

Safe Harbor statement: Please ensure you do not blindly follow this post for your own safety 😉

HOST command from PL/SQL

Uh? Does it exists? LLM training on the job! Of course, not 😉

DBMS_SCHEDULER

The Oracle scheduler support several job types when working with external programs:

EXECUTABLE and EXTERNAL_SCRIPT

Create credentials for jobs from type EXTERNAL_SCRIPT (aka. existing local Operating System user credentials):

BEGIN
  DBMS_CREDENTIAL.CREATE_CREDENTIAL(
    credential_name => 'test_creds',
    username        => 'test',
    password        => 'test');
END;
/

Once, created if needed the credentials can be applied at pluggable database level only though init. parameter PDB_OS_CREDENTIAL.

Create the scheduler jobs:

BEGIN
  DBMS_SCHEDULER.CREATE_JOB(
     job_name=>'EXEC_SHELL_CMD_AS_EXECUTABLE',
     job_type=>'EXECUTABLE',
     job_action=>'/opt/oracle_scripts/run_prog.sh',
     enabled=>TRUE,
     auto_drop=>FALSE,
     repeat_interval => 'freq=secondly;bysecond=5;'
     );

	-- EXTERNAL_SCRIPT requires credentials ! 
	-- Please Refer to DBMS_SCHEDULER package documentation for details
  DBMS_SCHEDULER.CREATE_JOB(
     job_name=>'EXEC_SHELL_CMD_AS_EXTERNAL_SCRIPT',
     job_type=>'EXTERNAL_SCRIPT',
     job_action=>'/opt/oracle_scripts/run_prog.sh',
     credential_name=>'test_creds',
     enabled=>TRUE,
     auto_drop=>FALSE,
     repeat_interval => 'freq=secondly;bysecond=15;'
     );   
END;
/

Nota Bene: DBMS_SCHEDULER job_type EXECUTABLE do not capture STDOUT as long as no credentials are applied (created with DBMS_CREDENTIALS)! at least this was the case on my Oracle 19c Release Update 23 database

STORED_PROCEDURE and PLSQL_BLOCK (Java and External C program)

Functions are not supported by the Oracle Scheduler. Thus, we created a simple instrumentation table:

DROP TABLE debug;
CREATE TABLE debug 
   (EXECUTED_DATE TIMESTAMP default SYSTIMESTAMP, 
    use_case VARCHAR2(20), 
    output VARCHAR2(1024)
   );

And finally, created on top of the functions for the e Java and C program stored procedures:

CREATE OR REPLACE  PROCEDURE runproc_shell_cmd_with_c  AS
   l_output VARCHAR2(100); 
BEGIN  
   l_output := run_shell_cmd_with_c('/usr/bin/whoami'); 
   INSERT INTO debug(use_case, output) VALUES('c_program', l_output);
 END;
 /

CREATE OR REPLACE  PROCEDURE runproc_shell_cmd_with_java  AS
   l_output VARCHAR2(100); 
BEGIN  
   l_output := run_shell_cmd_with_java('/usr/bin/whoami'); 
   INSERT INTO debug(use_case, output) VALUES('java_program', l_output);
 END;
 /

Create the scheduler jobs:

-- Once executed as STORED_PROCEDURE
BEGIN
  DBMS_SCHEDULER.CREATE_JOB(
     job_name=>'EXEC_SHELL_CMD_USING_C_STOREDPROC',
     job_type=>'STORED_PROCEDURE',
     job_action=>'runproc_shell_cmd_with_c',
     enabled=>TRUE,
     auto_drop=>FALSE,
     repeat_interval => 'freq=secondly;bysecond=5;'
     );
    
  DBMS_SCHEDULER.CREATE_JOB(
     job_name=>'EXEC_SHELL_CMD_USING_JAVA_STOREDPROC',
     job_type=>'STORED_PROCEDURE',
     job_action=>'runproc_shell_cmd_with_java',
     enabled=>TRUE,
     auto_drop=>FALSE,
     repeat_interval => 'freq=secondly;bysecond=5;'
     );
END;
/

