The ZDM 21.5 version brings some new functions like encrypting automatically now the TEMP, SYSTEM, SYSAUX and UNDO tablespaces. There is no need to do it manually any more after the ZDM migration, ZDM will take care of it on its own. Little problem, this is adding a new bug because the temporary database needs to be restarted to drop the previous TEMP tablespace. Let’s see how to resolve the problem and move forward with the ZDM migration.

Problem description

After switchover is run by ZDM, the TEMP, SYSTEM, SYSAUX and UNDO tablespaces are now encrypted by ZDM during the ZDM_POST_DATABASE_OPEN_TGT step. In my case described here, I was doing a dry run, so I manually ran a failover to the target environment to avoid any impact and downtime to the source database. It was currently a dry run and not the final migration. Thus, after having paused the ZDM migration once the Data Guard configuration was setup (ZDM_CONFIGURE_DG_SRC step), I manually ran the failover and then moved forward with the ZDM Migration using the -skip SWITCHOVER option. I have explained this in one of my previous ZDM blog if you want more details.

I’m running same kind of migration I was doing with 21.4 version, non-cdb as source and including conversion to pdb during ZDM migration.

So, after failover has been run manually, I resumed the ZDM migration till the end.

[exauser@zdm-host ~]$ zdmcli resume job -jobid 580 -skip SWITCHOVER
zdm-host.domain.com: Audit ID: 6963

As we can see, the ZDM job failed on the ZDM_POST_DATABASE_OPEN_TGT step.

[exauser@zdm-host ~]$ zdmcli query job -jobid 580
zdm-host.domain.com: Audit ID: 6966
Job ID: 580
User: exauser
Client: zdm-host
Job Type: "MIGRATE"
Scheduled job command: "zdmcli migrate database -sourcesid SRCSID -rsp /home/exauser/migration/zdm_SRCSID_physical_online.rsp -sourcenode dbsource-host -srcauth dbuser -srcarg1 user:oracle -srcarg2 identity_file:/home/exauser/.ssh/id_rsa -targetnode exacc-cl01n1 -tgtauth zdmauth -tgtarg1 user:opc -tgtarg2 identity_file:/home/exauser/.ssh/id_rsa -tgtarg3 sudo_location:/usr/bin/sudo -tdekeystorepasswd -tgttdekeystorepasswd -pauseafter ZDM_COPYFILES"
Scheduled job execution start time: 2025-06-11T17:09:40+02. Equivalent local time: 2025-06-11 17:09:40
Current status: FAILED
Result file path: "/u01/app/oracle/chkbase/scheduled/job-580-2025-06-11-17:10:06.log"
Metrics file path: "/u01/app/oracle/chkbase/scheduled/job-580-2025-06-11-17:10:06.json"
Job execution start time: 2025-06-11 17:10:07
Job execution end time: 2025-06-12 10:04:40
Job execution elapsed time: 2 hours 52 minutes 48 seconds
ZDM_GET_SRC_INFO .............. COMPLETED
ZDM_GET_TGT_INFO .............. COMPLETED
ZDM_PRECHECKS_SRC ............. COMPLETED
ZDM_PRECHECKS_TGT ............. COMPLETED
ZDM_SETUP_SRC ................. COMPLETED
ZDM_SETUP_TGT ................. COMPLETED
ZDM_PREUSERACTIONS ............ COMPLETED
ZDM_PREUSERACTIONS_TGT ........ COMPLETED
ZDM_VALIDATE_SRC .............. COMPLETED
ZDM_VALIDATE_TGT .............. COMPLETED
ZDM_DISCOVER_SRC .............. COMPLETED
ZDM_COPYFILES ................. COMPLETED
ZDM_PREPARE_TGT ............... COMPLETED
ZDM_SETUP_TDE_TGT ............. COMPLETED
ZDM_RESTORE_TGT ............... COMPLETED
ZDM_RECOVER_TGT ............... COMPLETED
ZDM_FINALIZE_TGT .............. COMPLETED
ZDM_CONFIGURE_DG_SRC .......... COMPLETED
ZDM_SWITCHOVER_SRC ............ COMPLETED
ZDM_SWITCHOVER_TGT ............ COMPLETED
ZDM_POST_DATABASE_OPEN_TGT .... FAILED
ZDM_DATAPATCH_TGT ............. PENDING
ZDM_NONCDBTOPDB_PRECHECK ...... PENDING
ZDM_NONCDBTOPDB_CONVERSION .... PENDING
ZDM_POST_MIGRATE_TGT .......... PENDING
ZDM_POSTUSERACTIONS ........... PENDING
ZDM_POSTUSERACTIONS_TGT ....... PENDING
ZDM_CLEANUP_SRC ............... PENDING
ZDM_CLEANUP_TGT ............... PENDING
[exauser@zdm-host ~]$

ZDM log file would show the problem coming from the TEMP tablespace encryption.

