DBA Group Initiatives

I am not sure if I am in the right discussion board or not but here it goes. At our company they want each of the DBAs to lead various initiatives to improve the way we get things done on a day to day basis. They are always looking to us for new ideas to save money or standardize more or use the newest oracle technology. I thought it would be a good idea to start a thread to see what other DBA groups have done to improve their quality. It could be very simple things to not so simple. At our work we have done things like
standardize the setup on all unix servers by using the same profiles and variables.
create deployment scripts to create the Oracle Homes and New Database - sets up auditing and locks certain users automatically
using BMC to monitor processes on servers
created scripts to monito the alert logs
I am looking for ideas from others. I was thinking of something with the 10g scheduler or consumer groups. If anyone has done something like this and would like to share let me know. Thanks
Edited by: user579934 on Jan 27, 2009 5:14 AM

user579934 wrote:
I am not sure if I am in the right discussion board or not but here it goes.Nope. wrong place.
>
Forum: Community Feedback and Suggestions (Do Not Post Product-Related Questions Here)
Use this forum for feedback about OTN programs, Web site content, and systems - product-related questions will be deleted.
>
This forum is for any issues or matters relating to the OTN site/forums themselves.
You question sound a bit like it relates to DBA stuff, so perhaps the [Database General Forum|http://forums.oracle.com/forums/forum.jspa?forumID=61] would be a good place.

Similar Messages

LINUX:while Deleting OLD backup's got error that ORACLE is not in DBA group

Error
Error - The specified host user is not a member of the operating system DBA group. The host user must be a DBA group member since the database user does not have the SYSDBA role.
But. put users: system,oracle in OS /etc/group :
oracle:x:500:oracle,system
And both users have the DBA role

To be able to OS authenticate login as sysdba, your OS user need to be in dba group which you choose when you do installation.
SYSDBA role is not same as DBA role

"change the DBA group" in a windows environment

I would like to prevent OS-privileged users or connect as SYSDBA without giving password!
(there would be no passwordfile)
In a unix environment we can hide the name of dba-group changing config at /rdbms/lib
and relink:
Change: #define SS_DBA_GRP "dba" to: #define SS_DBA_GRP "mygroup"
rm config.o
make -f ins_rdbms.mk config.o ioracle
??? How can I do that in a WINDOWS environment ???

lkahlenb wrote:
sorry, thats an windows environment.
I didnt found anything like a config for group name as in unix (there is no relinking at windows).
If I use windows I can modify the config (another existing group), relink and recopy the default config.
So a unix.admin with only basic oracle o´know-how is confused.
I am looking for similar steps on windows...Someone with admin authority on the OS has ultimate authority. Even if you figure out a way to have Oracle use a group other than ora_dba, it won't take a rocket scientist of an SA to figure it out and put himself in the correct group. You need to turn on auditing and have some strong policies regarding DBAs and SAs staying in their lane.

How to add a dba group in Unix after Installation

I need help in figuring out how to add a dba group, which one would do prior to installation, but how can one do it after installation?
I need to have a group that will have people allowed to start and stop oracle. Is this possible to modify to do after installation?
Please help... Thank you.

Thanks for the advice. I am looking in my config.s file and this is what i see..
     .section     ".text",#alloc,#execinstr
/* 0x0000     7 */          .file     "x.c"
     .section     ".data",#alloc,#write
/* 0x0000     9 */          .global     ss_dba_grp
/* 0x0000     10 */          .align     8
     .global ss_dba_grp
ss_dba_grp:
/* 0x0000     17 */          .align     8
/* 0x0000     18 */          .xword     (.L12+0)
/* 0x0004     24 */          .align     8
/* 0x0004     25 */          .xword     (.L13+0)
/* 0x0008     26 */          .type     ss_dba_grp,#object
/* 0x0008     27 */          .size     ss_dba_grp,16
     .section     ".rodata1",#alloc
/* 0x0008     13 */          .align     8
.L12:
/* 0x0008     15 */          .ascii     "dba\0"
/* 0x0014     20 */          .align     8
.L13:
/* 0x0014     22 */          .ascii     "dba\0"
What should i change?