-- Once executed as anonymous PL/SQL block
BEGIN
  DBMS_SCHEDULER.CREATE_JOB(
     job_name=>'EXEC_SHELL_CMD_USING_C_PLSQLBLOCK',
     job_type=>'PLSQL_BLOCK',
     job_action=>'runproc_shell_cmd_with_c;',
     enabled=>TRUE,
     auto_drop=>FALSE,
     repeat_interval => 'freq=secondly;bysecond=5;'
     );
    
  DBMS_SCHEDULER.CREATE_JOB(
     job_name=>'EXEC_SHELL_CMD_USING_JAVA_PLSQLBLOCK',
     job_type=>'PLSQL_BLOCK',
     job_action=>'runproc_shell_cmd_with_java;',
     enabled=>TRUE,
     auto_drop=>FALSE,
     repeat_interval => 'freq=secondly;bysecond=15;'
     );
END;
/

Test cases

So any guess about old Unix command that prints the effective user id ? whoami?

Comments:

• With Oracle Grid Infrastructure the entire Single Client Access Name (SCAN) listeners belong to Operating System User grid
• BEQUEATH Protocol is local Operating System authentication method only based on the traditional OSDBA, OSOPER. etc .. O.S group mapping
• Oracle Scheduler job coordination CJQn processes and workers Jnn processes are spawned when database starts.

Additional background information

Oracle Cloud database home specificity

On our LAB we had to tweak the Oracle Home as documented per Oracle support note, for some reason on OCI the external job feature is not working by default and according to the note it’s a feature 🙂

DBMS_SCHEDULER job type EXECUTABLE

By default any job is executed under the Unix pseudo user “nobody” which is a low-privileged Unix namespace and as such considered as secure. Oracle allows to tweak the behavior by adapting ${ORACLE_HOME}/rdbms/admin/externaljob.ora:

[oracle@svl-ora-t ~]$ grep '^run_' ${ORACLE_HOME}/rdbms/admin/externaljob.ora
run_user = nobody
run_group = nobody

DBMS_SCHEDULER & Linux PAM (Pluggable Authentication Modules) kernel module

Oracle Scheduler switch the user in background like you would run an “su” command. If this is not possible because of security reasons. the Job wont’ be executed at all

[oracle@svl-ora-t ~]$ su - test
Password:
su: Permission denied

Some hardened system on which we worked did not allow to “escape” from oracle O.S user and as such all Oracle Scheduler jobs failed due to the PAM config preventing switching to another user unless member of wheel O.S group:

# Uncomment the following line to require a user to be in the "wheel" group.
auth           required        pam_wheel.so use_uid

Oracle Support note which is still valid nowadays despite Oracle Linux 6 reference:

Isolate Oracle JVM runtime execution to least privileged O.S user

Oracle delivers Oracle JVM isolation feature using a DBMS_JAVA sub-program to bind execution of program to a specific Operating System user. This setting requires to be conneted as SYS:

SQL> show user 

"SYS"

SQL> alter session set container=APP_001I;

Session altered.

SQL> exec dbms_java.set_runtime_exec_credentials(dbuser=>'JEW', osuser=>'test', ospass =>'test');

PL/SQL procedure successfully completed.

From now on, all sub-subsequent execution will be started under the Operating System user “test”. Unfortunately, all executions fail with following error message

Cannot run program "/bin/bash": cannot execute /u01/app/oracle/product/19.0.0.0/dbhome_1/bin/jssu

Unfortunately, we were not able to fix this issue which has been well described in following post:
https://mvelikikh.blogspot.com/2020/04/secure-use-of-runtimeexec-functionality.html

Unbinding the OJVM runtime environment requires as well SYS:

SQL> alter session set container=APP_001I;

Session altered.

SQL> exec dbms_java.set_runtime_exec_credentials(dbuser=>'JEW', osuser=>null, ospass => null);

PL/SQL procedure successfully completed.