[exauser@zdm-host ~]$ tail -f /u01/app/oracle/chkbase/scheduled/job-580-2025-06-11-17:10:06.log
####################################################################
zdm-host: 2025-06-12T08:01:48.268Z : Resuming zero downtime migrate operation ...
zdm-host: 2025-06-12T08:01:52.847Z : Skipping phase ZDM_PRECHECKS_SRC on resume
zdm-host: 2025-06-12T08:01:53.255Z : Skipping phase ZDM_PRECHECKS_TGT on resume
zdm-host: 2025-06-12T08:01:53.273Z : Executing phase ZDM_SETUP_SRC
zdm-host: 2025-06-12T08:01:53.274Z : Setting up ZDM on the source node dbsource-host ...
dbsource-host: 2025-06-12T08:02:23.476Z : TNS aliases successfully setup on the source node source-hostname...
dbsource-host: 2025-06-12T08:02:34.101Z : successfully registered ZDM with the database SRCSID
zdm-host: 2025-06-12T08:02:34.106Z : Execution of phase ZDM_SETUP_SRC completed
zdm-host: 2025-06-12T08:02:34.123Z : Executing phase ZDM_SETUP_TGT
zdm-host: 2025-06-12T08:02:34.123Z : Setting up ZDM on the target node exacc-cl01n1 ...
exacc-cl01n1: 2025-06-12T08:03:00.739Z : TNS aliases successfully setup on the target node exacc-cl01n1...
zdm-host: 2025-06-12T08:03:00.742Z : Execution of phase ZDM_SETUP_TGT completed
zdm-host: 2025-06-12T08:03:00.754Z : Skipping phase ZDM_VALIDATE_SRC on resume
zdm-host: 2025-06-12T08:03:00.765Z : Skipping phase ZDM_VALIDATE_TGT on resume
zdm-host: 2025-06-12T08:03:00.779Z : Skipping phase ZDM_DISCOVER_SRC on resume
zdm-host: 2025-06-12T08:03:00.789Z : Skipping phase ZDM_COPYFILES on resume
zdm-host: 2025-06-12T08:03:00.802Z : Skipping phase ZDM_PREPARE_TGT on resume
zdm-host: 2025-06-12T08:03:00.813Z : Skipping phase ZDM_SETUP_TDE_TGT on resume
zdm-host: 2025-06-12T08:03:00.823Z : Skipping phase ZDM_RESTORE_TGT on resume
zdm-host: 2025-06-12T08:03:00.833Z : Skipping phase ZDM_RECOVER_TGT on resume
zdm-host: 2025-06-12T08:03:00.843Z : Skipping phase ZDM_FINALIZE_TGT on resume
zdm-host: 2025-06-12T08:03:00.844Z : resuming job execution from phase "ZDM_CONFIGURE_DG_SRC"
zdm-host: 2025-06-12T08:03:00.859Z : Skipping phase ZDM_CONFIGURE_DG_SRC on resume
zdm-host: 2025-06-12T08:03:00.880Z : Executing phase ZDM_SWITCHOVER_SRC
zdm-host: 2025-06-12T08:03:00.881Z : Switching database null on the source node dbsource-host to standby role ...
dbsource-host: 2025-06-12T08:03:11.403Z : Switchover actions in the source environment executed successfully
zdm-host: 2025-06-12T08:03:11.407Z : Execution of phase ZDM_SWITCHOVER_SRC completed
####################################################################
zdm-host: 2025-06-12T08:03:11.445Z : Executing phase ZDM_SWITCHOVER_TGT
zdm-host: 2025-06-12T08:03:11.445Z : Switching database SRCSID_CHZ1 on the target node exacc-cl01n1 to primary role ...
exacc-cl01n1: 2025-06-12T08:03:23.137Z : Switchover actions in the target environment executed successfully
zdm-host: 2025-06-12T08:03:23.241Z : Execution of phase ZDM_SWITCHOVER_TGT completed
####################################################################
zdm-host: 2025-06-12T08:03:23.279Z : Executing phase ZDM_POST_DATABASE_OPEN_TGT
zdm-host: 2025-06-12T08:03:23.280Z : Executing post database open actions at the target ...
exacc-cl01n1: 2025-06-12T08:03:34.667Z : Restoring pluggable database state ...
exacc-cl01n1: 2025-06-12T08:03:35.368Z : Creating SSO for keystore location /u02/app/oracle/zdm/zdm_SRCSID_CHZ1_580/zdm/TDE/tde/ ...
exacc-cl01n1: 2025-06-12T08:03:35.569Z : Restoring RMAN configuration ...
exacc-cl01n1: 2025-06-12T08:03:40.374Z : Encrypting unencrypted temp tablespaces...
####################################################################
zdm-host: 2025-06-12T08:04:40.845Z : Oracle ZDM ONLINE PHYSICAL migration failed
zdm-host: 2025-06-12T08:04:40.845Z : Failed at phase: ZDM_POST_DATABASE_OPEN_TGT
zdm-host: 2025-06-12T08:04:40.846Z : Job duration: 2 minutes and 56 seconds
PRGZ-3727 : Re-creation of temporary tablespace "TEMP" as encrypted for database "PDB001P" failed.

