Save your credential store before patching GoldenGate !

I recently had an issue with the GoldenGate credential store at a customer when patching a GoldenGate 19c setup with the latest 19.30 patch. Since it is not the first time that I have encountered this problem, I figured it would be worth doing some scripting around it. So what is the problem exactly ?

When patching a GoldenGate installation and restarting it, we had the following error with the credential store: OGG-30555 Timeout waiting for credential store wallet upgrade. The patching corrupted GoldenGate credential store.

GGSCI (vmogg) 1> info credentialstore

Reading from credential store:

Source Context
  SourceModule            : [ggsec.CCredentialStore]
  SourcelD                : [ggsec/CCredentialStore.cpp]
  SourceMethod            : [load]
  SourceLine              : [352]
  ThreadBacktrace         : [15]
...
                          : [/lib64/1ibc.so.6(__libc_start_main)]
                          : [./ggsci()]

2026-02-12 14:49:32 ERROR   OGG-30555  Timeout waiting for credential store wallet upgrade.

2026-02-12 14:49:32 ERROR   OGG-01668  PROCESS ABENDING.

I tried rolling back the patch, and the credential store was accessible. Applying the patch did break something, but how to solve this ?

If you encounter this error, you have three possibilities:

• If you are in a hurry, just roll back the patch. Whenever I had this issue, rolling back the patch corrected the issue. After rolling back, I had access to the credential store again. This is just a temporary workaround, of course, but it’s better than stopping all your replication processes. For this specific patch, you can do it with opatch rollback -id 38781237
• If you have the time, contact the Oracle Support. There might be a bigger problem here.
• Sometimes, recreating the credential store is the only solution.

We will focus on the third option here, trying to rebuild the credential store. But of course, if you cannot access the credential store, it is hard to know what needs to be recreated. This is why you should always make a backup of the credential store before patching ! In our case, rolling back the patch gave back access to the credential store, so I could retrieve the entries.

But because I was tired of encountering this issue, I made this script that will generate the instructions to recreate the credential store in case you have an issue when patching.

#!/bin/bash

OGG_HOME="/u01/app/oracle/product/ogg"
GGSCI="$OGG_HOME/ggsci"
domain="${1:-OracleGoldenGate}"
DEBUG="${DEBUG:-0}"

log() {
    [ "$DEBUG" -eq 1 ] && printf '%s\n' "$*" >&2
}

log "Processing domain: $domain"
log "Running: info credentialstore domain $domain"

domain_output="$(
    "$GGSCI" <<EOF
info credentialstore domain $domain
EOF
)"

log "Raw output:"
log "$domain_output"

commands="$(
    awk -v dom="$domain" '
    /Alias:/ {
        alias = $2
        getline
        if ($1 == "Userid:") {
            user = $2
            printf "alter credentialstore add user %s alias %s domain %s\n",
                   user, alias, dom
        }
    }' <<< "$domain_output"
)"

if [[ -n "$commands" ]]; then
    printf '%s\n' "$commands"
else
    log "No aliases found in domain $domain"
fi

You just have to run the script to get the credential store recreation instructions. If you have one or more custom domains in your credential store, run the script with the custom domain as an argument.

> ./recreate_credentialstore.sh
alter credentialstore add user [email protected] alias db01 domain OracleGoldenGate
alter credentialstore add user [email protected] alias db02 domain OracleGoldenGate
alter credentialstore add user [email protected] alias db03 domain OracleGoldenGate
alter credentialstore add user [email protected] alias db04 domain OracleGoldenGate

Or with a custom domain:

> ./recreate_credentialstore.sh CustomDomain
alter credentialstore add user [email protected] alias CustomDomain

Once you have this backup plan organized, to get rid of the OGG-30555 error after patching:

• Stop all GoldenGate processes
• Backup your credential store files. In the classic architecture, they are located in $OGG_HOME/dircrd
• Patch your GoldenGate setup
• Recreate the credential store with the following commands

GGSCI (vmogg) 1> drop credentialstore

Credential store deleted.

GGSCI (vmogg) 2> info credentialstore

Reading from credential store:

ERROR: Unable to open credential store.

GGSCI (vmogg) 3> add credentialstore

Credential store added.

GGSCI (vmogg) 4> alter credentialstore add user [email protected] alias db01 password ***

Credential store altered.

GGSCI (vmogg) 5> info credentialstore

Reading from credential store:

Default domain: OracleGoldenGate

  Alias: db01
  Userid: [email protected]

Make sure to integrate this in your GoldenGate patching strategy to avoid being surprised with a corrupted GoldenGate credential store ! And of course, this is also valid for GoldenGate 26ai.