Summary

Well, there is no blueprint to deduct from this post which method suits the best for extermal programs, but at least it provides an overview and reproducible test cases to understand under which circumstances some files may or may not need special file system flags.

Indeed, the dissected use cases for several scripts / C programs were amended with SETUID, GID flag to mitigate some past issues nobody remember leaving the system an undesired state, hackers could potentially take advantage of.

L’article What is the most secure way to call an external job from an Oracle (pluggable) database? est apparu en premier sur dbi Blog.

Yesterday I participated to the Oracle Technology Roundtable for Digital Natives in Zurich.

It was a good opportunity to learn more about AI, Cloud and HeatWave with the focus on very trendy features of this product: generative AI, machine learning, vector processing, analytics and transaction processing across data in Data Lake and MySQL databases.

It was also great to share moments with the Oracle and MySQL teams and meet customers which gave feedback and tips about their solutions already in place in this area.

I’ll try to summarize below some key take-away of each session.

Unlocking Innovation: How Oracle AI is Shaping the Future of Business (by Jürgen Wirtgen)

AI is not a new topic. But how do we use it today and where are we in the process, early or advanced?

To answer this question, you can have a look to the stages of adoption:

1. Consume (AI embedded in your applications) -> SaaS applications
2. Extend (models via Data Retrieval, RAG) -> AI services
3. Fine tune -> Data
4. Build models from scratch -> Infrastructure

AI is not AI. The best AI starts with the best data, securely managed. Which can be translated back into a simple equation: Best Data + Best Technology = Best AI.

Innovations in HeatWave & MySQL – The Present and the Future (by Cagri Balkesen)

HeatWave is an in-memory query processing accelerator for data in MySQL transactional RDBMS or data in Object Store in different format.

Normally you need to put in place and maintain ETL processes to produce data that can be used effectively by analytics. This brings several drawbacks:

• Complexity
• You have to maintain different systems, on which you’ll have security issues to handle and costs to assume.

Using HeatWave, you don’t need that anymore, because it’s a single platform which allows you to manage together all your OLTP, OLAP, Machine Learning and GenAI workloads.

Which are the advantages of using HeatWave?

• You current SQL syntax doesn’t need to change
• Changes to data are automatically propagated to HeatWave
• Best performances for your queries
• Efficient processing for Data Lake
• Best platform for MySQL workloads
• Built-in GenAI & Vector Store
• Available in multi cloud (natively on OCI, it can run inside AWS, you can setup a private interconnection for Microsoft Azure, and there are works in progress for Google Cloud).

HeatWave is based on a massively parallel architecture which uses partitioning of data: each CPU core within a node processes the partitioned data in parallel.

Driven by Machine Learning algorithms, HeatWave Autopilot offers several features such as:

• Improvements in terms of performance and scalability
• Provisioning, data loading, query execution and fault management automation, to reduce human errors.

Finally, according to Oracle, with HeatWave you will have best performances and lowest costs rather than competitors: Snowflake, Amazon Redshift, Google BigQuery and Databricks.

Building Next-Gen Applications with Generative AI & Vector Store (by Adi Hochmann)

As we said, Oracle HeatWave allows you to manage together all your OLTP, OLAP, Machine Learning and GenAI workloads.

Steps to build a GenAI application are the following ones:

1. Create a vector store
2. Use vector store with LLMs

And this is performed using the following routines:

call sys.HEATWAVE_LOAD (…);

call sys.ML_RAG(@query,@output,@options);

But how to train data for Machine Learning? The process and tasks done by a data analyst could be complex and this is replaced here by the AutoML:

CALL sys.ML_TRAIN(‘data_source’, ‘model_type’, JSON_OBJECT(‘task’, ‘classification’), @result_model);

This is useful for some use-cases such as classification, anomalies detection, recommendations, predictive maintenance, …

Additional tip: Adi used MySQL Shell for VS Code to run his demo. This extension enables interactive editing and execution of SQL for MySQL databases and MySQL Database Service. It integrates the MySQL shell directly into VS Code development workflows and it’s pretty nice!

