22 Using the Archival Utilities

22.1.1 Understanding the Reconciliation Archival Utility

Oracle Identity Manager stores reconciliation data from target systems in Oracle Identity Manager tables called active reconciliation tables:

During the reconciliation process, Reconciliation Manager reconciles data in the active reconciliation tables with the Oracle Identity Manager core tables. Because Reconciliation Manager does not remove reconciled data from the active reconciliation tables, they might eventually grow very large, resulting in decreased performance during the reconciliation process. You can use the Reconciliation Archival utility to archive data that has been reconciled with Oracle Identity Manager. The Reconciliation Archival utility stores archived data in the archive reconciliation tables, which have the same structure as the active reconciliation tables.

Table 22-1 lists the active reconciliation tables with the corresponding archive reconciliation tables in which data from the active reconciliation tables are archived.

You can use the Reconciliation Archival utility to perform the following tasks:

• Archive all or specific data from the active reconciliation tables to the archive reconciliation tables

• Delete all data from the active reconciliation tables

When you archive data by moving it from the active reconciliation tables to the archive reconciliation tables, you must specify the date in the YYYYMMDD format, such as all records before this date will be archived, and a reconciliation event status parameter value, which defines the data that you want to archive. For information about these archiving criteria, refer to "Archival Criteria".

If you choose to archive selective data, then the utility archives data that falls in the specified date range and event status.

When you archive all data from the active reconciliation tables to the archive reconciliation tables, the Reconciliation Archival utility archives all reconciliation data with event status of Event Linked or Event Closed.

The files that constitute the Oracle Database version of the Reconciliation Archival utility are located in the following directory:

OIM_HOME/db/oim/oracle/Utilities/Recon11gArchival

22.1.2 Prerequisite for Running the Reconciliation Archival Utility

Before running the Reconciliation Archival utility, the OIM_RECON_ARCH tablespace must be created in the database. To do so, you can run the following sample command:

CREATE TABLESPACE OIM_RECON_ARCH
        LOGGING DATAFILE 'OIM_RECON_ARCH'
        SIZE 500M REUSE AUTOEXTEND ON NEXT 10M;

22.1.3 Archival Criteria

To select reconciliation data to archive, provide the following criteria. Data with matching values will be archived.

• Date must be in the format YYYYMMDD. All records before this date that match the specified reconciliation event parameter value will be archived.

• Select Closed, Linked, Closed or Linked, or All for the reconciliation event parameter.

  • Closed describes events that have been manually closed in Reconciliation Manager.

  • Linked describes events that were reconciled in Oracle Identity Manager, including the following states:

    • Creation Succeeded

    • Update Succeeded

    • Delete Succeeded

    • Creation Failed

    • Update Failed

    • Delete Failed

  • Closed or Linked

  • All archives all events regardless of status

22.1.4 Running the Reconciliation Archival Utility

To run the Reconciliation Archival utility:

1. Ensure that the Oracle Identity Manager database is available and that no reconciliation processes are running. In addition, ensure that the Oracle Identity Manager database is not open to transactions for other sessions.

   Note:

   Oracle recommends that you run the Reconciliation Archival utility during off-peak hours.

2. Stop the Oracle Identity Manager by following the instructions in the "Starting and Stopping Servers" chapter.

3. On Microsoft Windows platforms, you must specify the short date format as M/d/yyyy. In addition, you must specify the time format as H:mm:ss. To customize the date and time formats, use the Regional and Language Options command in Control Panel.

   Note:

   • When you change the date and time format, the change is applied to all the applications running on the Microsoft Windows platform.

   • Minimal validation is done on date before calling the utility, and you can scan logs files for any ORA-18xx errors for invalid date-related errors.

4. On Linux or UNIX platforms, run the following commands to set execution permission for the oim_recon_archival.sh file and to ensure that the file is a valid Linux or UNIX text file:

   chmod 755 path/oim_recon_archival.sh
   dos2unix path/oim_recon_archival.sh
   

5. On Linux or UNIX platforms, run the path/oim_recon_archival.sh file. On Microsoft Windows platforms, run the path\oim_recon_archival.bat file.

