3
Management and Security

This chapter describes management and security issues associated with Oracle Application Server. It includes the following topics:

• Section 3.1, "Supported Network Features"

• Section 3.2, "OPMN Issues"

• Section 3.3, "DCM Issues"

• Section 3.4, "Other Management Issues"

• Section 3.5, "Documentation Errata"

3.1 Supported Network Features

Table 3-1 shows the networking features that are supported for Linux Systems:

Table 3-1 Supported Networking Procedures 

Feature	Supported?
Installing Oracle Application Server on a host using DHCP.	Yes
Installing Oracle Application Server on a host off of the network.	Yes
Changing the hostname of a host containing an Oracle Application Server middle-tier instance.	Yes Refer to the Oracle Application Server 10g Administrator's Guide.
Changing the IP address of a host containing an Oracle Application Server middle-tier instance.	Yes Refer to the Oracle Application Server 10g Administrator's Guide.
Changing the hostname of a host containing an Oracle Application Server Infrastructure.	No
Changing the IP address of a host containing an Oracle Application Server Infrastructure.	Yes Refer to the Oracle Application Server 10g Administrator's Guide.

3.2 OPMN Issues

This section describes OPMN issues. It includes the following topics:

• Section 3.2.1, "opmnctl Scoped Commands do not Work Against Oracle9iAS 9.0.2 and 9.0.3 instances."

• Section 3.2.2, "Error Message When Executing opmnctl Commands"

• Section 3.2.3, "Problem with Application Server Control Ports Page"

• Section 3.2.4, "OPMN Reports Incorrect Shared Memory Value"

3.2.1 opmnctl Scoped Commands do not Work Against Oracle9iAS 9.0.2 and 9.0.3 instances.

opmnctl scoped commands do not work against Oracle9iAS 9.0.2 and 9.0.3 instances. A scoped command that is for a single Oracle Application Server instance and sent to either an Oracle9iAS 9.0.2 or 9.0.3 instance will return an error.

3.2.2 Error Message When Executing opmnctl Commands

When you execute either an opmnctl stopall or opmnctl startall command, the oidctl log file contains the following error message:

*** Instance Number already in use. *** 
*** Please try a different Instance number. ***

This error message is benign and can be ignored.

This error message typically appears for OracleAS Infrastructure 10g installations with Oracle Internet Directory.

3.2.3 Problem with Application Server Control Ports Page

When you go to the Application Server Control ports page, the Oracle HTTP Server Diagnostic Port is displayed for Oracle HTTP Server Listener. After you restart OPMN, the diagnostic port will no longer be displayed.

3.2.4 OPMN Reports Incorrect Shared Memory Value

In some circumstances, Linux systems incorrectly record negative values in the /proc file system. As a result of this Linux issue, OPMN incorrectly reports the shared memory value as a positive value and incorrectly reports the value for shared memory and private memory combined to be greater than the total memory.

Typically, this issue only occurs with the Oracle HTTP Server process. To workaround this issue, restart the associated component. For example, if you find this issue with Oracle HTTP Server, restart Oracle HTTP Server.

3.3 DCM Issues

This section describes DCM issues. It includes the following topic:

• Section 3.3.1, "Tune the DCM Auto-archiving Feature to Improve System Performance"

3.3.1 Tune the DCM Auto-archiving Feature to Improve System Performance

When you install Oracle Application Server, the DCM auto-archiving feature is configured to maintain fifteen backup archives. You can improve system performance by reducing the number of archives, or turning off auto-archiving.

To reduce the number of archives, for example, to 5:

ORACLE_HOME/dcm/bin/dcmctl set -arch 5

To turn off auto-archiving:

ORACLE_HOME/dcm/bin/dcmctl set -arch 0

Refer to Distributed Configuration Management Reference Guide for more information about DCM auto-archiving.

Note: Limiting or disabling DCM auto-archiving may affect your ability to recover from system failures.

3.4 Other Management Issues

This section describes other management issues. It includes the following topics:

• Section 3.4.1, "Online Help for Oracle Wallet Manager is Not Available"

• Section 3.4.2, "Open Wallet Failed Message on STDOUT"

• Section 3.4.3, "Alter Database Open Resetlogs Fails With ORA-01194"

• Section 3.4.4, "Ignore Warnings in warn.log File When Running chgiphost.sh Script"

• Section 3.4.5, "chgiphost.sh Script Returns Benign Error Messages in Standalone J2EE and Web Cache Installation"

• Section 3.4.6, "Error Message Using OracleAS Backup and Recovery Tool"

3.4.1 Online Help for Oracle Wallet Manager is Not Available

The online help for Oracle Wallet Manager is not available. If you try to use the online help, an error code will be displayed.

Refer to Oracle Application Server 10g Security Guide for Oracle Wallet Manager information.

3.4.2 Open Wallet Failed Message on STDOUT

When registering OracleAS Metadata Repository with Oracle Internet Directory the DBCA output will feature a message "OPEN WALLET FAILED". This error message can be seen from in the DBCA output to Oracle Universal Installer screen or in the ORACLE_HOME/oraInventory/logs/installActions<time.stamp>.log file.

This message is benign and has no affect on the registration process.