Oracle Cloud for Digital Natives: Supporting Innovation and Growth (by Claire Binder)

Which are the 5 reasons why Digital Natives picked OCI?

1. Developer-First openness and flexibility, to speed acquisition
2. Advanced Data & AI Services, to achieve innovation and agility
3. Technical and global reach, to achieve scalability
4. Security, compliance and resilience, to control risks
5. Cost efficiency and TCO, to achieve optimized spending.

Linked to the point 4, there are several services in OCI to avoid data breaches in terms of prevention, monitoring, mitigation, protection, encryption and access.  

To select a Cloud provider, the recommendation would be to choose a solution which allows you to run converged open SQL databases, instead of single-use proprietary databases.

And finally, Oracle brings AI to your data with his new 23ai release and some of its features, such as Property Graphs and AI Vector Search.

Analytics at the speed of thoughts with HeatWave Lakehouse (by Nitin Kunal)

What is a Data Lake? It’s a cost efficient, scalable, online storage of data as file (for instance, Object Store). Data are not structured and non-transactional and can be sourced from Big Data frameworks.

Again, you could have 4 different platforms to maintain:

•  Your RDBMS
• A DWH system for analytics processing
• A Data Lake
• A ML & Gen-AI system.

Instead of that, your can merge everything in only one platform: HeatWave. And you can query near real time data with HeatWave Lakehouse because new data is available in seconds: that’s great!

Conclusion

1. If you have mixed workloads, if you start to work with AI and if you want to improve your performances, it is really worth taking a look at Oracle HeatWave. You can try it here for free.
2. We all know that AI is the future. These next years, we’ll be more and more challenged on GenAI, ML, vector processing and so on. With all this innovation, we must not lose sight of topics that remain crucial (and perhaps become even more important) such as security, reliability, availability, and best practices. With dbi services and Sequotech we can for sure help you with this transition.

L’article Oracle Technology Roundtable for Digital Natives – Let’s have a look at AI, Cloud and HeatWave est apparu en premier sur dbi Blog.

I wrote this article to show how you can integrate Legacy OEM with your Cloud environment in this case Oracle ExaCC.To have overall view on your Exadata X9M Cloud Infrastructure, statistics related to CPU/Memory/ASM Storage usage. Your on premise monitoring OEM can read data from Oracle cloud using OCI libraries and present them in combination with your standard DB/VMs target monitoring, this give you powerful tool for overall view on your Enterprise environment.

Since version OEM release update 13.5.0.23 of OMS / Agents. There is few new interesting Dashboards and panels related to OCI Exadata Infrastructure, also RU23 introduces the Oracle Enterprise Manager Cloud Control Exadata Management Pack and Zero Data Loss Recovery Appliance (ZDLRA) Management Pack, some Dashboards, panels view below:

Biggest advantage of this integration is that you will have wider view to your cloud environment, Concept of ExaCC is that you see and have access to VMs and databases, hardware of Exadata Dbservers and Cellservers are normally managed by Oracle.

Adding this OCI integration to OEM give you viasability of physical cell servers and their statistics.

Now lets move on how this can be configured

Prerequisites:

1. OEM OMS/Agents update to minimum 13.5.0.23 (AUG 07/2024), why? since this version there is OCI integration enhancements and new dashboards,management packs for ExaCC. I described this in another post link here: https://www.dbi-services.com/blog/oem-cloud-control-release-update-to-13-5-0-23
2. Get your Exacli user/password to cellservers from your environment , in procedure I will describe how to do it
3. Have OCI client/libraries installed on one of Agents host.
4. Have access to OCI directly or over HTTPS proxy from Agent host.

Step by Step Procedure:

Get Exacli username and password to your ExaCC cellservers(this step is optional but recommend to have more statistics from cell servers.