6. For Oracle Database installations, enter values for the following parameters when prompted:

   • Oracle home directory

   • Input for validating whether the Oracle Identity Manager database is running on a remote computer

   • For a remote database, a connection string is required as input, which is of the following format: //HOST_NAME:PORT/SERVICE_NAME

   • Oracle Identity Manager database user name and password

7. When prompted, select a reconciliation event status for the data that you want to archive:

   • Enter 1 for Closed

   • Enter 2 for Linked

   • Enter 3 for Closed or Linked

   • Enter 4 for All

   • Enter 5 for Exit

8. Enter the reconciliation creation date in the YYYYMMDD format. All records before this date with required status value will be archived.

9. Enter the batch size for processing.

   The default batch size is 2000.

10. On Microsoft Windows platforms, reset the short date format to the date format for your region or locale after you run the utility. Use the Regional and Language Options command in Control Panel to reset the date format.

11. Because the data from active reconciliation tables are removed, your DBA must analyze the active reconciliation tables and their indexes in order to update the statistics. Perform this step only if you are using Oracle Database as the database for Oracle Identity Manager.

22.1.5 Log File Generated by the Reconciliation Archival Utility

After running the Reconciliation Archival utility, the following log file is generated:

./logs/oim_recon_archival_summary_TIMESTAMP.log

If the running the utility fails, then the log file records the batch number at which the utility fails along with the error messages.

22.2.1 Understanding the Task Archival Utility

In Oracle Identity Manager, a task refers to one or more activities that comprise a process, which handles the provisioning of a resource. For example, a process for requesting access to a resource may include multiple provisioning tasks. Oracle Identity Manager stores task data in the following tables, which are called active task tables:

• OSI

• OSH

• SCH

By default, Oracle Identity Manager does not remove completed tasks from the active task tables. As the size of the active task tables increases, you might experience a reduction in performance, especially when managing provisioning tasks. After a task executes successfully, you can use the Task Archival utility to archive the task data and remove it from the active task tables. Archiving task data with the Task Archival utility improves performance and ensures that the data is safely stored.

The Task Archival utility stores archived task data in the following archive task tables, which have the same structure as the active task tables:

• ARCH_OSI

• ARCH_OSH

• ARCH_SCH

You can use the Task Archival utility to archive the following types of tasks:

• Provisioning tasks for resource instances that have been revoked for disabled or deleted users

• Provisioning tasks for resource instances that have been revoked

When you archive tasks with the Task Archival utility, you can specify the type of archive operation, the user status, the task execution date, and the number of records above which to drop the indexes before archiving. The archive operation represents the type of task data to archive and the user status determines whether to archive data for users who have been deleted, disabled, or both. The task execution date represents the date on which a task is executed and must be in the format YYYYMMDD.

All executed tasks, up to the task execution date you specify, will be archived. To reduce the time that the archiving process takes, the utility drops the indexes on all active task tables when the number of records to be archived is greater than 200000. The indexes are re-created after the archived data is deleted from the active task tables. You can change the value 200000 to your preferred value. You can change the value in the following lines of code in the OIM_TasksArch.bat file or in the OIM_TasksArch.sh file:

In the .bat file, set INDXRESP=200000

In the .sh file, indxopt=200000

The files that constitute the Oracle Database version of the Task Archival utility are located in the following directory:

OIM_HOME/db/oim/oracle/Utilities/TaskArchival

22.2.2 Preparing Oracle Database for the Task Archival Utility

Before you can use the Task Archival utility with Oracle Database, you must perform the following steps:

1. Start SQL*Plus and connect to Oracle Database as a SYS user.

2. Create a separate tablespace for the archival task tables by entering the following command. Replace DATA_DIR with the directory in which you want to store the data file and adjust the size and other parameters as necessary for your environment.

   CREATE TABLESPACE TasksArch
       DATAFILE 'DATA_DIR\tasksarch_01.dbf' SIZE 1000M REUSE
       EXTENT MANAGEMENT LOCAL SEGMENT SPACE MANAGEMENT AUTO;
   

   Note:

   Oracle recommends that you allocate a large UNDO tablespace when archiving large amounts of data. In addition, turn on parallel execution by configuring the parallel_max_servers and parallel_min_servers initialization parameters. Parallel execution helps improve the performance of the archival process.

3. Connect to Oracle Database as the Oracle Identity Manager database user.

4. Enter the following command to run the cr_taskarchival_ddl_table.sql script, which creates a table named OIM_TASK_ARCH_DDL. This table is used by the Task Archival utility.

