RAC, multiple OracleHomes & lost permission in crs registry

Hi all,
I'm installing a RAC11 (11.0.7 on RHEL5) SE 2 node cluster, where I'l will migrate the current two node rac.
I've the necessity to install two different OracleHomes with different username/permission, so I have:
-crs home, owned by crs user
-ASM home owner by asm user
-dbhome_1 owned by oracle (which is part of dba, oper, asmdba groups)
-dbhome_2 owned by oracle1 (which is part of dba1, oper1, asmdba group)
Of course all of those users are part of oinstall.
The installation and creation of those oraclehomes and related db/services goes fine.
Doing an ocrdump I find that all of the resources of db_home1 are owned by oracle:dba and the resources of dbhome_2 are owned by oracle1:dba1
That's fine... till the first reboot of crs.
At this point I discover that all the permission on crs registry are oracle:dba. I mean all the resources previously owned by oracle1:dba1 are now owned by oracle:dba.
The start/stop of the res. are ok, but if only I need to add/remove a service I get an error:
PROC-5: User does not have permission to perform a cluster registry operation on this key. Authentication error [User does not have permission to perform this operation] [0]
I'm stuck... I've reinstalled all a second time but same result...
On metalink I haven't found anything like this.
Before open an sr@oracle have you ever had similar problem?
Regards,
Roberto

