Require official Oracle Best Practices about PSU patches

A customer complained about the following
Your company statements are not clear...
On your web page - http://www.oracle.com/security/critical-patch-update.html
The following is stated!
Critical Patch Update
Fixes for security vulnerabilities are released in quarterly Critical Patch Updates (CPU), on dates announced a year in advance and published on the Oracle Technology Network. The patches address significant security vulnerabilities and include other fixes that are prerequisites for the security fixes included in the CPU.
The major products patched are Oracle Database Server, Oracle Application Server, Oracle Enterprise Manager, Oracle Collaboration Suite, Oracle E-Business Suite, PeopleSoft Enterprise Tools, PeopleSoft CRM, JD Edwards EnterpriseOne, JD Edwards OneWorld XE, Oracle WebLogic Suite, Oracle Communications and Primavera Product Suite.
Oracle recommends that CPUs be the primary means of applying security fixes to all affected products as they are released more frequently than patch sets and new product releases.
BENEFITS
* Maximum Security—Vulnerabilities are addressed through the CPU in order of severity. This process ensures that the most critical security holes are patched first, resulting in a better security posture for the organization.
* Lower Administration Costs—Patch updates are cumulative for many Oracle products. This ensures that the application of the latest CPU resolves all previously addressed vulnerabilities.
* Simplified Patch Management—A fixed CPU schedule takes the guesswork out of patch management. The schedule is also designed to avoid typical "blackout dates" during which customers cannot typically alter their production environments.
PROGRAM FEATURES
* Cumulative versus one-off patches—The Oracle Database Server, Oracle Application Server, Oracle Enterprise Manager, Oracle Collaboration Suite, Oracle Communications Suite and Oracle WebLogic Suite patches are cumulative; each Critical Patch Update contains the security fixes from all previous Critical Patch Updates. In practical terms, the latest Critical Patch Update is the only one that needs to be applied if you are solely using these products, as it contains all required fixes. Fixes for other products, including Oracle E-Business Suite, PeopleSoft Enterprise Tools, PeopleSoft CRM, JD Edwards EnterpriseOne, and JD Edwards OneWorld XE are released as one-off patches, so it is necessary to refer to previous Critical Patch Update advisories to find all patches that may need to be applied.
* Prioritizing security fixes—Oracle fixes significant security vulnerabilities in severity order, regardless of who found the issue—whether the issue was found by a customer, a third party security researcher or by Oracle.
* Sequence of security fixes—Security vulnerabilities are first fixed in the current code line. This is the code being developed for a future major release of the product. The fixes are scheduled for inclusion in a future Critical Patch Update. However, fixes may be backported for inclusion in future patch sets or product releases that are released before their inclusion in a future Critical Patch Update.
* Communication policy for security fixes—Each Critical Patch Update includes an advisory. This advisory lists the products affected by the Critical Patch Update and contains a risk matrix for each affected product.
* Security alerts—Security alerts provide a notification designed to address a single bug or a small number of bugs. Security Alerts have been replaced by scheduled CPUs since January 2005. Unique or dangerous threats can still generate Security Alert email notifications through MetaLink and the Oracle Technology Network.
Nowhere in that statement is the Patch Set Update even mentioned. If Oracle intends to recommend to all customers that Patch Set Updates are the recommended means of Patching for Security and Functionality then it should be stated so here!
Please clarify!
Where can I find the current information so that I can use to Official Oracle statement as a reference for my Enterprise Practices and Standards document? The individual patch package references you are giving me do not state Oracle recommended Best Practice, they only speak to the specific patch package they describe. These do not help me in making an Enterprise statement of Practices and Standards.
I need to close the process out to capture a window of availability for Practices and Standards approval.
Do we have any Best Practice document about PSU patches available for customers?