ORA-01031: insufficient privileges despite oracle belonging to DBA group

DB Version : 10.2.0.4.0
OS Version : Solaris 5.10
Os user oracle already belongs to DBA group.
$ id -a
uid=1001(oracle) gid=1100(oinstall) groups=1100(oinstall),1800(dba)But, i get the following error
$ sqlplus / as sysdba
SQL*Plus: Release 10.2.0.4.0 - Production on Mon Nov 29 14:33:59 2010
Copyright (c) 1982, 2007, Oracle. All Rights Reserved.
ERROR:
ORA-01031: insufficient privileges
Enter user-name: ^C
$
$
$ sqlplus sys/password as sysdba
SQL*Plus: Release 10.2.0.4.0 - Production on Mon Nov 29 09:34:13 2010
Copyright (c) 1982, 2007, Oracle. All Rights Reserved.
Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.4.0 - Production
With the Partitioning, Data Mining and Real Application Testing options
SQL>Value of remote_login_passwordfile parameter
SQL> show parameter password
NAME TYPE VALUE
remote_login_passwordfile string EXCLUSIVEWhat could possibly be the reason?

Hi,
Have you create the orapw file in the $ORACLE_HOME/dbs with orapwd ?
example :
orapwd file=${ORACLE_HOME}/dbs/orapw${ORACLE_SID} password=change_on_install entries=40
Then the unix user oracle will be create in the orapw${ORACLE_SID} file
after if you want to create another user :
grant sysdba to TOTO; the unix user TOTO could do : connect / as sysdba
Regards,
Mario Alcaide
http://marioalcaide.wordpress.com

Multiple instances in Windows 7. & Adding Administrator in DBA group

i have installed two databases Using DBCA in win7,
& den used set oracle_sid= <old instance name>
then when i said sqlplus / as sysdba
The new instance is starting.. then i tried sqlplus sys/sys as sysdba previous instance password.. it's asking for user name & password.. ??? which i did give & its promting error..
how to deal with multiple instances in windows 7??
& i created a user using net user administrator /active:no ... now i cudn't get to add this user to DBA group?? As while editing tnsnames.ora & etc.. it's saying access denied so created admin user.. now cudn't login to dba user using administrtor profile.. how to add this in dba group ??

Aduke wrote:
i have installed two databases Using DBCA in win7,
& den used set oracle_sid= <old instance name>
Did you create both databases from the same ORACLE_HOME, or did you actually install oracle twice, into separate ORACLE_HOMEs and create your two databases from those separate homes?
then when i said sqlplus / as sysdba
The new instance is starting.. then i tried sqlplus sys/sys as sysdba previous instance password.. it's asking for user name & password.. ??? which i did give & its promting error..
how to deal with multiple instances in windows 7??
& i created a user using net user administrator /active:no ... now i cudn't get to add this user to DBA group?? As while editing tnsnames.ora & etc.. it's saying access denied so created admin user.. now cudn't login to dba user using administrtor profile.. how to add this in dba group ??
Control panel
Computer Management
Local Users and Groups
Users (select your Oracle user)
Properties
Member Of
select orcl_dba
But then, this IS Windows, who knows if your cascade of applets and options is the same as mine? To paraphrase Forest Gump, "My momma always said Windows was like a box of chocolates. You never know what you're going to get."

Add grid user to dba group

Hello,
After RAC installation, We are facing some cluster issues. After investigation, Oracle support suggested to add the grid user to the dba group. We missed to add the grid user to the dba user in most of the nodes. This is Linux Redhat 5.
How can I add grid user to dba group and keep the grid user belonging to the other linux groups? what 's the correct command?
Thanks,
Diego

Hi,
As root:
#### check before
id grid
#### Change It
usermod -a -G dba grid
#### Check after
id gridLevi Pereira

Changing the default DBA group

Hi guys,
For Oracle8i, 9i, and 10g, is it possible to change the DBA group once Oracle is installed? Let me give you an example:
I got Oracle 10g, with the DBA group 'oinstall'. Is it possible that i create a new OS group called 'DBAtest' and use this as the default DBA group so OS users members of this group can os-authenticate to oracle?
thanks,
james

Yes, on Unix platforms I think it is possible to change the OSDBA group (the group used to authenticate SYSDBA connection).
Not sure if there are any consequences afterwards, if you did not separate the Oracle software owner OraInventory group, usually 'oinstall', from OSDBA/OPER groups. Could be a good idead to work that out before implementing any changes!