Ok, I've restarted from scratch...
Here are the steps to reproduce:
*0. CRS home, ASM home, 1 dbhome*
Resource present:
[crs@jose ~]$ crsstat.sh
HA Resource Target State
ora.aureliano.ASM1.asm ONLINE ONLINE on aureliano
ora.aureliano.LISTENER_AURELIANO.lsnr ONLINE ONLINE on aureliano
ora.aureliano.gsd ONLINE ONLINE on aureliano
ora.aureliano.ons ONLINE ONLINE on aureliano
ora.aureliano.vip ONLINE ONLINE on aureliano
ora.jose.ASM2.asm ONLINE ONLINE on jose
ora.jose.LISTENER_JOSE.lsnr ONLINE ONLINE on jose
ora.jose.gsd ONLINE ONLINE on jose
ora.jose.ons ONLINE ONLINE on jose
ora.jose.vip ONLINE ONLINE on jose
ora.rac11.db ONLINE ONLINE on aureliano
ora.rac11.macondo_svc.cs ONLINE ONLINE on jose
ora.rac11.macondo_svc.rac111.srv ONLINE ONLINE on aureliano
ora.rac11.macondo_svc.rac112.srv ONLINE ONLINE on jose
ora.rac11.rac111.inst ONLINE ONLINE on aureliano
ora.rac11.rac112.inst ONLINE ONLINE on jose
ora.rac11.rac11svc.cs ONLINE ONLINE on jose
ora.rac11.rac11svc.rac111.srv ONLINE ONLINE on aureliano
ora.rac11.rac11svc.rac112.srv ONLINE ONLINE on jose
USER and OFA
[root@aureliano oracd]# id crs # CRS owner
uid=501(crs) gid=501(oinstall) groups=501(oinstall)
[root@aureliano oracd]# id asm # ASM owner
uid=504(asm) gid=501(oinstall) groups=501(oinstall),506(asmdba),505(asmadmin)
[root@aureliano oracd]# id oracle # dbhome1 owner
uid=502(oracle) gid=501(oinstall) groups=501(oinstall),503(dba),504(oper),506(asmdba)
[root@aureliano oracd]# id oracles3 # dbhome2 owner
uid=509(oracles3) gid=501(oinstall) groups=501(oinstall),506(asmdba),509(dbas3),510(opers3)
[oracles3@aureliano ~]$ ll /u01/app/
total 20
drwxr-xr-x 6 asm oinstall 4096 Jun 5 23:04 asm
drwxr-xr-x 41 root oinstall 4096 Jun 6 16:11 crs
drwxr-xr-x 6 oracle oinstall 4096 Jun 22 12:10 oracle
drwxr-xr-x 6 oracles3 oinstall 4096 Jul 7 15:38 oracles3
drwxrwx--- 6 crs oinstall 4096 Jul 7 15:01 oraInventory
*1) install another 11.0.6 + patchset 11.0.7 running out of a oracles3's dbhome*
*2) run dbca from oracles3's dbhome*
the database "s3repl" is created and started fine:
HA Resource Target State
ora.aureliano.ASM1.asm ONLINE ONLINE on aureliano
ora.aureliano.LISTENER_AURELIANO.lsnr ONLINE ONLINE on aureliano
ora.aureliano.gsd ONLINE ONLINE on aureliano
ora.aureliano.ons ONLINE ONLINE on aureliano
ora.aureliano.vip ONLINE ONLINE on aureliano
ora.jose.ASM2.asm ONLINE ONLINE on jose
ora.jose.LISTENER_JOSE.lsnr ONLINE ONLINE on jose
ora.jose.gsd ONLINE ONLINE on jose
ora.jose.ons ONLINE ONLINE on jose
ora.jose.vip ONLINE ONLINE on jose
ora.rac11.db ONLINE ONLINE on aureliano
ora.rac11.macondo_svc.cs ONLINE ONLINE on jose
ora.rac11.macondo_svc.rac111.srv ONLINE ONLINE on aureliano
ora.rac11.macondo_svc.rac112.srv ONLINE ONLINE on jose
ora.rac11.rac111.inst ONLINE ONLINE on aureliano
ora.rac11.rac112.inst ONLINE ONLINE on jose
ora.rac11.rac11svc.cs ONLINE ONLINE on jose
ora.rac11.rac11svc.rac111.srv ONLINE ONLINE on aureliano
ora.rac11.rac11svc.rac112.srv ONLINE ONLINE on jose
ora.s3repl.db ONLINE ONLINE on aureliano
ora.s3repl.s3repl1.inst ONLINE ONLINE on aureliano
ora.s3repl.s3repl2.inst ONLINE ONLINE on jose
*3) check permission on s3repl database with a ocrdump*
Cut & paste of an ocr entry owner by oracles3, there are many
\[DATABASE.DATABASES.s3repl\]
ORATEXT : s3repl
SECURITY : {USER_PERMISSION : PROCR_ALL_ACCESS, GROUP_PERMISSION : PROCR_WRITE, OTHER_PERMISSION : PROCR_READ, USER_NAME : oracles3, GROUP_NAME : dbas3 }
note the user_name oracles3 and group_name dbas3
*4) stop databases, crs and restart: the permission are now gone*
\[DATABASE.DATABASES.s3repl\]
ORATEXT : s3repl
SECURITY : {USER_PERMISSION : PROCR_ALL_ACCESS, GROUP_PERMISSION : PROCR_WRITE, OTHER_PERMISSION : PROCR_READ, USER_NAME : oracle, GROUP_NAME : dba}
note the user_name oracleand group_name dba
Any ideas?
What I'm missing?
Regards,
Roberto

Similar Messages

  • Want to regain lost permission

    By an accident I have lost permission of all my files and folders of External Hard disk I don't know how but. Now I have to recover those files and I found that it's a tiring process for regain/reset permission of individual files. I need a help that if
    there is any other way to get those file permission to set to my current a/c at a go ???? I had a lots of files there including personal pictures, movies, games, and coding source files.
    I have windows 7 Ultimate OS. And I haven't reinstall my OS. The External Hard Drive is not recognised by any other PC/Laptop only my PC has the view.
    Please Help me ASAP.

    Hi appi02,
    Based on your description, I suspect your external disk may has something wrong, considering the security, it’s recommended to back up your contents on it to another place.
    Meanwhile, do you have the correct permission after you move files to another place?
    Alex Zhao
    TechNet Community Support