cnawrati wrote:
A customer complained about the following
Your company statements are not clear...
On your web page - http://www.oracle.com/security/critical-patch-update.html
Who is the "your" to which you are referring?
<snip>
Nowhere in that statement is the Patch Set Update even mentioned. If Oracle intends to recommend to all customers that Patch Set Updates are the recommended means of Patching for Security and Functionality then it should be stated so here!Um. OK
Please clarify!
Of whom are you asking for a clarification?
Where can I find the current information so that I can use to Official Oracle statement as a reference for my Enterprise Practices and Standards document? The individual patch package references you Who is the "you" to which you refer?
are giving me do not state Oracle recommended Best Practice, they only speak to the specific patch package they describe. These do not help me in making an Enterprise statement of Practices and Standards.
I need to close the process out to capture a window of availability for Practices and Standards approval.
Be our guest.
Do we What do you mean "we", Kemosabi?
have any Best Practice document about PSU patches available for customers?This is a very confusing posting, but overall it looks like you are under the impression that this forum is some kind of channel for communicating back to Oracle Crop anything that happens to be on your mind about their corporate web site and/or policies and practices. Please be advised that this forum is simply a platform provided BY Oracle Corp as a peer operated user support group. No one here is responsible for anything on any Oracle web site. No one here is responsible for any content anywhere in the oracle.com domain, outside of their own personal posting on this forum. In other words, you can complain all you want about Oracle's policy, practice, and support, but "there's no one here but us chickens."

Similar Messages

Where does one find the Oracle Best Practice/recommendations for how to DR

What is the Oracle Best Practice for install/deployment and configuration of ODI 11g for Disaster Recovery?
We have a project that is using Oracle ODI 11g (11.1.1.5).
We have configured all the other Oracle FMW components as per the Oracle DR EDG guides. Basically using the Host ip name/aliasing concept to ‘trick’ the secondary site into thinking
it is primary and continue working with minimal (or no) manual reconfiguration. But will this work for ODI? The FMW DR guide has sections for SOA, WebCenter and IdM, but nothing for ODI.
Since ODI stores so much configuration information in the Master Repository..when this DB gets ‘data guarded’ to the secondary site and promoted to Primary…ODI will still think it is at the ‘other’ site. Will this break the actual agents running the scenarios?
Where does one find the Oracle Best Practice/recommendations for how to DR ODI properly?
We are looking for a solution that will allow a graceful switchover/failover with minimal manual re-configuration.

user8804554 wrote:
Hi all,
I m currently testing external components with Windows Server and I want to test Oracle 11g R2.
The only resource I have is this website and the only binaries seem to be for Linux OS.You have one other HUGE resource that, while it won't answer your current question, you'd better start getting familiar with if you are going to use Oracle. That is the complete and official documentation, found at tahiti.oracle.com
>
Does anybody know how I can upgrade my Oracle 11.1.0.7 version to the R2 release?
Thanks,
Bertrand

What oracle best practices in mapping budgeting to be implement at item

Dear Consultant's
Really i need you values Consultantancy
What oracle best practices in mapping budgeting to be implement at item category level or item level
I want to check fund at encumbrance account according to item level
Case:
I have there item category
One is Computer's items
Tow is printer's items
Third is food's item's
I want to implement my budget on item category level
Example:
I want my purchase budget for item with printer's type not exceed 30000USD
And For item with type food's not exceed 45000usd
How to map this in oracle application
The modules implemented on my site
(GL, AP, AR, INV, PURCHASING, OM)
Please give me the oracle best practice that handle this case
Thanks for all of you

Hi,
It is really difficult to have Budgetary Control on Inventory Items in Average Costing enviornment as you can have only one Inventory Account at the Inventory Organization level.
You have to modify your PO / Requisition Account Generator to populate the Encumbrance Account in PO / Requisition based upon item category. Moreover, the "Reverse Encumbrance" flag in your Inventory Org needs to be unchecked so that the encumbrances are not revered when the goods are received.
Gajendra

Best practic about web document

Hi
I need a handbook (best practic) about web document.
can you help me?
thanks.

Hi Ignacio,
try this:
<a href="http://www.sapdesignguild.org/resources/htmlb_guidance/">http://www.sapdesignguild.org/resources/htmlb_guidance/</a>
and
<a href="http://help.sap.com/saphelp_erp2004/helpdata/en/4e/ac0b94c47c11d4ad320000e83539c3/frameset.htm">http://help.sap.com/saphelp_erp2004/helpdata/en/4e/ac0b94c47c11d4ad320000e83539c3/frameset.htm</a>
Regards,
Gianluca Barile

Is there any best practice about by-products

Dear all,
Is there any best practice about handleing by-products in production order?
Thanks!

