• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1650
  • Last Modified:

OEM Grid Control: Policy Violation Details: Server Parameter File Permission(Windows)

I'm finally entering the 20th century and playing round with OEM Grid Control.    Version I'm running:  10.2.0.3.

Running Oracle on Windows:

1: What are the proper file permissions/owner to avoid the policy violation:
                   Policy Violation Details: Server Parameter File Permission(Windows)

The description says only the owner of the Oracle software and the DBA group should have access.  I believe I've done this and the 2 users it mentions in the violation are:  (NT AUTHORITY\SYSTEM TEST-DB1\ora_dba).  I'll give you 2 guesses who owns all the software...

2: Short of setting the policy collection through OEM to run every couple of minutes, how do I run it manually?  The default is to run every 24 hours and while I'm playing with permissions I'd like to force another check.  The only work-around I've found is to tweak the default of once a day and tell it to run every couple minutes.  There has to be a better way.

0
slightwv (䄆 Netminder)
Asked:
slightwv (䄆 Netminder)
  • 15
  • 10
1 Solution
 
TolomirAdministratorCommented:
The twentieth century of the Anno Domini era began on January 1, 1901 and ended on December 31, 2000, according to the Gregorian calendar.
0
 
TolomirAdministratorCommented:
Alright I got grid control also running on windows.

Is that user part of the administrators group?
0
 
TolomirAdministratorCommented:
0
Fill in the form and get your FREE NFR key NOW!

Veeam is happy to provide a FREE NFR server license to certified engineers, trainers, and bloggers.  It allows for the non‑production use of Veeam Agent for Microsoft Windows. This license is valid for five workstations and two servers.

 
slightwv (䄆 Netminder) Author Commented:
>>The twentieth century of the Anno Domini

Can I assume this is for another question?

>>Is that user part of the administrators group?

I've checked with our sys admin and he believes that the SYSTEM user is automatically part of the Administrators group even though it doesn't show up in the local groups.

That actually makes sense.  I'll create an Oracle Windows user and change ownership and see if it magically goes away (not sure why I didn't think of that yet....).

Any insight on the 2nd part of the question?
0
 
TolomirAdministratorCommented:
Just check your first few words of the question ... scnr ;-)

The system user is an oracle user.

Don't mix oracle and windows accounts.

---
2nd part: I see no reason to check every few minutes with the policy.
What do you expect to happen?
We are talking about grid control, where normally just a couple of users should have access to.




0
 
slightwv (䄆 Netminder) Author Commented:
>>The system user is an oracle user.

In this case I'm talking about the Windows user SYSTEM not the database user.

>>I see no reason to check every few minutes with the policy.

I agree, hence the question.  While I'm tweaking my test system to eliminate the policy alert, I need to change file ownerships and see if that 'fixes' the alert.  If I can't run it manually, I need to set the time to some small number to have it update.  In production, I'll leave it at the default of 24 hours.

>> new info...
First:  I HATE WINDOWS (not really)!!!  I'd love to go back to the UNIX world.  Oracle was SOOOooo much easier there.

Creating a windows user named oracle and resetting all the ACLs made the problem worse since the service runs as 'SYSTEM' ( again the Windows user system ) and now the service can't see the datafiles.

Since you obviously aren't getting these policy violations, what are the permissions on your SPFILE and who owns it?
0
 
TolomirAdministratorCommented:
I can take a look at it tomorrow, right now I'm (already) at home.

As far as I remember, I setup just an oracle user granted him administrator permissions and left the rest to oracle installer handling this stuff.

Btw. why don't you use oracle grid control on linux?

Just a few days ago I've installed 10.2.0.3 grid control 64bit on a SuSE SLES 10 SP1 (latest, brand new)

Runs flawless. Ok had to install 2 rpm packages, but if you need details there I can take a look at my installation notes.

Tolomir
0
 
slightwv (䄆 Netminder) Author Commented:
>>why don't you use oracle grid control on linux?

We're a Windows shop.  I'd be run out of town if I suggested plugging a Linux box into our network.

>>left the rest to oracle installer handling this stuff.

That's what I've done for years as well.  I never gave it a second thought until I started messing with 10g Grid Control and receive all these 'ownership' policy violations.
0
 
TolomirAdministratorCommented:
Ok, here is what I got:

All programs / data are owned by the Administrators group.

All oracle services are started as the local system account (windows default setting)

---

So you might want to reinstall the entire package with an normal Administrator account (I suppose I did create / use an account named oracle (member of the Administrators group) for the installation.

Tolomir
0
 
slightwv (䄆 Netminder) Author Commented:
Thanks for the info.

You have to install from an administrators account so I'm not sure what re-installing would accomplish.

Can you check another piece of your setup for me?

In Grid Control under the Compliance tab, click Policies then Library.  Go to advanced search and look for policies that contain "Server Parameter File Permission" in the policy rule.

For the Windows one, is this policy enabled for you and  how many targets use it?
0
 
TolomirAdministratorCommented:
alright will do that tomorrow.
0
 
TolomirAdministratorCommented:
Yes this is enabled and used by 5 targets (all my databases 4 on linux 1 grid control itself on windows).