   @ path/cr_taskarchival_ddl_table.sql
   

5. Enter the following command to run the Create_TasksArch_Tables.sql script, which creates the archive task tables:

   @ path/Create_TasksArch_Tables.sql
   

6. Enter the following command to run the OIM_SP_TASKS_ARCHIVAL.sql script, which creates a stored procedure that the Task Archival utility uses to archive and delete task data:

   @ path/OIM_SP_TASKS_ARCHIVAL.sql
   

7. If your Oracle Database instance is running in ARCHIVELOG mode, you must switch to NOARCHIVELOG mode before running the Task Archival utility. See Oracle Database Administrator's Guide for information about changing the database archiving mode.

22.2.3 Running the Task Archival Utility

Perform the following steps to run the Task Archival utility:

1. Ensure that the Oracle Identity Manager database is available and that no reconciliation processes are running. Also, ensure that the Oracle Identity Manager database is not open to transactions for other sessions.

   Note:

   Oracle recommends that you run the Task Archival utility during off-peak hours.

2. Back up the OSI, SCH, and OSH tables.

3. Stop Oracle Identity Manager by following the instructions in the Oracle Identity Manager installation guide for your application server.

4. On Microsoft Windows platforms, you must specify the short date format as dddd M/d/yyyy. In addition, you must specify the time format as H:mm:ss. To customize the date and time formats, select the Regional and Language Options command in the Control Panel.

   Note:

   • When you change the date and time format, the change is applied to all the applications running on the Microsoft Windows platform

   • Minimal validation is done on date before calling the utility, and you can scan logs files for any ORA-18xx errors for invalid date-related errors

5. On Linux and UNIX platforms, run the path/OIM_TasksArch.sh file. On Microsoft Windows platforms, run the path\OIM_TasksArch.bat file.

6. For Oracle Database installations, enter values for the following parameters when prompted:

   • Oracle home directory

   • Oracle Identity Manager database name or TNS string if the Oracle Identity Manager database is running on a remote computer

   • For a remote database, a connection string is required as input, which is of the following format: //HOST_NAME:PORT/SERVICE_NAME

   • Oracle Identity Manager database user name and password

7. When prompted, select one of the following options:

   • Archive all provisioning tasks on resource instances that have been revoked for disabled or deleted users.

   • Archive all provisioning tasks on resource instances that have been revoked.

   • Exit.

8. If you chose to archive all provisioning tasks for resource instances that have been revoked for disabled or deleted users, select one of the following options:

   • Users at Deleted status

   • Users at Disabled status

   • Users at Deleted and Disabled status

   • Go back to Main Menu

9. Enter a task execution date in the format YYYYMMDD when prompted. All executed tasks, up to the task execution date you specify, will be archived. To archive all tasks that were executed on or before the current date, press Enter without entering a date.

10. Enter a value of y or Y when prompted to archive the tasks. Otherwise, enter a value of n or N to exit the utility.

    Note:

    You must enter the value of Y or N when prompted. If you press Enter without selecting a value, then the utility again counts the number of tasks to be archived and prompts you without beginning the archive.

11. On Microsoft Windows platforms, reset the short date format to the date format for your region or locale after the Task Archival utility finishes running. Use the Regional and Language Options command in the Control Panel to reset the date format.

    Note:

    You must analyze the active task tables and their indexes for updated statistics, because the data from active task tables is removed. Perform this step only if you are using Oracle Database as the database for Oracle Identity Manager.

22.2.4 Reviewing the Output Files Generated by the Task Archival Utility

Table 22-2 describes the output files that are generated by the Task Archival utility.

22.3.1 What is Platform Archival Utility?

Oracle Identity Manager stores platform data from the target systems in the following tables, which are called active platform tables:

• ORCHPROCESS

• ORCHEVENTS

• ORCHFAILEDEVENTS

• CONTEXT

• CONTEXTVALUE

By default, Oracle Identity Manager does not remove completed transaction data from the active platform tables. As the size of the active platform table increases, you might experience a deterioration in the performance of Oracle Identity Manager. You can use the Platform Archival utility to archive data processed by Oracle Identity Manager and remove it from the active platform table. Archiving transaction data with the Platform Archival utility enhances performance and ensures that the data is safely stored.

The Platform Archival utility stores archived data in the following tables, called archival platform tables, which have the same structure as the active platform tables:

• ARCH_ORCHPROCESS

• ARCH_ORCHEVENTS

• ARCH_ORCHFAILEDEVENTS

• ARCH_CONTEXT

• ARCH_CONTEXTVALUE

The files that constitute the Oracle Database version of the Platform Archival utility are located in the following directory:

OIM_HOME/db/oim/oracle/Utilities/PlatformArchival

22.3.2 Scripts Constituting the Platform Archival Utility

Table 22-3 lists the files that comprise the Platform Archival Utility.