Hi,
Have you searched the SCN forum, blog and wiki?
You may check this: http://wiki.sdn.sap.com/wiki/pages/viewpage.action?pageId=23593837
Thanks,
Gordon

Best Practices for automated patching?

Howdy,
We've been having trouble getting patching to work on our servers for months. I decided it's time to start over. I've done some searching and have found tons of different people saying they have the best practices and recommended ways of handling
patches but they're all different.
I'm using SCCM 2012 R2 and want to setup ADRs so that every month we can set all our servers up to install their Windows Updates. I have a few questions:
Is there an "Official" tutorial, video, walkthrough of how we should be doing this?
Is the best way to test this to set something up that is available ASAP but doesn't expire until far in the future? Should I then be able to see the patches in Software Center as available but they just won't actually do anything since the expiration
would be way down the road?
Most of our servers are running 2012 or 2012 r2 and we're just concerned with the standard patches that come out every month.
Thanks for any links, input, advice, etc.

> I never know if a tutorial I found is a good one or just some random person that recorded
what they were doing.
That's just it... tutorial's are meant to show you how the features work. They are not meant to be "follow these step-by-step in your production environment and you're done" instructions. Gerry and Niall's guides are to walk you through building
things out in a lab environment so you can learn them. You need to learn how the features work, look at the requirements of your company, and then
make conscious decisions about how to implement the tool to meet the requirements.
If you don't feel like you'll be able to synthesize that from knowledge learned in tutorials/guides/books, then I'd suggest bringing in a consultant with a deep understanding of the product to help you accomplish it.
I hope that helps,
Nash
Nash Pherson, Senior Systems Consultant
Now Micro -
My Blog Posts
If you found a bug or want the product to work differently,
share your feedback.
<-- If this post was helpful, please click the up arrow or propose as answer.

Oracle Best Practices for generating Transactions IDs in high OLTP systems

We are in the process of designing a high OLTP system using Oracle 11g Database with the following NFRs:
1) 1 million transactions per day
2) 100,000 concurrent users
There are close to about 160-180 entities in the database and we want to know the best approach/practice in deriving the transaction IDs for the OLTP system. Our preferences are given below:
1) Use Oracle Sequence starting with 1,000,000,000 (1 billion) - This is to make the TXN ID look meaningful when it starts with 1 billion instead of starting it with 1.
2) Use timestamp and cast it to number instead of using Oracle sequence.
Note: Transaction IDs must appear in sequence as they are inserted - be it sequence/timestamp
I would like to know pros/cons of the above methods and their impacts on performance. Also, appreciate if you could share any any best practices/methods that Oracle supports.
Thanks in advance.
Ken R

Ken R wrote:
I did a quick PoC using both Oracle Sequence & Timestamp for 1 million inserts in a Non-RAC environment. Code used is given below:
create sequence testseq start with 1 cache 10000 order;
create table test1 (txnid number, txndate timestamp(9));
create table test2 (txnid number, txndate timestamp(9));
begin
for i in 1..1000000
loop
insert into test1 values(testseq.nextval,systimestamp(9));
end loop;
commit;
end;
begin
for i in 1..1000000
loop
insert into test2 values(to_number(to_char(systimestamp(9),'yyyymmddhh24missff9')), systimestamp(9));
end loop;
commit;
end;
Here are the results:
select max(txndate)-min(txndate) from test1;
Result >> 0 0:3:3.514891000
select max(txndate)-min(txndate) from test2;
Result >> 0 0:1:32.386923000
It appears that Timestamp is faster than sequence... Any thought is highly appreciated...Interesting that your sequence timing is so slow. You say this was a non-RAC environment, but I wonder if you had Oracle linked in RAC mode even though you were running single instance - this would result in the ORDERed sequence running through RAC's "DFS Lock Handle" mechanism which might account for the timing anomaly.
Unfortunately your test is not particularly relevant. As DomBrooks points out there are lots of problems with sequence-based or time-based columns, especially in RAC, and most particularly if you think you want a "no-gap" sequence. On top of this, of course, your test doesn't include an index on the relevant column, and it's single user and doesn't test for any concurrency effects.
Typical performance problems are: your RAC instances spend all their time negotiating who gets to use the next value; the index you use to enforce uniqueness suffers from massive contention on the "high-value" block unless you create a reverse-key index - at which point you have to be able to cache the entire index to minimise I/O overheads; you can hash partition the index to avoid using the reverse-key option - but that costs a lot of money if you don't already license the partitioning option.
Regards
Jonathan Lewis

