Oracle® Database Vault

Installation Issues

This section describes the known issues pertaining to installation.

Enterprise manager configuration failed due to the following error - 
Database instance unavailable. Refer to the log file at 
/scratch/aime/102DV/060315/d1/dvn3/cfgtoollogs/dbca/dvn3/emConfig.log 
for more details. 
You can retry configuring this database with Enterprise Manager later 
by manually running /scratch/aime/102DV/060315/d1/dvn3/bin/emca script.

Mar 21, 2006 4:38:55 PM oracle.sysman.emcp.util.GeneralUtil initSQLEngine 
CONFIG: ORA-01031: insufficient privileges 

oracle.sysman.assistants.util.sqlEngine.SQLFatalErrorException: ORA-01031: 
insufficient privileges 
.... 
SEVERE: Database instance unavailable. 
Refer to the log file at /scratch/aime/102DV/060315/d1/dvn3/cfgtoollogs/dbca/dvn3/emConfig.log for more details. 
Mar 21, 2006 4:38:55 PM oracle.sysman.emcp.EMConfig perform 
CONFIG: Stack Trace: 
oracle.sysman.emcp.exception.EMConfigException: Database instance unavailable. 

ORACLEDB = (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST ....

ORACLEDB90 = (DESCRIPTION = (ADDRESS = (PROTOCOL = TCP)(HOST ....

ORA-00604: error occurred at recursive SQL level 1 
ORA-01031: insufficient privileges 
ORA-06512: at "XDB.DBMS_XDB", line 73 
ORA-06512: at line 319

Frequently Asked Questions on Installation

This section covers some of the frequently asked questions related to Database Vault installation. Oracle Database Vault installation is covered in detail in the Oracle Database Vault Installation Guide .

The installer does not detect my existing Oracle Database Enterprise Edition 10g Release 2 (10.2.0.2) instance. What should I do?

To allow the installer to find the database instance information, you should check the following:

• The database home has Oracle Enterprise Manager Console DB 10.2.0.2.0 installed.

• /etc/oratab has an entry for the database.

• All database names listed in /etc/oratab have unique system identifier (SID) names.

• The file, /etc/oraInst.loc exists.

• The oraInventory location is set in the /etc/oraInst.loc file.

• The oraInventory location set in /etc/oraInst.loc is the same as the 10.2.0.2 Enterprise Edition database's oraInventory location.

• The 10.2.0.2 database home does not have Oracle Database Vault in it.

• The 10.2.0.2 database home does not contain an Automatic Storage Management (ASM) instance.

I have installed Oracle Database Vault into an Oracle home that has multiple databases. How do I secure the other databases in the Oracle home?

You would need to run Database Vault Configuration Assistant (DVCA) manually on the other databases. Refer to the Oracle Database Vault Installation Guide for detailed instructions.

I have installed Oracle Database Vault on a Real Application Clusters (RAC) database instance. How do I secure the other nodes in the cluster?

You need to run DVCA manually on the other RAC nodes. Refer to the Oracle Database Vault Installation Guide for detailed instructions.

Manually Deploying the DVA Application

You can manually deploy Database Vault Administrator (DVA) to the following Oracle Application Server Containers for J2EE (OC4J) home:

$ORACLE_HOME/oc4j/j2ee/home

Use the following steps to manually deploy the DVA application:

1. Edit the file, $ORACLE_HOME/oc4j/j2ee/home/config/server.xml. Enter the following line just before the last line that reads, </application-server>:

   <application name="dva" path="$ORACLE_HOME/dv/jlib/dva_webapp.ear" auto-start="true" />
   
   

   For example:

   <application name="dva" path="/u00/app/oracle/oracle/product/dv12/dv/jlib/dva_webapp.ear" auto-start="true" />
   
   

2. Edit the file, $ORACLE_HOME/oc4j/j2ee/home/config/http-web-site.xml. Enter the following line just above the last line that reads, </web-site>:

   <web-app application="dva" name="dva_webapp" root="/dva" />
   
   

3. Edit the file, $ORACLE_HOME/oc4j/j2ee/home/config/global-web-application.xml. Search for <servlet-class>oracle.jsp.runtimev2.JspServlet</servlet-class>. Uncomment the following lines after this:

   <init-param>
     <param-name>main_mode</param-name>
     <param-value>justrun</param-value>
   </init-param>
   
   

4. Create the directory, $ORACLE_HOME/dv/jlib/sysman/config.

   mkdir -p $ORACLE_HOME/dv/jlib/sysman/config
   
   