Login to one of yours Virtual Exadata vm server and check username and password for StorageCells.

username usually have format: cloud_user_<crs_cluster_name>

to get clustername and password ,login as grid user end execute:

[grid@s***n1 ~]$ crsctl get cluster name; 
CRS-6724: Current cluster name is 'zh1234clua1' 

#so in this case username will be cloud_user_zh1234clua1

#now get Exadata initial password
[opc@s***n1 ~]$ sudo su - 
[root@s***n1 ~]# /opt/exacloud/get_cs_data.py 
*** WARNING : deprecated key derivation used. 
Using -iter or -pbkdf2 would be better. 
ExaCli initial password is: 
 **************************** 


#Collect the storage server IP address from 
/etc/oracle/cell/network-config/cellip.ora on the VM Guest. 

#Test Connection to one of cell IP addresses 
#using exacli provide username and password gathered above 
exacli -l cloud_user_zh1234clua1 -c 100.100.0.13 -e list physicaldisk 
Password: **************************** 

#in output you should receive disk list from Storage cell , if not then means that your username or passwords are incorrect.

Save credentials for later.

Create new named credentials in OEM:

Go to Setup > Security > Named Credentials and create new with user and passwords saved above:

Now we have connection between OEM and storage Cellservers.

Create user/group/policy for monitoring and assign proper policy’s in OCI.

Login to OCI and create new user,group and policys

Go to Identity > Domains > Groups and create new (use name which apply to your naming convention

Create New user and attache to Group created earler:

Create API keys:

Copy OCI configuration config file and save ssh key.

Create new policy with 2 Statements (privileges to be able to read your compartment objects) like below:

Go to Identity & Security > Policies

Download and install OCI Client on your server.

In our case, we installing OCI on OMS server and use EM Agent deployed to this machine. To use OCI API to connect and gather data from Oracle Cloud about our infrastructure using HTTPS_PROXY server.

To install OCI please follow official documentation, there are different options of installation and OS versions: https://docs.oracle.com/en-us/iaas/Content/API/SDKDocs/cliinstall.htm#InstallingCLI__oraclelinux8

In our case we installing OCI Cli as oracle user on Oracle Linux 8

First we set http/s proxy :

oracle@agent1:~/ export HTTPS_PROXY=http://proxy.proxy.com:3038 
oracle@agent1:~/ export HTTP_PROXY=http://proxy.proxy.com:3038 

Download newest OCI libraries :

oracle@agent1:~/# mkdir -p /u01/app/oracle/oci/
oracle@agent1:~/# cd  /u01/app/oracle/oci/
oracle@agent1:/u01/app/oracle/oci/# bash -c "$(curl -L https://raw.githubusercontent.com/oracle/oci-cli/master/scripts/install/install.sh)" 