Oracle Best practices for changing Byte to Char on Varchar2 columns

Dear Team,
Application Team wanted to change Byte to Char on Varchar2 columns to accommodate Multi byte character on couple of production tables.
Wanted to know is it safe to have mixture of BYTE and CHAR semantics in the same table i have read on the couple of documents that It's good practice to avoid using a mixture of BYTE and CHAR semantics columns in the same table.
What happens if we have mixture of BYTE and CHAR semantics columns in the same table?
Do we need to gather stats & rebuild indexes on the table after these column changes .
Thanks in Advance !!!
SK

Application Team wanted to change Byte to Char on Varchar2 columns to accommodate Multi byte character on couple of production tables.
Wanted to know is it safe to have mixture of BYTE and CHAR semantics in the same table i have read on the couple of documents that It's good practice to avoid using a mixture of BYTE and CHAR semantics columns in the same table.
No change is needed to 'accommodate Multibyte characters'. That support has NOTHING to do with whether a column is specified using BYTE or CHAR.
In 11g the limit for a VARCHAR2 column is 4000 bytes, period. If you specify CHAR and try to insert 1001 characters that each take 4 bytes you will get an exception since that would require 4004 bytes and the limit is 4000 bytes.
In practice the use of CHAR is mostly a convenience to the developer when defining columns for multibyte characters. For example for a NAME column you might want to make sure Oracle will allocate room for 50 characters REGARDLESS of the actual length in bytes.
If you provide a name of 50 one byte characters then only 50 bytes will be used. Provide a name of 50 four byte characters and 200 bytes will be used.
So if that NAME column was defined using BYTE how would you know what length to use for the column? Fifty BYTES will seldom be long enough and 200 bytes SEEMS large since the business user wants a limit of FIFTY characters.
That is why such columns would typically use CHAR; so that the length (fifty) defined for the column matches the logical length of the number of characters.
What happens if we have mixture of BYTE and CHAR semantics columns in the same table?
Nothing happens - Oracle could care less.
Do we need to gather stats & rebuild indexes on the table after these column changes .
No - not if you by 'need' you mean simply because you made ONLY that change.
But that begs the question: if the table already exists, has data and has been in use without their being any problems then why bother changing things now?
In other words: if it ain't broke why try to fix it?
So back to your question of 'best practices'
Best practices is to set the length semantics at the database level when the database is first created and to then use that same setting (BYTE or CHAR) when you create new objects or make DDL changes.
Best practices is also to not fix things that aren't broken.
See the 'Length Semantics' section of the globalization support guide for more best practices
http://docs.oracle.com/cd/E11882_01/server.112/e10729/ch2charset.htm#i1006683

Best Practice for applying patches in WL 8.1

Below is what I did to apply patches to WL 8.1 SP2. Is there a better way?
Best Practice? Thanks in advance.
1) Created directory.
C:\bea\weblogic81\server\lib\patches
2) Copied jar files to patches directory.
CR127930_81sp2.jar
CR124746_81sp2.jar
3) Modified startWebLogic.cmd to include jar files first in the classpath.
set
CLASSPATH=%WL_HOME%\server\lib\patches\CR124746_81sp2.jar;%WL_HOME%\server\l
ib\patches\CR127930_81sp2.jar;%WEBLOGIC_CLASSPATH%;%POINTBASE_CLASSPATH%;%JA
VA_HOME%\jre\lib\rt.jar;%WL_HOME%\server\lib\webservices.jar;%CLASSPATH%
4) Restarted server and saw in console that the patches were applied.