22.3.3 Preparing Oracle Database for the Platform Archival Utility

Before you can use the Platform Archival utility with Oracle Database, you must perform the following steps:

1. Start Oracle SQL*Plus and connect to Oracle Database as a user with Create Tablespace privileges or SYSDBA privileges, such as SYS user.

2. Enter the following command to run the oim_archival_tablespace_setup.sql script, which creates a separate tablespace for the archival platform tables:

   @ path/oim_archival_tablespace_setup.sql
   

22.3.4 Running the Platform Archival Utility

Perform the following steps to run the Platform Archival utility:

1. Ensure that the Oracle Identity Manager database is available. In addition, verify that the Oracle Identity Manager database is not open for transactions with other sessions.

   Note:

   Oracle recommends that you run the Platform Archival utility during off-peak hours.

2. Back up the ORCHPROCESS, ORCHEVENTS, ORCHFAILEDEVENTS, CONTEXT, and CONTEXTVALUE tables.

3. Stop the Oracle Identity Manager by following the instructions in the "Starting and Stopping Servers"chapter.

4. On Microsoft Windows platforms, specify the short date format as dddd M/d/yyyy. In addition, you must specify the time format as H:mm:ss.

   To customize the date and time format, select the Regional and Language Options command in the Control Panel.

   Note:

   • When you change the date and time format, the change is applied to all the applications running on the Microsoft Windows platform.

   • Minimal validation is done on date before calling the utility, and you can scan logs files for any ORA-18xx errors for invalid date-related errors.

5. On Linux and UNIX platforms, run the following commands to set execution permission for the OIM_PlatformArch.sh file and to ensure that the file is a valid Linux and UNIX text file:

   chmod 755 path/OIM_PlatformArch.sh
   dos2unix path/OIM_PlatformArch.sh
   

6. On Linux and UNIX platforms, run the path/OIM_PlatformArch.sh file. On Microsoft Windows platforms, run the path\OIM_PlatformArch.bat file.

7. For Oracle Database installations, enter values for the following parameters when prompted:

   • Oracle home directory

   • Oracle Identity Manager database name or TNS string, if the Oracle Identity Manager database is running on a remote computer

   • For a remote database, a connection string is required as input, which is of the following format: //HOST_NAME:PORT/SERVICE_NAME

   • Oracle Identity Manager database user name and password

8. Enter the date range in YYYYMMDD format when prompted.

9. When prompted, select one of the following menu options:

   • 1) Archive Orchestration Process Instance Data

   • 2) Archive Context Data

   • 3) Exit

     See "Platform Archival Utility Menu Options" for more information.

10. If you select Archive Orchestration Process Instance Data, you are prompted for the archival criteria.

11. Enter the batch size for processing.

    The default batch size is 2000.

12. The count of records to be archived is displayed. Enter y or Y when prompted to archive the data. Alternatively, enter a value of n or N to exit the utility.

    Note:

    You must enter the value of Y or N when prompted. If you press Enter without selecting a value, then the utility again counts the number of records to be archived and prompts you without beginning the archival process.

13. On Microsoft Windows platform, reset the short date format to the date format of your region or locale after you run the utility. Select the Regional and Language Options command in Control Panel to reset the date format.

    Note:

    You must analyze the active tables and their indexes for updated statistics, because the data from active tables is removed. You need to perform this step, if and only if you are using Oracle Database as the database for Oracle Identity Manager.

22.3.5 Platform Archival Utility Menu Options

The Platform Archival Utility presents the following menu options.

• Archive Orchestration Process Instance Data

• Archive Context Data

"WARNING: You are archiving data less than 3 months old. Any pending transaction information will be lost, and those transactions cannot be completed. Do you want to continue?".

22.3.6 Output Files Generated by the Platform Archival Utility

Table 22-4 describes the output files that are generated by the Platform Archival utility.

22.4.1 Understanding the Requests Archival Utility

Requests that are closed or withdrawn are stored in the Oracle Identity Manager database. To archive these requests and free up the disk space and thereby enhance database performance, the Requests Archival utility is used. You can archive request data based on request creation date and request status. Archiving requests based on the request status is optional. By using request status, you can archive:

• Completed requests such as requests with status Withdrawn, Closed, and Completed. This is specified by the user input 1.