Troubleshooting

Let’s investigate the issue.

The ZDM step log, named zdm_post_database_open_tgt, would show exactly the issue and the command that are expected to be run.

oracle@exacc-cl01n1:/u02/app/oracle/zdm/zdm_SRCSID_CHZ1_580/zdm/log/ [PDB001P1 (CDB$ROOT)] view zdm_post_database_open_tgt_7924.log
...
...
...
[jobid-580][2025-06-12T08:03:41Z][mZDM_Queries.pm:655]:[DEBUG] Will be running following sql statements as user: oracle:

        export ORACLE_HOME=/u02/app/oracle/product/19.0.0.0/dbhome_1,
        export ORACLE_SID=PDB001P1,
        /u02/app/oracle/product/19.0.0.0/dbhome_1/bin/sqlplus -L / as sys ******

        set pagesize 0 feedback off verify off heading off echo off tab off linesize 32767 trimspool on trimout on wrap off
CREATE BIGFILE TEMPORARY TABLESPACE TEMP_ENCRYPTED TEMPFILE ENCRYPTION ENCRYPT
ALTER DATABASE DEFAULT TEMPORARY TABLESPACE TEMP_ENCRYPTED
DROP TABLESPACE TEMP INCLUDING CONTENTS
ALTER TABLESPACE TEMP_ENCRYPTED RENAME TO TEMP

[jobid-580][2025-06-12T08:03:41Z][mZDM_Utils.pm:3438]:[DEBUG] run_as_user2: Running /*******@/u02/app/oracle/zdm/zdm_SRCSID_CHZ1_580/zdm/out/sql/tmpsql_2025-06-12-08-03-41_7924.sql '
[jobid-580][2025-06-12T08:04:41Z][mZDM_Utils.pm:3460]:[DEBUG] Remove /tmp/xE6e9fcUzC
[jobid-580][2025-06-12T08:04:41Z][mZDM_Utils.pm:3468]:[DEBUG] /bin/su successfully executed

[jobid-580][2025-06-12T08:04:41Z][mZDM_Queries.pm:678]:[DEBUG] Output is :
 SQL*Plus: Release 19.0.0.0.0 - Production on Thu Jun 12 08:03:41 2025
 Version 19.26.0.0.0

 Copyright (c) 1982, 2024, Oracle.  All rights reserved.


 Connected to:
 Oracle Database 19c EE Extreme Perf Release 19.0.0.0.0 - Production
 Version 19.26.0.0.0

 DROP TABLESPACE TEMP INCLUDING CONTENTS
 *
 ERROR at line 1:
 ORA-60100: dropping temporary tablespace with tablespace ID number (tsn) 3 is blocked due to sort segments


 ALTER TABLESPACE TEMP_ENCRYPTED RENAME TO TEMP
 *
 ERROR at line 1:
 ORA-02154: a tablespace with the name 'TEMP' is found


 Disconnected from Oracle Database 19c EE Extreme Perf Release 19.0.0.0.0 - Production
 Version 19.26.0.0.0

[jobid-580][2025-06-12T08:04:41Z][mZDM_Queries.pm:11791]:[ERROR] SQL Error recreating temp tablespace TEMP as encrypted for database 'PDB001P'
[jobid-580][2025-06-12T08:04:41Z][mZDM_Utils.pm:4632]:[ERROR] Reporting  error :

The TEMP tablespace can not be dropped, the database needs to be restarted.