  • Lost permission/ownership on ocr&voting device after reboot

    Hi all
    I have an issue on setting up a 10.2.0.3 crs+rac on OEL 5 64 bit.
    My configuration is as follows:
    - 2 node OEL 5 64 bit
    - storage on netapp (FCP)
    - 2 hba per node (qlogic driver qla2400)
    - dm-multipath
    I was able to install and upgrade the crs stack up to 10.2.0.3, binding multipath devices to raw devices (as requested by OUI).
    After install, I changed OCR and voting to point to block devices, using "multipathed" devices /dev/mapper/crs_voting1p1 anc /dev/mapper/crs_ocr1p1.
    All worked fine, until I decided to reboot the node.
    The issue is that I was not able to set ownership/permission on /dev/mapper/crs* devices on reboot (as expected, they become root:disk 660, and oracle:dba can't read/write on them).
    I tried to setup udev to change these, as I used when dealing with raw and block devices, but with no success.
    Could anyone give me some tip?
    Thanks in advance
    Regards

    Hi
    correct syntax for binding raw devices is:
    raw /dev/raw/raw1 /dev/mpath/mpath24.
    I used the above syntax, binding raw to "mapper" devices.
    Remember to create at least one partition and initialize it (with dd), and to assign correct permission/ownership on raw devices.
    After the install phase, I changed bot voting and ocr device to point to block devices (/dev/mpath/....).
    Hope this helps.
    regards
    --alessandro                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           

  • RAC: Multiple Databases / Instances with network seperation

    Dear all,
    We are planning to run our oracle 11g DB on RAC, with two instances both on seperate networks. Is this possible?
    here is what i mean
    Instance 1 including RAC DB is configured in e.g VLAN 12 with subnet 192.168.120.0/24. Instance 2 is configured in VLAN 22 with subnet 192.168.122.0/24. Servers of instance 2 send their data also to instance 1 RAC DB at subnet 192.168.120.0/24. Traffic between them is routed by a Cisco router.
    i searched the net for similar implementations and found a couple of people running similar configurations on RAC,
    but i want to know any downsides/pros cons of running such a setup.
    THanks in advance
    Saad

    Hi Saad,
    The problem in my case is clusterware configuration. While creating the cluster CRS asks for public IP,Private IP and VIP for both nodes. I can do it for one database environment which we call here pre-prod.
    The prod environment also uses the same hardware but is in different subnet and will use same cluster. Can i put vips for that environment when clusterware asks for public ip,private ip and vips.
    Or as you suggested,create cluster using ip of one subnet and create database for it and for second network create just database and in listerner.ora enter vips of prod environment. My current hosts file looks like this
    # Do not remove the following line, or various programs
    # that require network functionality will fail.
    127.0.0.1 localhost.localdomain localhost
    ::1 localhost6.localdomain6 localhost6
    #Production
    10.88.118.200 cps-oracle-vip.fedex.com cps-oracle-vip
    10.88.118.201 cps-oracle-1.fedex.com cps-oracle-1
    10.88.118.202 cps-oracle-2.fedex.com cps-oracle-2
    10.88.118.203 cps-oracle-1-vip.fedex.com cps-oracle-1-vip
    10.88.118.204 cps-oracle-2-vip.fedex.com cps-oracle-2-vip
    #Pre-Production
    10.88.119.200 cps-pre-oracle-vip.fedex.com cps-pre-oracle-vip
    10.88.119.201 cps-pre-oracle-1.fedex.com cps-pre-oracle-1
    10.88.119.202 cps-pre-oracle-2.fedex.com cps-pre-oracle-2
    10.88.119.203 cps-pre-oracle-1-vip.fedex.com cps-pre-oracle-1-vip
    10.88.119.204 cps-pre-oracle-2-vip.fedex.com cps-pre-oracle-2-vip
    #Internal
    192.168.101.1 cps-oracle-1-priv.fedex.com cps-oracle-1-priv
    192.168.101.2 cps-oracle-2-priv.fedex.com cps-oracle-2-priv
    Does 11G provide facility to enter multiple vips in CRS.

  • RAC (Linux) Security: "Unknown" Passwords for CRS, ASM, Oracle?

    We're going through an audit (PCI) and the question of these shared accounts has come up. I do realize that ssh connectivity, with key exchange, is used in the maintenance of Oracle RAC clusters. What I'm thinking/wondering is if it's possible to have an "unknown" password for one or all of these accounts. This would mean that a 'sudo su' would still be allowed to the account if needed, and ssh key exchange would still work, but it would tighten up the security a bit (and make writing compensating controls a lot easier).
    I'm wondering if anyone can help identify areas where actually having the crs, asm and oracle passwords will be required in the care and feeding of RAC? Also, or alternately, if someone can point me to the documentation where it shows having the password is a prerequisite, that would make my life a lot easier.
    Thanks in advance for any assistance.