0
 
slightwv (䄆 Netminder) Author Commented:
Crap.  I don't know where else to look for differences in our systems.

Even though all my targets are Windows, I also have a stand alone Grid Control machine with a local repository and the Policy is even failing on it from the day of install.

If you can't think of anything else to do, I'll go ahead and close this out and give you the points and wait for Support to take action on my SR ( Like I'm really gonna hold my breath ).

While waiting, I may get bored and try your suggested re-install with a twist.  I'll bribe our admins to give me another machine and try a stand-alone install and only have Grid Control muck with the EMREP instance.
0
 
TolomirAdministratorCommented:
yes choose the latter, stand alone installation should do the trick for you.

Especially since it can run most times in the background (the installation)

I've installed grid control at least 4 times so far, keeps me updated with the procedures...

Also wait for the SR, of cause I'm also interest in the result here...

Tolomir
0
 
slightwv (䄆 Netminder) Author Commented:
Will do.  I'll leave it open until I hear back.

Just thought of something, I just rescaned all your posts and didn't see this:  What version of Windows is your grid control installed on?

If I get around to another machine and you were local, I'd bet you a beer that it will do the same thing.  My current grid control is on it's own machine now.  I was just gonna leave that machine alone while I had the SR open and install another playground that I can trash at will.
0
 
TolomirAdministratorCommented:
windows server 2003 sp2
0
 
TolomirAdministratorCommented:
For a start just use:

Oracle Enterprise Manager 10g Grid Control Release 2 (10.2.0.2.0) for Microsoft Windows (32-bit)

and check if there are any issues.

Then upgrade to

Oracle Enterprise Manager 10g Grid Control Release 3 (10.2.0.3) for Microsoft Windows (32-bit)

Good luck,
Tolomir
0
 
slightwv (䄆 Netminder) Author Commented:
double crap.  That's what we're on.  Oh well.  Thanks for all the help.  I'll let you know how the SR comes out.
0
 
slightwv (䄆 Netminder) Author Commented:
Tolomir,
You seem to have been around Oracle products for a while.

You'll probably get a kick out of this one.  After a month of being ignored and having to escalate the SR a couple of times, I was told to review the following note:

Subject:       Support Status for VMWare
Doc ID:       Note:249212.1

Pay particular attention to the 'Note' at the bottom of the note (The one that mentions that even though Oracle provides VMWare templates, they do not support it).

Although I'm not on VMWare, I am in a Microsoft virtual environment, I guess it still causes some issues.  Who would have thought this would cause it?

Post back that you've read this and the points are yours!!!
0
 
TolomirAdministratorCommented:
NOTE: Oracle has not certified any of its products on VMWare, but use of
Oracle products in the RAC environment is specifically not supported.  
This is noted because some Oracle product demonstrations have been conducted
in a RAC environment using VMware.  These are demonstrations only and not
certified for use by customers.


So you did run it in a virtual environment?

I think that is just their standard disclaimer, there must ne no real issues, but your grab yourself some real hardware and repeat the tests...




0
 
TolomirAdministratorCommented:
Btw. I've setup another grid control 10.2.0.3, just yesterday on a SUSE SLES 10 SP1 x86_64.

Runs flawless as far as I can see.

0
 
slightwv (䄆 Netminder) Author Commented:
Don't you just love that disclaimer!!!  I can download a RAC example in a VMWare environment from Oracle, yet they don't support it......

Yes, I was in a virtual server (Microsoft not VMWare).  Therefore, I'm not supported.  Oracle must be doing some really nasty things under the sheets........

>>grab yourself some real hardware and repeat the tests...

lol....   if I had the real hardware available, would I be in a virtual environment?

I will add that virtual environments are real nice for testing.  If a test goes horribly wrong, I can be back to baseline as fast as I can copy a single OS file.  I know.... cold backup then restore is about the same (just more files to deal with).  Guess I just can't test Grid Control.

>>Runs flawless as far as I can see.

Sure.... rub it in !!!    :)
0
 
TolomirAdministratorCommented:
Have you ever considered to use the free vmware server?

It's not that hard to setup the whole stuff, acutally you run the installer. Load (add) the image and press run.

http://www.vmware.com/download/server/

That's all.

Tolomir
(I know the advantages of virtualisation, I just started with vmware, also because of linux virtualisation)
0
 
slightwv (䄆 Netminder) Author Commented:
We're a Microsoft shop and their Virtual Server is free as well.  

In talking with our Sys Admin, VMWare has some extra features (I can't remember them off the top of my head) but so far the MSoft one works fine for us (except for this 1 problem but I bet it also fails in VMWare).

If you ever run Grid Control in a VMWare environment and it works for you, let me know.  Go ahead and post it here.  I'm sure in the future someone else will try this exact thing and this question will save them MANY headaches.
0
 
TolomirAdministratorCommented:
Thank you for the points.

If it woudn't take so very long to install the complete package, I could give it a try.

Still after installing grid control on both: windows and linux. Linux runs smoother...

I just use best of both worlds -)

nice weekend...
Tolomir
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

  • 15
  • 10
Tackle projects and never again get stuck behind a technical roadblock.
Join Now