Resolution

Let’s first create a pfile for the temporary non-CDB database ZDM created for the migration. Reminder, this temporary database will have as instance name and db_unique_name the name of the final PDB. And of course as DB_NAME the same than our source database, mandatory, when using HA primary and standby databases. I will create a pfile just in case…

I created a pfile from memory:

oracle@exacc-cl01n1:/u02/app/oracle/zdm/zdm_SRCSID_CHZ1_580/zdm/log/ [PDB001P1 (CDB$ROOT)] sqh

SQL*Plus: Release 19.0.0.0.0 - Production on Thu Jun 12 10:14:20 2025
Version 19.26.0.0.0

Copyright (c) 1982, 2024, Oracle.  All rights reserved.


Connected to:
Oracle Database 19c EE Extreme Perf Release 19.0.0.0.0 - Production
Version 19.26.0.0.0

SQL> create pfile='/u02/app/oracle/zdm/zdm_SRCSID_CHZ1_580/zdm/log/init_PDB001P1.ora.bck.before.restart' from memory;

File created.

And a pfile from spfile:

SQL> show parameter spfile

NAME                                 TYPE                              VALUE
------------------------------------ --------------------------------- ------------------------------
spfile                               string                            /u02/app/oracle/product/19.0.0
                                                                       .0/dbhome_1/dbs/spfileAVQPZ_AP
                                                                       P_001P1.ora

SQL> create pfile='/u02/app/oracle/zdm/zdm_SRCSID_CHZ1_580/zdm/log/init_PDB001P1.ora.bck.before.restart.from.spfile' from spfile='/u02/app/oracle/product/19.0.0.0/dbhome_1/dbs/spfilePDB001P1.ora';

File created.

SQL>

I restarted the temporary non-CDB

SQL> shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.

SQL> startup
ORACLE instance started.

Total System Global Area 8577884400 bytes
Fixed Size                 13693168 bytes
Variable Size            3439329280 bytes
Database Buffers         5100273664 bytes
Redo Buffers               24588288 bytes
Database mounted.
ORA-28374: typed master key not found in wallet

ORA-28374 Failure. Would be the same if I start with the pfile, so there was some missing parameter into the spfile.

Confirmed, there is no wallet_root instance parameter configured.

SQL> show parameter wallet

NAME                                 TYPE                              VALUE
------------------------------------ --------------------------------- ------------------------------
ssl_wallet                           string
wallet_root                          string

And confirmed it was not in the pfile.

SQL> !grep -i wallet /u02/app/oracle/zdm/zdm_SRCSID_CHZ1_580/zdm/log/init_PDB001P1.ora.bck.before.restart

SQL>

We can easily find the directory where ZDM copied the wallet…

oracle@exacc-cl01n1:/u02/app/oracle/zdm/zdm_SRCSID_CHZ1_580/zdm/log/ [PDB001P1 (CDB$ROOT)] ls -ltrh /u02/app/oracle/zdm/zdm_SRCSID_CHZ1_580/zdm/TDE/tde
total 92K
-rw-r----- 1 oracle oinstall 2.5K Jun 27  2024 ewallet_2024062706422567.p12
-rw-r----- 1 oracle oinstall    0 Jun 27  2024 ewallet.p12.lck
-rw-r----- 1 oracle oinstall    0 Jun 27  2024 cwallet.sso.lck
-rw-r----- 1 oracle oinstall 4.0K Sep 19  2024 ewallet_2024091909561990_pre-refresh-AVQZZ_APP_001T.p12
-rw-r----- 1 oracle oinstall 5.2K Jan 16 10:54 ewallet_2025011609540081_pre-refresh-AVQZZ_APP_001T-20250116.p12
-rw-r----- 1 oracle oinstall 6.4K Feb 27 09:28 ewallet_2025022708284959_pre-refresh-AVQZZ_APP_001T-20250227.p12
-rw-r----- 1 oracle oinstall 7.7K Mar 31 14:10 ewallet_2025033112100549_pre-refresh-AVQZZ_APP_001T-20250331.p12
-rw-r----- 1 oracle oinstall 8.9K Jun 11 13:58 ewallet_2025061111581822_chg_password_to_prod.p12
-rw-r----- 1 oracle oinstall  11K Jun 11 14:00 ewallet.p12
-rw-r----- 1 oracle oinstall 8.9K Jun 11 14:00 ewallet_2025061112003957_pre-dryrun-SRCSID-to-prodAVAPCl.p12
-rw-r----- 1 oracle oinstall  11K Jun 11 14:00 cwallet.sso.back
-rw------- 1 oracle asmdba    11K Jun 12 10:03 cwallet.sso
oracle@exacc-cl01n1:/u02/app/oracle/zdm/zdm_SRCSID_CHZ1_580/zdm/log/ [PDB001P1 (CDB$ROOT)]