    Hi,
    If I understand your requirement correctly, yes, I believe it's possible.
    If you're doing RAC, you must have "user equivalence" (i.e. ssh via password-less key based authentication) set up on all nodes in the cluster. In addition, it's possible to disable password authentication, once you have key authentication set up. Finally, once you're logged in, you still need sudo to work, correct? If password will not be known to you, you can set up sudo to work without a password, (look at NOPASSWD option) but consider that, you really need to set things up correctly, or you may jeopardize your system security.
    Ideally, you would:
    1.) set up ssh keys with passphrase.
    2.) disable password authentication.
    3.) set up ssh-agent and authentication forwarding.
    I'm not an expert at all, I've just recently been reading up to try to do something similar in my environment.
    I found this three-part article that seems to cover the subject pretty thoroughly:
    http://www.ibm.com/developerworks/linux/library/l-keyc.html
    Hope that helps,
    -Mark

  • Oracle RAC multiple LISTENERS

    Greetings,
    I have 2 test databases on single Oracle RAC installation.
    Is it possible to configure separate  LISTENERS for databases?
    Oracle v. 11.2.0.3
    OS RHEL 6.3

    Hi Farid,
    Yes it is possible: You can create listener (netca or manualy) and add listener to resource srvctl .
    1) Create a new RAC listener using 'netca'
    As the grid user invoke "netca" from the 11.2 GRID_HOME, the select "Cluster configuration" -> "Listener configuration" -> "Add", enter Listener name as required.  For example: "LISTENER_MON".
    On the next page, "Select Subnet", the 2nd subnet will appear in the drop down list.
    For example:
    $ ./netca
    Oracle Net Services Configuration:
    Oracle Net Configuration Assistant is launched from Grid Infrastructure home. Network configuration will be clusterwide.
    Configuring Listener:LISTENER_MON
    prodserver1...
    prodserver2...
    Listener configuration complete.
    Oracle Net Listener Startup:
        Listener started successfully.
    Oracle Net Services configuration successful. The exit code is 0
    2) Add listener
    $ ./srvctl add listener -l LISTENER_MON -s -p 1523 -k 2
    3) Verify the new RAC listener
    $ lsnrctl status LISTENER_MON
    Thank you

  • Lost permission to my external drive after : Debugger called : panic

    Hi,
    I run Snow Leopard. Yesterday, I installed a RAID array using an external disk. The result was that the external disk was connected but, it did not seem to work. I have many external disk and many partition on my boot disk. They are all protected with restricted permission. I have set permissions to read/write for me and staff and deny access to others.
    Today, I had a major crash. On the screen was written "Debugger called : <panic>". After reinstalling Snow Leopard with my boot disk I had the message that <<System/Library/Extentions/LexarFilterScheme.kext >> was not properly installed. Finder wasn't able to show any window. Restarting Finder did not solve the problem.Then I installed Snow on my old RAID disk and boot with this disk. I was then able to run disk utility and uninstall the RAID array. This solved this problem.
    But, now, I got a big problem. The permission of all my external disk and secondary partitions of my primary disk are now changed to Custom and there is no way I can access them anymore. I can do a check disk but I can't repair permission as they are not accessible.
    If I click on dick folder, get info, sharing & permissions, enter password and changed my privelege from custom to read & write, when I close and reopen get info, permission as not changed.
    Can anybody help me to get my data back?

    See V.K.'s post in this thread: https://discussions.apple.com/message/11044944?messageID=11044944#11044944?messa geID=11044944

  • I lost permission to do everything since upgrade

    Macbook asks for permission for every app and has shut me out of others.  Have tried reboot and fix permissions to no avail.