Hi:
SAP Standard does not recommend you to update quantity field in asset master data. Just leave the Qty Field Blank , just mention the Unit of Measure as EA. While you post acquisition through F-90 or MIGO this field will get updated in Asset master data automatically. Hope this will help you.
Regards

Best Practice for Portal Patches and effort estimation

Hi ,
One of our client is applying the following patches
1. ECC 6.0 SP15(currently SP14)
2. ESS MSS SP15(currently SP14 with some level of functional customization )
3. EP 7 SP18(currently SP14)
We would like to kwow the best practice for applying portal patches and the effort estimation for redoing the portal devt on the new patch.
o   What is the overall level of effort with applying Portal patches?
o   How are all the changes to SAP objects handle? Do they have to be
     manually re-entered?
o What is the impact of having a single NWDI instance across the
    Portal Landscape during the Patch process?
Regards,
Revathi Raju.

Hi Revathi,
o What is the overall level of effort with applying Portal patches?
overall effort to apply the patch is apprx 1/2-1 days for NW7 system. This is exclude the patch files download because it's based on your download speed.
o How are all the changes to SAP objects handle? Do they have to be
manually re-entered?
Depending on your customization. Normally it wont effect if you created the customzation application apart from SAP standard application
o What is the impact of having a single NWDI instance across the
Portal Landscape during the Patch process?
Any change that related to NWDI, you might be need to re-deployed from NWDI itself.
Thanks
Regards,
AZLY

Best practices about JTables.

Hi,
I'm programming in Java since 5 months ago. Now I'm developing an application that uses tables to present information from a database. This is my first time handling tables in Java. I've read Sun's Swing tutorial about JTable, and several information on other websites, but they limit to table's syntax and not in best practices.
So I decided what I think is a proper way to handle data from a table, but I'm not sure that is the best way.Let me tell you the general steps I'm going through:
1) I query employee data from Java DB (using EclipseLink JPA), and load it in an ArrayList.
2) I use this list to create the JTable, prior transformation to an Object[][] and feeding this into a custom TableModel.
3) From now on, if I need to search an object on the table, I search it on the list and then with the resulting index, I get it from the table. This is possible because I keep the same row order on the table and on the list.
4) If I need to insert an item on the table, I do it also on the list, and so forth if I'd need to remove or modify an element.
Is the technique I'm using a best practice? I'm not sure that having to keep synchronized the table with the list is the better way to handle this, but I don't know how I'd deal just with the table, for instance to efficiently search an item or to sort the table, without doing that first on a list.
Are there any best practices in dealing with tables?
Thank you!
Francisco.

Hi Joachim,
What I'm doing now is extending DefaultTableModel instead of implementing AbstractTableModel. This is to save implementing methods I don't need and because I inherit methods like addRow from DefaultTableModel. Let me paste the private class:
protected class MyTableModel extends DefaultTableModel {
        private Object[][] datos;
        public MyTableModel(Object[][] datos, Object[] nombreColumnas) {
            super(datos, nombreColumnas);
            this.datos = datos;
        @Override
        public boolean isCellEditable(int fila, int columna) {
            return false;
        @Override
        public Class getColumnClass(int col) {
            return getValueAt(0, col).getClass();
    }What you are suggesting me, if I well understood, is to register MyTableModel as a ListSelectionListener, so changes on the List will be observed by the table? In that case, if I add, change or remove an element from the list, I could add, change or remove that element from the table.
Another question: is it possible to only use the list to create the table, but then managing everything just with the table, without using a list?
Thanks.
Francisco.