Let’s configure it!

oracle@exacc-cl01n1:/u02/app/oracle/zdm/zdm_SRCSID_CHZ1_580/zdm/log/ [PDB001P1 (CDB$ROOT)] sqh

SQL*Plus: Release 19.0.0.0.0 - Production on Thu Jun 12 12:34:45 2025
Version 19.26.0.0.0

Copyright (c) 1982, 2024, Oracle.  All rights reserved.


Connected to:
Oracle Database 19c EE Extreme Perf Release 19.0.0.0.0 - Production
Version 19.26.0.0.0

SQL> alter system set WALLET_ROOT='/u02/app/oracle/zdm/zdm_SRCSID_CHZ1_580/zdm/TDE' scope=spfile;

System altered.

Let’s restart the database again.

SQL> shutdown immediate
ORA-01109: database not open


Database dismounted.
ORACLE instance shut down.

SQL> startup
ORACLE instance started.

Total System Global Area 8577884400 bytes
Fixed Size                 13693168 bytes
Variable Size            3439329280 bytes
Database Buffers         5100273664 bytes
Redo Buffers               24588288 bytes
Database mounted.
ORA-28365: wallet is not open

Wallet is recognised but not opened.

Confirmed:

SQL> set lines 300
SQL> col WRL_PARAMETER for a30
SQL> col WRL_TYPE for a30
SQL> col WALLET_TYPE for a30
SQL> col status for a40
SQL> select WRL_PARAMETER, WRL_TYPE,WALLET_TYPE, status from V$ENCRYPTION_WALLET;

WRL_PARAMETER                  WRL_TYPE                       WALLET_TYPE                    STATUS
------------------------------ ------------------------------ ------------------------------ ----------------------------------------
                               FILE                           UNKNOWN                        NOT_AVAILABLE


tde_configuration parameter is not configured.

SQL> show parameter tde_configuration

NAME                                 TYPE                              VALUE
------------------------------------ --------------------------------- ------------------------------
tde_configuration                    string

Let’s configure it.

SQL> alter system set tde_configuration='keystore_configuration=FILE' scope=both;

System altered.

Checking, we can see that the wallet is now opened.

SQL> select WRL_PARAMETER, WRL_TYPE,WALLET_TYPE, status from V$ENCRYPTION_WALLET;

WRL_PARAMETER                    WRL_TYPE                       WALLET_TYPE                    STATUS
------------------------------   ------------------------------ ------------------------------ ----------------------------------------
/u02/app/oracle/zdm/zdm_SRCSID_C FILE                           AUTOLOGIN                      OPEN
HZ1_580/zdm/TDE/tde/

And we can open the database now.

SQL> alter database open;

Database altered.

SQL>

And completed the command for the TEMP tablespace encryption.

SQL> DROP TABLESPACE TEMP INCLUDING CONTENTS;

Tablespace dropped.

SQL> ALTER TABLESPACE TEMP_ENCRYPTED RENAME TO TEMP;

Tablespace altered.

SQL>

We can now resume the ZDM job. As the TEMP tablespace is now encrypted, ZDM will move forward with the next actions from the ZDM_POST_DATABASE_OPEN_TGT phase. Which is good because updating the ZDM XML metadata file to consider the phase as successful would have as consequence some missing steps and actions.

Resume ZDM job again:

[exauser@zdm-host ~]$ zdmcli resume job -jobid 580 -skip SWITCHOVER
zdm-host.domain.com: Audit ID: 6969

And we can see that the ZDM migration is now completed successfully.

