E Troubleshooting Oracle Database Vault

Using Trace Files to Diagnose Events in the Database

You can monitor your Oracle Database Vault database instance for server and background process events by checking the database instance trace files. Trace files reveal events such as the logic that the Oracle Database Vault security enforcement engine executes, and internal errors, block corruption errors, deadlock errors, administrative actions that may have occurred, values of parameters that had nondefault settings when the database instance started, and other information.

Be careful about enabling trace files, however. Doing so can increase the overhead of the database instance operation, which could decrease performance. Contact Oracle Support before you decide to enable tracing.

To enable tracing, log on to SQL*Plus with an account that has the ALTER SESSION privilege and issue the following statement:

ALTER SESSION SET EVENTS '47998 trace name context forever, level 12'

For example, suppose you have an account that is trying to use a statement that is protected by a command rule, but the statement is not working as expected. You can diagnose the enforcement logic for this account by granting it the ALTER SESSION privilege, issuing the ALTER SESSION statement, and then retrying the statement. Afterward, check the trace files to determine what is going on.

You can disable tracing by issuing the following statement:

ALTER SESSION SET EVENTS '47998 trace name context off'

For more information about how to manage trace files, see Oracle Database Administrator's Guide.

General Diagnostic Tips

Follow these general tips for diagnosing problems in realms, factors, and rule sets:

• For realm protections, verify that a user has the underlying system or object privileges (granted directly or through a role) that might affect the command.

• If a realm authorization is not working, verify that the account roles are set correctly.

• For PL/SQL expressions used in factors and rule sets, grant EXECUTE privileges on the PL/SQL package functions used in these expressions directly to the account and determine if the results appear to be correct.

• To find detailed information about the cause of an error message, check the trace files. See Oracle Database Performance Tuning Guide for more information about trace files. The USER_DUMP_DEST initialization parameter specifies the current location of the trace files. You can find the value of this parameter by issuing SHOW PARAMETER USER_DUMP_DEST in SQL*Plus

• Use the auditing reports to diagnose problems in general. See "Oracle Database Vault Auditing Reports" for more information.

Configuration Problems with Oracle Database Vault Components

If you suspect problems with the configuration of realms, command rules, factors, rule sets, or secure application roles, you can run the appropriate configuration report. See the following sections for more information:

• "Command Rule Configuration Issues Report"

• "Factor Configuration Issues Report"

• "Factor Without Identities Report"

• "Identity Configuration Issues Report"

• "Realm Authorization Configuration Issues Report"

• "Rule Set Configuration Issues Report"

• "Secure Application Configuration Issues Report"

To run these reports, see "How to Run Oracle Database Vault Reports".