Any Oracle best practice/standards for inter-DataCente links for Oracle RAC

Hello Oracle Experts,
Am working for a customer to set up Oracle RAC architecture hosting SAP/Non-SAP applications per SLA levels(MC/BC/Standard) specs. Currently my network team needs calculation to arrive at whether we will go for a (1), (2) or (3) 10Gig links for inter DC (Data-Center) for Oracle RAC.. below is additional background:
•     Porting all client SAP/Non-SAP Oracle databases to new 2 data-centers.
•     There will be 10 blades (4x BL680s and 6x BL460s) in each DC (can scale-up/out later on).
•     Clusters architecture to support Extended/Stretched RAC cluster feature
•     Clusters 2-node each(1-datacenter1, 1-datacenter2) and nodes distributed across 2 x c7000 such that no cluster has more than one node in an enclosure.
•     Each node will have - 4 NIC ports ( 2 x public and 2 x private) , 2 dual-port HBA
•     Oracle ASM/ACFS (ASM Cluster File System), Voting Disk, OCR and Database files
•     the versions are Oracle 11g RAC, Oracle 10g RAC and Oracle 9i (for DataGuard/Standby) on RHEL 6 on Proliant Blades (x86) + BladeMatrix
My network colleagues considering using DWDM across the 2 DCs(given the lesser cost?). Am still looking around if there are any Oracle/industry-best practices around this and having a calculation to support that..
Many Thanks in advance..
Regards,
Abhijit

Hi ,
There are no specific set of steps / practices for batch loading contents to ucm . It would be very much dependent on how many contents does the user have to load to UCM and how well the server is configured in terms of performance .
You can get more details from the following documentation link : http://docs.oracle.com/cd/E21043_01/doc.1111/e10792/c02_settings009.htm
Thanks,
Srinath

Oracle Best Practices in 10g When Disabling NUMA

We have both Linux and Solaris 10 DB servers running 10g on them with NUMA. What is Oracle's best practice for dealing with NUMA in hardware when it can be disabled?

user10387007 wrote:
We have both Linux and Solaris 10 DB servers running 10g on them with NUMA. What is Oracle's best practice for dealing with NUMA in hardware when it can be disabled?How are you using NUMA (Non Uniformed Memory Access)?
NUMA can be implemented at CPU level - in which case CPU affinity becomes important. NUMA can be used across an Interconnect (e.g. SCSI over RDMA protocol).
So it depends on what you mean by NUMA and how you are using it (and whether or not it is used by the Oracle s/w stack itself).

Best Practice about enabling RD

After running the Best Practice Analyser i've been getting the error that the "server should be configured to allow remote desktop connections"
See http://technet.microsoft.com/nl-nl/library/ff646929(v=ws.10).aspx
I've got a GPO which enables RDC for me and works fine. If I go to Remote Settings on the specified server it's cleary enabled.
Still the error kept popping up, only after I disabled the GPO and falling back to the default (local) off setting and enabling it manually, the error is gone. After this I can again apply the GPO without any errors.
So the error is gone now, but I'm still curious why this happened. I should be able to configure stuff through GPO's right? Am I missing something here?
Thanks in advance,

Hi,
Thank you for posting in Windows Server Forum.
The setting which you have configured are all correct, {for information: need GPO setting “Allow logon through Remote Desktop Services” under User Rights assignment must be enabled}. From description seems the GPO setting is not applied\configured
properly and this issue happens. Just be sure to update the GPO once you perform the steps.
Just for reference you can go through following article.
Securing Remote Desktop for System Administrators
Hope it helps!
Thanks.
Dharmesh Solanki
TechNet Community Support
Please remember to mark the replies as answers if they help and unmark them if they provide no help. If you have feedback for TechNet Support, contact [email protected]

Solution Manager best practices about environments

Hello,
we intend to use Solution Manager 4.0.
My question : I wonder whether we need to have a single instance a SM (production) or whether we need to have multiple instances (one development SM where developments and customizing will be performed and one production SM populated with transport requests coming from the development SM) ?
What are the best practices ?
Thank you.
Regards,
Fabrice

Dear Fabrice,
In principle you donot need to have 2 instances of Solution Manager. 1 Instance is sufficient enough for monitoring all the Satellite Systems.
However if you intending to have Customized ABAP on Solution Manager then it might be a good idea to do so in an different client in the same instance keeping the client as an development client.
Most of the customizing in Solution Manager is non transportable hence it should be directly done in the productive client.
Hope this answers your queries.
Regards
Amit

Require official Oracle Best Practices about PSU patches

Similar Messages

Maybe you are looking for