Tcode for DBA group

What are the common transaction code that should be assigned to the member of the DBA group? I'm trying to use the SAP GUI to support some of the SAP-Database related issue and sometimes I find it very hard, due to the missing access on the tcode.

only for db admin oracle?
-> db* (db01, db02, db12, db14, db17 etc.)
-> st04/st04n (db "cockpit")
-> st05 (tracing)
-> st02 & st06 (memory tuning etc.)
GreetZ, AH

How to deal with 2 dba groups

Hi Friends,
I want to install two (2) Oracle 10g DBs in my linux server. I want different dba groups for each so that the dba on one database will not be able to touch the other's database.
In my first DB the owner is > oraprod and group> dba
In my 2nd DB the owner is> oratest and group> dba2
My quiestion is, can the user oratest/dba2 be able to connect "/ as sysdba" and starup/shutdown oracle? What is the special tag thats makes a certain owner/group be able to connect as "sysdba". I just felt it is a reserved word granted by default to "dba" by oracle.
Thanks

Suggestions: (with a little humor)
1) switch to Solaris and you can use zones isolating the dbas
2) create user accounts in your separate databases and grant sysdba or sysoper privileges accordingly -- this is actually the way Oracle intended this to be for these types of situations.
3) fire one of your dbas and give a big raise to the other one.
4) trust your dbas - doesn't everyone trust their dbas?

Grid user in dba group ?

Hey,
according to the best practise paper, the grid user should not be part of the dba user group.
While running cluvy, this fixupscript will put the user grid into this group.
Is it neccessary to put the grid user into the dba group or can I ignore this message ?
CHristian

Christian wrote:
Hey,
according to the best practise paper, the grid user should not be part of the dba user group.
While running cluvy, this fixupscript will put the user grid into this group.
Is it neccessary to put the grid user into the dba group or can I ignore this message ?
CHristianHi, GRID user can be part of DBA group there is no problem, this is designed if grid user is supposed to have access to db's which would be running on RAC system.
See
http://docs.oracle.com/cd/E11882_01/install.112/e22489/prelinux.htm#BABBIDCF

Kerberos auth in Oracle, sys user and dba group

Hello.
I've set up kerbros auth in test oracle 10g r2 database on 64-bit linux according to Oracle® Database Advanced Security Administrator's Guide. I have the following issue: kerberos user can login to the test server (from this server) and normal database user can login to database server from other hosts. However, oracle system user, members of dba group and normal users can't longer login to this server from it. So, when oracle system user runs sqlplus "/as sysdba" , he gets ORA-12638: Credential retrieval failed.
sqlnet.ora looks the following way:
SQLNET.KERBEROS5_CC_NAME = /tmp/krb5cc
SQLNET.KERBEROS5_CONF_MIT=TRUE
SQLNET.AUTHENTICATION_SERVICES= (KERBEROS5)
NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)
SQLNET.KERBEROS5_CONF = /etc/krb5.conf
SQLNET.KERBEROS5_REALMS = /etc/krb5.realms
SQLNET.AUTHENTICATION_KERBEROS5_SERVICE = oracle
What should I do to enable login to this server for members of dba group and normal users from the database server?

I've tried to set SQLNET.AUTHENTICATION_SERVICES to (BEQ,KERBEROS5), it works almost as expected, but I have strange effect: my os user is not in dba group, but can connect "/as sysdba"...
$ id -nG
domusers oinstall
$ sqlplus "/as sysdba"
SQL*Plus: Release 10.2.0.1.0 - Production on Tue Mar 3 13:20:55 2009
Copyright (c) 1982, 2005, Oracle. All rights reserved.
Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - 64bit Production
With the Partitioning, OLAP and Data Mining options
SQL>

11gR2 problem for dba group user

Hi Pavan Sir,
After the 11gR2 Installation and connect to oracle as one of the dba group user(ex: tuser)
1) when sqlplus / as sysdba --> startup nomount --> receiving the error ORA-48189 (The OS command to create directory failed) for the diagnostic_dest(ex: /disk1/oradata/test)location, but the specified directory is created and owned by the same dba group user(test).
2) If suppose the "/disk1/oradata/test" directory permission are modified by 777, the dba group user(test) can connect to nomount stage, but the sub directories of diagnostic_dest automatically gets created (like /disk1/oradata/test/diag/rdbms then etc......) are being owned by oracle user and also if the db is created ,the control file,redolog file and datafiles are automatically getting owned by oracle user but not by the test user.
Which was not the case till 10gR2.
Plz. provide any body provide us with some solution to overcome the above experienced problem which is implemented in our Dev. box.
Thanks in Advance.
Best regards,
Habeeb.