5. Create the database connection configuration file, emoms.properties, in the configuration directory that you just created. Add the following lines to the file:

   oracle.sysman.emSDK.svlt.ConsoleMode=standalone 
   oracle.sysman.eml.mntr.emdRepRAC=FALSE 
   oracle.sysman.eml.mntr.emdRepDBName=ORACLE_SID
   oracle.sysman.eml.mntr.emdRepConnectDescriptor=TNS_connection_string
   
   

   
   

   Note: oracle.sysman.eml.mntr.emdRepRAC should be set to TRUE for a Real Application Clusters (RAC) database. For oracle.sysman.eml.mntr.emdRepConnectDescriptor, you can use an alias from $ORACLE_HOME/network/admin/tnsnames.ora. Alternatively, you can use the following syntax: oracle.sysman.eml.mntr.emdRepConnectDescriptor=(DESCRIPTION\=(ADDRESS_LIST\=(ADDRESS\=(PROTOCOL\=TCP)(HOST\=HOSTNAME)(PORT\=PORT)))(CONNECT_DATA\=(SERVICE_NAME\=ORACLE_SID)))

   
   

6. Start OC4J. Before starting OC4J, ensure that the correct environment variables are set. For example :

   ORACLE_SID=orcl
   export ORACLE_SID
   ORACLE_HOME=/u00/app/oracle/product/10.2/dv
   export ORACLE_HOME
   LD_LIBRARY_PATH=$ORACLE_HOME/bin:$ORACLE_HOME/lib:$ORACLE_HOME/jdbc/lib
   export LD_LIBRARY_PATH
   PATH=$ORACLE_HOME/bin:$ORACLE_HOME/jdk/bin:$PATH
   export PATH
   
   

   
   

   Note: LD_LIBRARY_PATH must be set to use the OCI-based JDBC libraries.

   
   

   Start OC4J using the following syntax:

   ${ORACLE_HOME}/jdk/bin/java -Djava.awt.headless=true -DEMDROOT=$ORACLE_HOME/dv/jlib -jar ${ORACLE_HOME}/oc4j/j2ee/home/oc4j.jar  -userThreads -config ${ORACLE_HOME}/oc4j/j2ee/home/config/server.xml
   
   

7. You can now access the DVA application. The HTTP port defaults to 8888 for this environment. Use the following URL:

   http://hostname:8888/dva
   

Documentation Corrections

The Database Vault Configuration Assistant (DVCA) command syntax for enabling and disabling Oracle Database Vault is incorrect in Appendix B of the Oracle Database Vault Administrator's Guide.

The correct command to enable Oracle Database Vault is as follows:

$ORACLE_HOME/bin/dvca -silent -action enable -service service_name -sys_passwd SYS_password -owner_account DV_owner_account_name -owner_passwd owner_password -nodecrypt [-logfile ./dvca.log]

Where:

• silent: Required if you are not running DVCA in an xterm window

• action: The action to perform. enable enables Oracle Database Vault. disable disables Oracle Database Vault.

• service: The alias for a connection in the tnsnames.ora file. Used to connect to a listener/database. For example, orcl.

• sys_passwd: Password for user SYS

• owner_account: Oracle Database Vault Owner account name

• owner_passwd: Oracle Database Vault owner account password

• nodecrypt: Reads plaintext passwords as passed on the command line. You must use this option if you are passing plaintext passwords to the command.

• logfile: Optionally, specify a log file name and location. You can enter an absolute path or a path that is relative to the location of the $ORACLE_HOME/bin directory.

The correct command to disable Oracle Database Vault is as follows:

$ORACLE_HOME/bin/dvca -silent -action disable -service service_name -sys_passwd SYS_password -owner_account DV_owner_account_name -owner_passwd owner_password -nodecrypt [-logfile ./dvca.log]

Documentation Accessibility

Our goal is to make Oracle products, services, and supporting documentation accessible, with good usability, to the disabled community. To that end, our documentation includes features that make information available to users of assistive technology. This documentation is available in HTML format, and contains markup to facilitate access by the disabled community. Accessibility standards will continue to evolve over time, and Oracle is actively engaged with other market-leading technology vendors to address technical obstacles so that our documentation can be accessible to all of our customers. For more information, visit the Oracle Accessibility Program Web site at

http://www.oracle.com/accessibility/

Accessibility of Code Examples in Documentation

Screen readers may not always correctly read the code examples in this document. The conventions for writing code require that closing braces should appear on an otherwise empty line; however, some screen readers may not always read a line of text that consists solely of a bracket or brace.

Accessibility of Links to External Web Sites in Documentation

This documentation may contain links to Web sites of other companies or organizations that Oracle does not own or control. Oracle neither evaluates nor makes any representations regarding the accessibility of these Web sites.

TTY Access to Oracle Support Services

Oracle provides dedicated Text Telephone (TTY) access to Oracle Support Services within the United States of America 24 hours a day, seven days a week. For TTY support, call 800.446.2398.