    This can occur if your Home folder permissions have been corrupted. The following procedure will reset them to their correct settings. It might not fix the problem but it won't make it any worse.
    Even if resetting permissions results in fixing the problem, the reason the corruption occurred must still be addressed.
    To restore your home folder permissions to their correct settings perform the following:
    Boot OS X Recovery by restarting the computer while holding the Command (⌘) and R keys.
    When the Repair Utilities screen appears, select Utilities from the Menu Bar, then click Terminal.
    In the Terminal window, type resetpassword and press Return.
    The password reset utility window will appear. Do not select a new password.
    Instead, click on the icon for your Mac's hard disk at the top. From the dropdown below it, select the user account with the problem.
    At the bottom of the window, you will see Reset Home Directory Permissions and ACLs. Click the Reset button. Repeat for each User account with the problem.
    The reset process may take a couple of minutes. When it finishes quit the programs and restart your Mac.

  • Lost permission to install and update

    I recently tried to install the new security update and received this error:
    "Make sure you have permission to write to /private/tmp/503/TemporaryItems/com.apple.SoftwareUpdate"
    I am the only user on my mac. I check the admin status and I am still ok there. I tried to find the specific files but could not find them. Suggestions?

    Mac OS X is a Multi-User system, even if you are the only user.
    The user attempting the update must have Administrator privileges (Admin should appear under that name in System Preferences > Accounts.
    It is possible that you cannot write to the subdirectory in that error message. If that is the case, running Disk Utility, selecting your Hard Drive and clicking (Repair Permissions) will sometimes fix things up. That subdirectory is usually hidden, but there are ways to find it and check its ownership and permissions manually.

  • MacPro/multiple OS drives permission problems? Need Help

    Hi,
    I am running a MacPro with both a Lepoard and Snow Leopard OS drives.
    I had a folder of image files on my Leopard desktop which I want to dupelicate on my Snow Leopard desktop to test my photo applications setup which I am trying to mirror on Snow Leopard drive. I copied the folder full of image files onto my SL desktop by dragging it from the actiuve Leopard desktop and onto the desktop folder of the Snow Leopard drive.
    When I booted into Snow Leopard and tried to import the images from the folder into Adobe LightRoom the application said that the import could not take plca due to missing image files... even though I could see the preview image files.
    I next tried to open the desktop folder on my Leopard drive... while I could see the folder I could not see what I knew was in it.
    A LightRoom guru said it sounded like a permissions problem... that if I had copied the floder full of image files to an external drive or thumb drive and THEN onto SL then it should work..
    My question is this... How do I or even should I set permissions so that I can access and transfer files between the Leopard and Snow Leopard drives without worrying about premissions? It would be nice if I could look at the contents of my Leopard Desktop while booted in SL.
    How do I make these changes?
    Thanks

    Baltwo,
    On a single OS system, if any user tries to access the home folder of another user, they will see the do not enter logo on the folders. Great, we have file security.
    However, along with the user name, there is also a number assigned to each account. To the OS, the number is the important thing, not the username.
    On a multi-OS system, that's a problem.
    The number controls several things, including file access, regardless of user name. The numbering sequence is the same in 10.5 and 10.6.
    User account 1 is user account 1, regardless of the name behind the number.
    Therefore, if user account 1 is john under 10.6,
    but
    user account 1 is mary under 10.5,
    then when mary is logged in, she will have access to her own files under 10.5, AND johns files on the 10.6 drive. Mary will not see the do not enter in Johns home folders.
    Similarly, john will have access to both his files under 10.6, and marys files under 10.5, and will not see the do not enter signs on Marys home folders.

  • Server 2012 lost permission and share folders

    I restart the server and the folder keep with the problem, i have other folder shared in the same location and work good, you think the solution is move all files to a new folder? 

    Have you tried restarting the "Server" service after rebooting to see if the folder permissions and sharing status come back? If this helps, you can create a script to run at startup to restart that service as a temporary workaround.
    Also, I would try creating and sharing another folder in the same parent folder as the problematic folder and see if it retains the permissions and sharing when the server is rebooted. If so and if possible, move contents of the problematic folder into the new folder.