Dear user,
Even if the perm are changed by -R ,the files are automatically owned by oracle user, not by the test user.
Have any body tried creating oracle database using dba group user in 11gR2, but the db files being created by test user should not be automatically owned by oracle user. If so , plz. forward me the steps.
Thanx in advance.

Problemm with dba group vs oinstall group

Hi to all ;
This is related to oracle as well as some os related security problems. please clarify it.
I tried but couldn't solve it All information's given here ..
Testing from user 'A'
+# useradd -m -g oinstall a+
+# passwd a+
Changing password for user a.
New UNIX password:
BAD PASSWORD: its WAY too short
Retype new UNIX password:
passwd: all authentication tokens updated successfully.
su - a
+[a@testorcl ~]$ export+
ORACLE_HOME=/u01/app/oracle/product/10.2.0/db_1
+$ export PATH=$PATH:$ORACLE_HOME/bin+
+$ export ORACLE_SID=testdb+
+$ sqlplus /nolog+
SQL*Plus: Release 10.2.0.1.0 - Production on Thu Jan 3 01:33:49 2013
Copyright (c) 1982, 2005, Oracle. All rights reserved.
Testing From user 'b' :
+# useradd -m -g dba b+
+# passwd b+
Changing password for user b.
New UNIX password:
BAD PASSWORD: its WAY too short
Retype new UNIX password:
passwd: all authentication tokens updated successfully.
su - b
Password:
+$ export ORACLE_HOME=/u01/app/oracle/product/10.2.0/db_1+
+$ export PATH=$PATH:$ORACLE_HOME/bin+
+$ export ORACLE_SID=testdb+
+$ sqlplus /nolog+
sqlplus: error while loading shared libraries: libsqlplus.so: cannot open shared object file: No such file or directory
*>> From oracle user finding libsqlplus.so >>*
*[oracle@testorcl ~]$*
*$ find / -name libsqlplus\* -ls 2>/dev/null*
+1378188 1296 -rw-r----- 1 oracle oinstall 1319436 Jun 22 2005 /u01/app/oracle/product/10.2.0/db_1/lib/libsqlplus.a+
+1378193 1028 -rw-r----- 1 oracle oinstall 1047293 Jun 22 2005 /u01/app/oracle/product/10.2.0/db_1/lib/libsqlplus.so+
SQLPLUS LOCATION with associated group
+$ ls -l $ORACLE_HOME+
drwxr-x--- 9 oracle oinstall 4096 Dec 24 03:28 sqlplus
Please Note :
USER 'a' belongs oinstall group.
USER 'b' belongs dba group.
My questions are :
*1.why OS user can access database with oinstall group ?*
*2.why OS user can't access database with dba group ?*
Note: This is concept of oracle
**To connect as sysdba using OS Authe*ntication ; UNIX OS user must be a part of OSDBA (dba) group.*
Once the user is part of OSDBA group.
but in dba group with os user 'b' , can't connect sqlplus , what's the real problem here ?
version : 10gr2
*$ uname -a*
Linux testorcl 2.6.9-42.0.0.0.1.ELsmp #1 SMP Sun Oct 15 14:02:40 PDT 2006 i686 athlon i386 GNU/Linux
Edited by: 952909 on Jan 4, 2013 1:03 PM