• Completed and failed requests such as requests with status Withdrawn, Closed, Completed, Failed, and Partially Failed. This is specified by the user input 2.

• All requests based on request creation date. This is specified by the user input 3.

The Requests Archival utility involves running the following scripts:

• oim_request_archival.bat and oim_request_archival.sh: Driver script batch for Microsoft Windows and shell script for UNIX

• oim_create_request_arch_tables.sql: Script with PL/SQL procedure to create archival tables against all tables that need archiving

• oim_request_archival.sql: Script with PL/SQL procedure that performs the archive

Table 22-5 lists the names of the tables which are to be archived and the corresponding archival table names.

The files that constitute the Oracle Database version of the Requests Archival utility are located in the following directory:

OIM_HOME/db/oim/oracle/Utilities/RequestArchival

22.4.2 Prerequisites for Running the Requests Archival Utility

Before running the Requests Archival utility:

• Create the OIM_REQUEST_ARCH tablespace. When the Requests Archival utility is run for the first time, a corresponding archival table is created for all the tables that are to be archived. The archival tables are created in a separate tablespace named OIM_REQUEST_ARCH. This tablespace must be created before running the utility.

• Create the required archival tables for the request tables by running the oim_create_request_arch_tables.sql script. This is the PL/SQL script to create archival tables against all tables that are to be archived.

22.4.3 Input Parameters

Table 22-6 lists the input parameters used by the Requests Archival utility:

22.4.4 Running the Requests Archival Utility

To run the Requests Archival utility:

1. Ensure that the Oracle Identity Manager database is available. In addition, ensure that the Oracle Identity Manager database is not open to transactions for other sessions.

   Note:

   It is recommended that you run the Requests Archival utility during off-peak hours.

2. Stop Oracle Identity Manager by following the instructions in the "Starting and Stopping Servers" chapter.

3. On Microsoft Windows platform, you must specify the short date format as dddd M/d/yyyy. In addition, you must specify the time format as H:mm:ss. To customize the date and time formats, use the Regional and Language Options command in Control Panel.

   Note:

   • When you change the date and time format, the change is applied to all the applications running on the Microsoft Windows platform.

   • Minimal validation is done on date before calling the utility, and you can scan logs files for any ORA-18xx errors for invalid date-related errors.

4. On UNIX platform, run the following commands to set execution permission for the OIM_request_archival.sh file and to ensure that the file is a valid UNIX text file:

   chmod 755 path/OIM_request_archival.sh
   dos2unix path/OIM_request_archival.sh
   

5. On UNIX platform, run the path/OIM_request_archival.sh file. On Microsoft Windows platform, run the path\OIM_request_archival.bat file.

   The oim_request_archival script validates the database input and establishes a connection with the database. It then calls the oim_request_archival.sql script, the script is used to compile PL/SQL procedures related to the utility.

6. For Oracle Database installations, enter values for the following parameters when prompted:

   • Oracle home directory.

   • Oracle Identity Manager database name or TNS string if the Oracle Identity Manager database is running on a remote computer. Otherwise, enter ORACLE SID.

   • For a remote database, a connection string is required as input, which is of the following format:

     //HOST_NAME:PORT/SERVICE_NAME

   • Oracle Identity Manager database user name and password.

7. When prompted, enter one of the following options:

   • Enter 1 to archive the requests with status Request Withdrawn, Request Closed, or Request Completed, and requests with creation date on or before the request creation date specified by the user in the format YYYYMMDD.

   • Enter 2 to archive the requests with status Request Withdrawn, Request Closed, Request Completed, or Request Partially Failed, and requests with creation date on or before the request creation date specified by the user in the format YYYYMMDD.

   • Enter 3 to archive all the requests with request creation date on or before the request creation date specified by the user in the format YYYYMMDD.

8. Specify the batch size, when prompted.

9. On Microsoft Windows platforms, reset the short date format to the date format for your region or locale after you run the utility. Use the Regional and Language Options command in Control Panel to reset the date format.

10. Because the data from active request tables are removed, your DBA must analyze the active request tables and their indexes in order to update the statistics. Perform this step only if you are using Oracle Database as the database for Oracle Identity Manager.

22.4.5 Log Files Generated by the Utility

All the logs are written to the logs/ directory created in the current folder. Table 22-7 lists the log files generated by the utility.