3.4.3 Alter Database Open Resetlogs Fails With ORA-01194

The Backup and Recovery section in the Oracle Application Server 10g Administrator's Guide contains instructions for using the OracleAS Backup and Recovery Tool to perform point-in-time recovery when restoring the OracleAS Metadata Repository to a new host. The instructions advise you to use "alter database open resetlogs" if you get an error while performing the recovery.

In rare cases, the "alter database open resetlogs" command may fail with error ORA-01194. If this happens, check the restore log generated by the OracleAS Backup and Recovery Tool. You should find that one or more data files were not restored. If this is the case, rerun the OracleAS Backup and Recovery Tool using the same options as the first time you ran it. Then use the "alter database open resetlogs" and it should work without error.

3.4.4 Ignore Warnings in warn.log File When Running chgiphost.sh Script

When running the chgiphost.sh script following installation of any Oracle Application Server install type, warning messages are generated in the warn.log file. The warning messages are benign and can be ignored.

3.4.5 chgiphost.sh Script Returns Benign Error Messages in Standalone J2EE and Web Cache Installation

When you run the chgiphost.sh script on a J2EE and Web Cache installation that does not use OracleAS Infrastructure 10g services, the following types of error messages may be logged in the actions.log and error.log files:

• actions.log file:

  main::ias_instance_oid::372**    Error while executing
  main::update_modosso::372**    Error while executing
  
  

• error.log file:

  Exception: Unable to establish connection to the Oracle Internet Directory @ 
  Server ldap://:/. Base Exception : javax.naming.CommunicationException: 
  @ localhost:389 [Root exception is java.net.ConnectException: Connection 
  refused]
  
  oracle.ias.repository.schema.SchemaException: Unable to establish connection 
  to the Oracle Internet Directory Server ldap://:/. Base Exception : @ 
  javax.naming.CommunicationException: localhost:389 [Root exception is @ 
  java.net.ConnectException: Connection refused]
  main::ias_instance_oid::371**    Error while executing ....
  main::update_modosso::371**    Error while executing ....
  
  

These error messages are benign and can be ignored.

3.4.6 Error Message Using OracleAS Backup and Recovery Tool

If you perform a backup of the OracleAS Metadata Repository using the OracleAS Backup and Recovery Tool, RMAN returns error message RMAN-06089, which indicates that an archived log is out of sync with the catalog. This occurs if any of the archived logs are lost.

Before you retry the OracleAS Backup and Recovery Tool, execute the following command in RMAN:

change archivelog all validate;

Then rerun the OracleAS Backup and Recovery Tool to perform the OracleAS Metadata Repository backup.

3.5 Documentation Errata

This section describes known errors in management and security documentation. It contains the following topic:

• Section 3.5.1, "Changing OPMN Ports (ONS Local, Request, and Remote)"

• Section 3.5.2, "Querying the Runtime JServ Port"

• Section 3.5.3, "Restart Infrastructure Processes After Restoring a Metadata Repository"

3.5.1 Changing OPMN Ports (ONS Local, Request, and Remote)

The procedure for changing the ONS local, request, and remote ports in Oracle Application Server 10g Administrator's Guide is incorrect as follows:

• It states that you can use Application Server Control to change the ONS local, request, and remote port numbers. This is not correct--do not use Application Server Control to change these ports.

• The procedure for changing the ports manually is incorrect. Use the following procedure:
  1. Shut down all processes:

     emctl stop iasconsole
     emctl stop agent
     opmnctl stopall
     
     

  2. Under the <notification-server> element, modify the local, remote, and request parameters, as desired, in the <port> element. For example:

     <port local="6101" remote="6201" request="6004"/>
     
     

  3. Save and close the file.

  4. Reload OPMN:

     opmnctl reload
     
     

  5. Start OPMN:

     opmnctl start
     
     

  6. If this is an Infrastructure with Oracle Internet Directory, start Oracle Internet Directory:

     opmnctl startproc ias-component=OID
     
     

  7. Start the rest of your processes:

     opmnctl startall
     
     

  8. Update DCM:

     dcmctl updateConfig -ct opmn
     

3.5.2 Querying the Runtime JServ Port

The procedure for querying the runtime JServ port in Oracle Application Server 10g Administrator's Guide is incorrect.

You can query the runtime JServ port numbers as follows:

• If you use mod_oprocmgr to manage JServ, make sure the oprocmgr-status handler is activated in ORACLE_HOME/Apache/Apache/conf/httpd.conf with the following directive:

  <ifModule mod_oprocmgr.c>
    <Location /oprocmgr-service>
      SetHandler oprocmgr-service
    </Location>
  </ifModule>
  
  

  Enter the following URL in your browser, and you will see the status of all processes currently managed by your process manager, including JServ:

  http://hostname:http_port/oprocmgr-status
  
  

• If you are not using mod_oprocmgr, but instead use a traditional JServ configuration, you can query the runtime ports with the following URL:

  http://hostname:http_port/jserv
  
  

  Note that the "jserv" portion of the preceding URL is protected to only be viewed from localhost. This is configured in ORACLE_HOME/Apache/Jserv/etc/jserv.conf. You can expand permissions to view from other hosts, or provide the following URL from the same host:

  http://localhost:port/jserv
  

3.5.3 Restart Infrastructure Processes After Restoring a Metadata Repository

The procedures in Oracle Application Server 10g Administrator's Guide for restoring a Metadata Repository are incomplete. You should restart all Infrastructure processes after restoring a Metadata Repository.