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current 
                                 Dload  Upload   Total   Spent    Left  Speed 
100 16926  100 16926    0     0   199k      0 --:--:-- --:--:-- --:--:--  199k 
    ****************************************************************************** 
    You have started the OCI CLI Installer in interactive mode. If you do not wish 
    to run this in interactive mode, please include the --accept-all-defaults option. 
    If you have the script locally and would like to know more about 
    input options for this script, then you can run: 
    ./install.sh -h 
    If you would like to know more about input options for this script, refer to: 
    https://github.com/oracle/oci-cli/blob/master/scripts/install/README.rst 
    ****************************************************************************** 
Downloading Oracle Cloud Infrastructure CLI install script from https://raw.githubusercontent.com/oracle/oci-cli/v3.2.1/scripts/install/install.py to /tmp/oci_cli_install_tmp_VwnM. 
######################################################################################################################################################################### 100.0% 
Running install script. 
python3 /tmp/oci_cli_install_tmp_VwnM 
-- Verifying Python version. 
-- Python version 3.6.8 okay. 
===> In what directory would you like to place the install? (leave blank to use '/home/oracle/lib/oracle-cli'): 
-- Creating directory '/home/oracle/lib/oracle-cli'. 
-- We will install at '/home/oracle/lib/oracle-cli'. 
===> In what directory would you like to place the 'oci' executable? (leave blank to use '/home/oracle/bin'): 
-- Creating directory '/home/oracle/bin'. 
-- The executable will be in '/home/oracle/bin'. 
===> In what directory would you like to place the OCI scripts? (leave blank to use '/home/oracle/bin/oci-cli-scripts'): 
-- Creating directory '/home/oracle/bin/oci-cli-scripts'. 
-- The scripts will be in '/home/oracle/bin/oci-cli-scripts'. 
===> Currently supported optional packages are: ['db (will install cx_Oracle)'] 
What optional CLI packages would you like to be installed (comma separated names; press enter if you don't need any optional packages)?: 
-- The optional packages installed will be ''. 
-- Trying to use python3 venv. 
-- Executing: ['/usr/bin/python3', '-m', 'venv', '/home/oracle/lib/oracle-cli'] 
-- Executing: ['/home/oracle/lib/oracle-cli/bin/pip', 'install', '--upgrade', 'pip'] 
Collecting pip 
  Downloading https://files.pythonhosted.org/packages/a4/6d/6463d49a933f547439d6b5b98b46af8742cc03ae83543e4d7688c2420f8b/pip-21.3.1-py3-none-any.whl (1.7MB) 
    100% |████████████████████████████████| 1.7MB 847kB/s 
Installing collected packages: pip 
  Found existing installation: pip 9.0.3 
    Uninstalling pip-9.0.3: 
      Successfully uninstalled pip-9.0.3 
Successfully installed pip-21.3.1 
You are using pip version 21.3.1, however version 24.2 is available. 
You should consider upgrading via the 'pip install --upgrade pip' command. 
-- Executing: ['/home/oracle/lib/oracle-cli/bin/pip', 'install', '--cache-dir', '/tmp/tmpk9na7c02', 'wheel', '--upgrade'] 
Collecting wheel 
  Downloading wheel-0.37.1-py2.py3-none-any.whl (35 kB) 
Installing collected packages: wheel 
Successfully installed wheel-0.37.1 
-- Executing: ['/home/oracle/lib/oracle-cli/bin/pip', 'install', '--cache-dir', '/tmp/tmpk9na7c02', 'oci_cli', '--upgrade'] 
Collecting oci_cli 
  Downloading oci_cli-3.48.0-py3-none-any.whl (50.7 MB) 
     |████████████████████████████████| 50.7 MB 2.6 MB/s 
Collecting jmespath==0.10.0 