[exauser@zdm-host ~]$ zdmcli query job -jobid 580
zdm-host.domain.com: Audit ID: 6970
Job ID: 580
User: exauser
Client: zdm-host
Job Type: "MIGRATE"
Scheduled job command: "zdmcli migrate database -sourcesid SRCSID -rsp /home/exauser/migration/zdm_SRCSID_physical_online.rsp -sourcenode dbsource-host -srcauth dbuser -srcarg1 user:oracle -srcarg2 identity_file:/home/exauser/.ssh/id_rsa -targetnode exacc-cl01n1 -tgtauth zdmauth -tgtarg1 user:opc -tgtarg2 identity_file:/home/exauser/.ssh/id_rsa -tgtarg3 sudo_location:/usr/bin/sudo -tdekeystorepasswd -tgttdekeystorepasswd -pauseafter ZDM_COPYFILES"
Scheduled job execution start time: 2025-06-11T17:09:40+02. Equivalent local time: 2025-06-11 17:09:40
Current status: SUCCEEDED
Result file path: "/u01/app/oracle/chkbase/scheduled/job-580-2025-06-11-17:10:06.log"
Metrics file path: "/u01/app/oracle/chkbase/scheduled/job-580-2025-06-11-17:10:06.json"
Job execution start time: 2025-06-11 17:10:07
Job execution end time: 2025-06-12 16:02:54
Job execution elapsed time: 4 hours 37 minutes 44 seconds
ZDM_GET_SRC_INFO .............. COMPLETED
ZDM_GET_TGT_INFO .............. COMPLETED
ZDM_PRECHECKS_SRC ............. COMPLETED
ZDM_PRECHECKS_TGT ............. COMPLETED
ZDM_SETUP_SRC ................. COMPLETED
ZDM_SETUP_TGT ................. COMPLETED
ZDM_PREUSERACTIONS ............ COMPLETED
ZDM_PREUSERACTIONS_TGT ........ COMPLETED
ZDM_VALIDATE_SRC .............. COMPLETED
ZDM_VALIDATE_TGT .............. COMPLETED
ZDM_DISCOVER_SRC .............. COMPLETED
ZDM_COPYFILES ................. COMPLETED
ZDM_PREPARE_TGT ............... COMPLETED
ZDM_SETUP_TDE_TGT ............. COMPLETED
ZDM_RESTORE_TGT ............... COMPLETED
ZDM_RECOVER_TGT ............... COMPLETED
ZDM_FINALIZE_TGT .............. COMPLETED
ZDM_CONFIGURE_DG_SRC .......... COMPLETED
ZDM_SWITCHOVER_SRC ............ COMPLETED
ZDM_SWITCHOVER_TGT ............ COMPLETED
ZDM_POST_DATABASE_OPEN_TGT .... COMPLETED
ZDM_DATAPATCH_TGT ............. COMPLETED
ZDM_NONCDBTOPDB_PRECHECK ...... COMPLETED
ZDM_NONCDBTOPDB_CONVERSION .... COMPLETED
ZDM_POST_MIGRATE_TGT .......... COMPLETED
ZDM_POSTUSERACTIONS ........... COMPLETED
ZDM_POSTUSERACTIONS_TGT ....... COMPLETED
ZDM_CLEANUP_SRC ............... COMPLETED
ZDM_CLEANUP_TGT ............... COMPLETED
[exauser@zdm-host ~]$

In the migrated PDB we can see that all tablespaces are encrypted!

SQL> show pdbs

    CON_ID CON_NAME                       OPEN MODE  RESTRICTED
---------- ------------------------------ ---------- ----------
         3 PDB001P                 READ WRITE NO

SQL> select count(*) from  cdb_tablespaces a, (select x.con_id, y.ENCRYPTIONALG, x.name from V$TABLESPACE x,  V$ENCRYPTED_TABLESPACES y
  2    where x.ts#=y.ts# and x.con_id=y.con_id) b where a.con_id=b.con_id(+) and a.tablespace_name=b.name(+) and b.ENCRYPTIONALG='AES128';

  COUNT(*)
----------
      2803

SQL> select count(*) from  cdb_tablespaces a, (select x.con_id, y.ENCRYPTIONALG, x.name from V$TABLESPACE x,  V$ENCRYPTED_TABLESPACES y
  2    where x.ts#=y.ts# and x.con_id=y.con_id) b where a.con_id=b.con_id(+) and a.tablespace_name=b.name(+) and b.ENCRYPTIONALG is null;

  COUNT(*)
----------
         0

SQL> select a.con_id, a.tablespace_name, nvl(b.ENCRYPTIONALG,'NOT ENCRYPTED') from  cdb_tablespaces a, (select x.con_id, y.ENCRYPTIONALG, x.name from V$TABLESPACE x,  V$ENCRYPTED_TABLESPACES y
  2    where x.ts#=y.ts# and x.con_id=y.con_id) b where a.con_id=b.con_id(+) and a.tablespace_name=b.name(+) and b.ENCRYPTIONALG is null;

no rows selected

SQL>

To wrap up…

As explained in my previous blog, ZDM 21.5 version brings some correction, new functionnalities but also some new bug that I could easily mitigate.