Hi dude ;
Thanks for your reply.
So , You suggest me to change install directory permission from 750 to 775.
$ cd install
[oracle@testorcl install]$ ls -l
total 240
-rw-r----- 1 oracle oinstall      0 Jun 7 2005 createseed1.sh
-rw-r----- 1 oracle oinstall      0 Jun 7 2005 createseed.sh
-rw-r----- 1 oracle oinstall    977 Dec 24 03:29 envVars.properties
drwxr-x--- 2 oracle oinstall   4096 Dec 24 03:26 jlib
-rw-r----- 1 oracle oinstall 194849 Dec 24 03:29 make.log
-rwxr-xr-x 1 oracle oinstall      0 Dec 24 03:29 oratab
-rw-r----- 1 oracle oinstall    132 Dec 24 04:01 portlist.ini
-rw-r----- 1 oracle oinstall    221 Dec 24 04:02 readme.txt
-rwxr-xr-x 1 oracle oinstall    824 Dec 24 03:28 rootdeletenode.sh
-rw-r----- 1 oracle oinstall   9646 Dec 24 03:28 rootlocaladd
-rw-r----- 1 oracle oinstall      0 Jun 7 2005 seed.log
-rw-r----- 1 oracle oinstall   2800 Jun 7 2005 templocal
drwxr-x--- 2 oracle oinstall   4096 Dec 24 03:29 unix
drwxr-x--- 2 oracle oinstall   4096 Dec 24 03:28 utl
*>> Permission changed as per your suggestion >>*
*[oracle@testorcl db_1]$ chmod 775 install*
*[oracle@testorcl db_1]$ ls -l*
drwxrwxr-x   5 oracle oinstall   4096 Dec 24 04:02 install
*>> Trying to find changePerm.sh >>*
[oracle@testorcl db_1]$ cd install
[oracle@testorcl install]$ ./changePerm.sh
-bash: ./changePerm.sh: No such file or directory
[oracle@testorcl install]$ cd
[oracle@testorcl ~]$ whereis changePerm.sh
changePerm:
[oracle@testorcl ~]$
In my testdb file not found ... Any suggestion to find DUDE
Please note :
http://www.oracle-base.com/articles/10g/oracle-db-10gr2-installation-on-rhel-4.php
Installation Doc did n't say anything to change permission related to install group +( from 750 to 775 )+
Can you please clarify this ?
Thanks Dude ..

sapsid adm has no access to "dba" group

My client, a LARGE telecom company, has 150+ SAP instances and is in the process of moving most of them from PARISC to Itanium HP servers.
As part of the replatforming effort, we have to create <sapsid>adm ids on the new servers. As per SAP installation Manuals, <sapsid>adm should have "sapsys" as primary and "dba" as secondary group. The Basis, DBA and SA support functions are performed by different work groups and due to SOX and other internal security policies, the DBA groups feels it is against "separation of duties", etc, to have someone other than DBAs have access to the "dba" group and is unwilling to approve "dba" as secondary group for <sapsid>adm. The Basis Admins feel that the failure to allow access to "dba" will negatively impact our ability to perform our Basis support activities, For example: unable to start & stop the database when using start|stopsap scripts; inability to perform any activity that uses sapinst (as sapinst checks for existence of <sapsid>adm and its membership of "sapsys" and "dba" groups; probably some of the database related transactions within the SAP gui, etc).
Have any other Basis Admins run across these SOX restrictions? How are they handled in other companies? What other impacts could the failure to have access to the "dba" group have?
Sharing of Any experiences in this area would be greatly appreciated.
Alex

Hi Alex,
Making the user <SID>adm as part of the group "dba" as secondary is the SAP Standard installation configuration. Indeed sometimes the internal Security policies of the organizations do make some restrictions for the "Segregation of duties" part due to which user configurations need to be different at the OS level. SAP do have a solution for that.
Now there can be 3 scenarios and you have to identify which scenario you want to implement-
1. SAP standard configuration where an operator has full privilege for DB administration.
2. An operator is authorized to backup the DB and also to start/shut down the DB but restricted privileges to modify the data.
3. Only authorized DBA operators are allowed to execute BR*Tools operations. Such users have
no other database access rights.
Please refer to the below link for more details-
http://www.sdn.sap.com/irj/sdn/go/portal/prtroot/docs/library/uuid/9e626b1c-0d01-0010-b2ba-cfa2443c1cce?quicklink=ora&overridelayout=true
Additonally you can also refer to the SAP note 832662.
Regards
Sourabh Majumdar

DBA Group Initiatives

Similar Messages

Maybe you are looking for