  • Recently lost permission to entire directory

    My wife and I have been sharing a folder in /Users/Shared that contained 5 iphoto libraries. All of a sudden, one day her user rights to access the iphoto library folder with all 5 libraries is gone. She gets an error that the iphoto library is locked, or the disk is locked. We have been successfully sharing these libraries for a while and now I have no clue how to restore her rights. info for those who don't know, only applies to change the rights of the current object, and doesn't change rights for all future items so that is not the answer. How does one loose rights so easily? Why does this even exist? Why can't shared be shared like it is on a PC? what's with all the security? I'm just trying to enjoy a computer with my wife and i'm having a rought time of it. I tried repairing disk permissions, but that didn't help. We are at a total loss and nobody who i've asked that owns a mac knows the answer.
    Can anybody help me? I don't know where else to get help.
    Thanks

    What are the permissions of the particular libraries in question? What are the permissions for the /Users/Shared/ folder and the /Users/ folder.
    Did you know you can share iTunes and iPhoto libraries from within each application? It should not be necessary to put the library in the /Users/Shared/ folder.

  • Multiple Problems: Lost messages, Booting, Wifi

    Hi there Guys!
    First of all - I bought a Blackberry device to get rid of many problems (stuff that never worked) - and was hoping a businessproof phone of this company could help.
    In only 5 month my former respect for this brand turned into anger.
    First thing that happened:
    I wanted to delete an email, phone froze, restarted. All of my communications were deleted. Mails. Texts. Everything. I tried to contact the twitterhelp and did not even get a response. Looking for a servicecenter? Nope, use twitter or this board.
    Second:
    Since the upgrade to the latest OS - Version (10.2.1.537)  the phone starts only at each 3. or 4th try. And if it starts it takes up to 7 minutes. That is way more than unacceptable, this is a joke.
    Third (and the reason it needs to restart that often):
    As soon as the connectivity to my wifi drops the phone does not (under any circumcances) reconnect. Disabling wifi does not work. Disabling all networks does not work. Deleting the concerning wifi from the list and reentering all information: Does not work. I need to restart it. Which leads to >> second.
    It is simply outragous for a company like Blackberry. I am stranded with no support and a 500 € device that seems like a late night release of a software, that should have never made it to daylight.
    If someone can help me here,
    I would be very happy.
    Otherwise this phone is going back to the shop and it was my last BB device.
    Greetings from Germany,
    Matthias

    Hi matthias if it is a new phone you might have this restart thing going until it synchronizes... as far as the software goes it's is obvious that it has not been installed correctly I would suggest backing up every thing and going for a os reload this way it should get working

  • Install CRS and RAC with different users

    I' m tring to install CRS and RAC with different users.
    It is supported but I don't find documentation.
    Have someone experience with this configuration ?
    My question are related to permission/own of voting and ocr file.
    in this configuration is CRS owner or DB owner that run srvctl commands ?
    Thanks !

    Yes it is ... check out the RAC FAQ on metalink, and just as Chris metioned the users will need to have the oinstall group as their primary..
    "Is it supported to install CRS and RAC as different users.
    Yes, CRS and RAC can be installed as different users. The CRS user and the RAC user must both have "oinstall" as their primary group, and the RAC user should be a member of the OSDBA group.
    Modified: 09-SEP-04 Ref #: ID-5769 "

  • How to set up multiple NLS_LANG or update the NLS_LANG in windows registry

    Hi!
    In our server machine, we have installed the Oracle Net Manager Version 10.2.0.0.0, which is used to connect to different oracle databases in different NLS_LANG settings (i.e., JA16SJIS, KO16KSC5601, WE8ISO8859P1). Currently, our NLS_LANG is set to "AMERICAN_AMERICA.UTF8". In order not to convert the character set to UTF-8 format, could anyone tell me:
    1. how to set multiple NLS_LANG for different databases in registry
    2. how to switch the NLS_LANG setting in registry programmatically in order to retrieve/view the data in the corresponding character set (same as the setting in Oracle DB) for the dedicated oracle database
    Please advise. Thanks a lot
    Best Regards
    Pinga

    1. how to set multiple NLS_LANG for different databases in registryBy default NLS_LANG registry settings is linked to the Oracle home and not to the database. I don't think that you can set a NLS_LANG setting for each database (unless you are using a command line tool and in this case you can set the NLS_LANG environment variable).
    See also OTN NLS_LANG FAQ.

Maybe you are looking for