  Downloading jmespath-0.10.0-py2.py3-none-any.whl (24 kB) 
Collecting prompt-toolkit==3.0.29 
  Downloading prompt_toolkit-3.0.29-py3-none-any.whl (381 kB) 
     |████████████████████████████████| 381 kB 51.8 MB/s 
Collecting arrow>=1.0.0 
  Donloading arrow-1.2.3-py3-none-any.whl (66 kB) 
     |████████████████████████████████| 66 kB 14.0 MB/s 
Collecting PyYAML<=6.0.1,>=5.4 
  Downloading PyYAML-6.0.1-cp36-cp36m-manylinux_2_17_x86_64.manylinux2014_x86_64.whl (677 kB) 
     |████████████████████████████████| 677 kB 47.5 MB/s 
Collecting oci==2.134.0 
  Downloading oci-2.134.0-py3-none-any.whl (27.9 MB) 
     |████████████████████████████████| 27.9 MB 96.5 MB/s 
Collecting terminaltables==3.1.10 
  Downloading terminaltables-3.1.10-py2.py3-none-any.whl (15 kB) 
Collecting certifi 
  Downloading certifi-2024.8.30-py3-none-any.whl (167 kB) 
     |████████████████████████████████| 167 kB 106.3 MB/s 
Collecting cryptography<43.0.0,>=3.2.1 
  Downloading cryptography-40.0.2-cp36-abi3-manylinux_2_28_x86_64.whl (3.7 MB) 
     |████████████████████████████████| 3.7 MB 25.3 MB/s 
Collecting six>=1.15.0 
  Downloading six-1.16.0-py2.py3-none-any.whl (11 kB) 
Collecting pyOpenSSL<25.0.0,>=17.5.0 
  Downloading pyOpenSSL-23.2.0-py3-none-any.whl (59 kB) 
     |████████████████████████████████| 59 kB 18.3 MB/s 
Collecting python-dateutil<3.0.0,>=2.5.3 
  Downloading python_dateutil-2.9.0.post0-py2.py3-none-any.whl (229 kB) 
     |████████████████████████████████| 229 kB 61.2 MB/s 
Collecting pytz>=2016.10 
  Downloading pytz-2024.2-py2.py3-none-any.whl (508 kB) 
     |████████████████████████████████| 508 kB 99.2 MB/s 
Collecting click==8.0.4 
  Downloading click-8.0.4-py3-none-any.whl (97 kB) 
     |████████████████████████████████| 97 kB 19.2 MB/s 
Collecting importlib-metadata 
  Downloading importlib_metadata-4.8.3-py3-none-any.whl (17 kB) 
Collecting circuitbreaker<2.0.0,>=1.3.1 
  Downloading circuitbreaker-1.4.0.tar.gz (9.7 kB) 
  Preparing metadata (setup.py) ... done 
Collecting wcwidth 
  Downloading wcwidth-0.2.13-py2.py3-none-any.whl (34 kB) 
Collecting typing-extensions 
  Downloading typing_extensions-4.1.1-py3-none-any.whl (26 kB) 
Collecting cffi>=1.12 
  Downloading cffi-1.15.1-cp36-cp36m-manylinux_2_5_x86_64.manylinux1_x86_64.whl (402 kB) 
     |████████████████████████████████| 402 kB 30.7 MB/s 
Collecting pycparser 
  Downloading pycparser-2.21-py2.py3-none-any.whl (118 kB) 
     |████████████████████████████████| 118 kB 89.7 MB/s 
Collecting zipp>=0.5 
  Downloading zipp-3.6.0-py3-none-any.whl (5.3 kB) 
Building wheels for collected packages: circuitbreaker 
  Building wheel for circuitbreaker (setup.py) ... done 
  Created wheel for circuitbreaker: filename=circuitbreaker-1.4.0-py3-none-any.whl size=7506 sha256=cd24462c8ab8bb71fba04fa996852c0cff6c93749f3a2c74591f3a1cbfa756ec 
  Stored in directory: /tmp/tmpk9na7c02/wheels/46/17/98/db2eb826e4a98da672cffe66ec16838182cde0cf19ad2c0c70 
Successfully built circuitbreaker 
Installing collected packages: pycparser, cffi, zipp, typing-extensions, six, cryptography, wcwidth, pytz, python-dateutil, pyOpenSSL, importlib-metadata, circuitbreaker, certifi, terminaltables, PyYAML, prompt-toolkit, oci, jmespath, click, arrow, oci-cli 
Successfully installed PyYAML-6.0.1 arrow-1.2.3 certifi-2024.8.30 cffi-1.15.1 circuitbreaker-1.4.0 click-8.0.4 cryptography-40.0.2 importlib-metadata-4.8.3 jmespath-0.10.0 oci-2.134.0 oci-cli-3.48.0 prompt-toolkit-3.0.29 pyOpenSSL-23.2.0 pycparser-2.21 python-dateutil-2.9.0.post0 pytz-2024.2 six-1.16.0 terminaltables-3.1.10 typing-extensions-4.1.1 wcwidth-0.2.13 zipp-3.6.0 

===> Modify profile to update your $PATH and enable shell/tab completion now? (Y/n): n 

-- If you change your mind, add 'source /home/oracle/lib/oracle-cli/lib/python3.6/site-packages/oci_cli/bin/oci_autocomplete.sh' to your rc file and restart your shell to enable tab completion. 

-- You can run the CLI with '/home/oracle/bin/oci'. 

-- Installation successful. 

-- Run the CLI with /home/oracle/bin/oci --help 

Configure credenials to OCI user and copy API private key to host:

oracle@agent1:~/# vi .oci/config 
[DEFAULT] 
user=ocid1.user.ooracle@agent1:~/#
fingerprint=.*********************************
tenancy=ocid1.tenancy..*********************************
region=eu-zurich-1 
key_file=/home/oracle/.oci/oem_ro.pem 

 
#Create private key you can copy or create by copy/past with vi
oracle@agent1:~/# vi /home/oracle/.oci/oem_ro.pem 
 -----BEGIN PRIVATE KEY----- 
*** 
*** 
*** 
*** 
*** 
-----END PRIVATE KEY----- 

# Test your connection and gather some info for example compartment list
oracle@agent1:~/#  oci iam compartment list
{ 
  "data": [ 
    { 
      "compartment-id": "ocid1.tenancy.oc1..*********************************", 
      "defined-tags": { 
        "Oracle-Tags": { 
          "CreatedBy": "*********************************@*********************************.com", 
          "CreatedOn": "2023-06-15T15:28:03.408Z" 
        } 
      }, 
      "description": "Exadata Cloud@Customer database service", 
      "freeform-tags": {}, 
      "id": "ocid1.compartment.o*********************************", 
      "inactive-status": null, 
      "is-accessible": null, 
      "lifecycle-state": "ACTIVE", 
      "name": "ExaCC*********************************", 
      "time-created": "2023-06-15T15:28:03.545000+00:00" 
    } 
  ] 
} 

Set https proxy for your OEM agent (which later will be used to communicate with OCI)

edit emd.properties and add on the end 2 extra parameters.

oci_http_proxy_host=

oci_http_proxy_port=

#Configure proxy on your agent installation folder: 

oracle@agent1:~/#  vi/u01/app/oracle/agent/agent_inst/sysman/config/emd.properties
oci_http_proxy_host=proxy.proxy.com 
oci_http_proxy_port=3038 

#Restart Agent
oracle@agent1:~/# emctl stop agent 
Oracle Enterprise Manager Cloud Control 13c Release 5 
Copyright (c) 1996, 2021 Oracle Corporation.  All rights reserved. 
Stopping agent ... stopped. 

oracle@agent1:~/#  [emagent1350] emctl start agent 
Oracle Enterprise Manager Cloud Control 13c Release 5 
Copyright (c) 1996, 2021 Oracle Corporation.  All rights reserved. 
Starting agent ........... started. 

Configure named credentials in OEM for OCI :

Go to Setup > Security > Named Credentials Click Create tab and create credentials using keys and OCI tenants keys copied from config or credentials:

next you can test it choice agent on which we installed oci and configure proxy.

Deploy Exadata plugins on Agents:

Go to Setup > Extensibility > Plug-ins

Choice:

Engineered Systems > Oracle Exadata

Click Deploy on and choice targets you wanna deploy it:

Follow logs to check if deployment successful :

Discovering ExaCC targets

Now we have all prerequisites configured and tested so we can discover our ExaCC :

Go to > Setup > Add Target > Add Target Manually > Add Using Guided Process

Choice target ExaCC infrastructure you wanna add to OEM , you can Also specify ExaCLI credentials to monitor Cellservers and ASMs (optional) We gather this credentials earlier in this tutorial.

Now you can Click next and Promote , and watch status of Target Promotions.

Please also turn on management packs for ExaCC

Go to Setup > Management Pack > Management Pack Access >

After Promotion finish you should have new entry in Target tab:

and Few minutes later you should also see your Oracle Cloud ExaCC infrastructure with all VMs and Databases.

You can go to each Exadata Cluster and see more details, also to ASM Grid Infrastructure:

Cell Statistics:

Please wait for some metrics and statistics some of them need up to 24h to be gathered.

One more interesting functionality of this integration is that there are new Dashboards

For Example Exadata Fleet Aggregated Capacity , Configuration , etc.

They can help you with overall look and capacity planning for future, you can see your total storage, memory current usage and historical values so you can predict growing trend in future.

I hope you enjoy this tutorial and already plan your ExaCC integration 😉

L’article ExaCC OCI integration with OEM 13.5 Cloud Control installed On-premises. est apparu en premier sur dbi Blog.