MODPLSQL-000058: mod_plsql: HTTP-503 ORA-65162 ORA-65162: The password of the common user has expired

Oracle XE 18c with Apex 19 on top has got a default password expiration setup and user profile setup which one day simply ends up as a closed down service. Only place to find a decent log is webservers access log (if you are lucky enough to have it).
"Common user" is really unhelpfull, basically your APEX_PUBLIC_USER account password has expired. Hopefully you recall original password, otherwise you will have to change password hashes in dads.conf.

SELECT username, account_status FROM dba_users WHERE ACCOUNT_STATUS LIKE '%EXPIRED%';
ALTER USER APEX_PUBLIC_USER IDENTIFIED BY yourpassword   (dont use SEMICOLON; - use new line)
/
alter user APEX_PUBLIC_USER account unlock;

In case you still stuck, somehow Apex 19 likes anonymous account being unlocked:

alter user ANONYMOUS identified by anonymous;
alter user ANONYMOUS account unlock;

Oracle Apex 19.2 on Oracle database 18c XE issues when running on HTTP server 11.1.1

System setup

Oracle Apex 19.2
Oracle Database XE 18c (18.4)
Oracle OFM HTTP server 11 (11.1.1.9)

List of articles that I have been following

Oracle Apex 19.2 installation instructions
Popular CDB/PDB issue article online

Issues encountered after setting up Oracle Apex with HTTP server using articles above

Error provisioning XXXXXXXXXXXX. ORA-20001: Request 1824748984765804 could not be processed. PROVISION_COMPANY - this basically means you are in the wrong DB. You are connected to CDB$ROOT instead of XEPDB1 (and not PDB1!)

ORA-65096: invalid common user or role name in oracle.

ORA-28040: No matching authentication protocol.

Lessons learned

You do not need install Apex as root
Oracle original documentation is missing examples or better explanation
XE has its own PDB naming prefix

Example dads.conf configuration file that worked

#Alias /i/ "ORACLE_HTTPSERVER_HOME/user_projects/domains/base_domain/images/"
Alias /i/ "/home/oracle/apex/images/"
<Location /apex>
 Order deny,allow
 AllowOverride None
 PlsqlDatabaseConnectString     i7mr:1521:XEPDB1 ServiceNameFormat
# PlsqlDatabaseConnectString     XEPDB1 TNSFormat
 PlsqlNLSLanguage               AMERICAN_AMERICA.AL32UTF8
 PlsqlAuthenticationMode        Basic
 SetHandler                     pls_handler
 PlsqlDocumentTablename         wwv_flow_file_objects$
 PlsqlDatabaseUsername          APEX_PUBLIC_USER
 PlsqlDefaultPage               apex
 PlsqlDatabasePassword          **********
 PlsqlRequestValidationFunction wwv_flow_epg_include_modules.authorize
 PlsqlPathAlias r
 PlsqlPathAliasProcedure wwv_flow.resolve_friendly_url
 Allow from all
</Location>

TL;DR

When you install Oracle XE 19.2 using installation manual there are 3 key steps missing:
1) you have to unlock APEX_PUBLIC_USER and ANONYMOUS user in PDB (XEPDB1) database
2) you have to setup HTTP server configuration file dads.conf to be connecting to the same PDB (XEPDB1)
3) Oracle XE has different PDB naming, they start with XE - XEPDB1 instead of normal PDB1 used in Oracle Std.

Its ok to install XE into CDB$ROOT. It goes there by default following installation instructions. After installation when you select:

select r.COMP_NAME, r.VERSION, c.NAME, c.CON_ID from CDB_REGISTRY r, V$CONTAINERS c where r.CON_ID=c.CON_ID and r.COMP_ID='APEX' order by CON_ID;

You get:

Oracle Application Express 19.2.0.00.18 CDB$ROOT          1
Oracle Application Express 19.2.0.00.18 XEPDB1          3

When installing XE make sure you add these few steps (some of them are not necessary, just leaving them here for more context):

alter session set container=XEPDB1;
exec dbms_xdb.sethttpport(0);
alter system register;
@apxchpwd
alter user APEX_PUBLIC_USER account unlock;
alter user ANONYMOUS account unlock;

The key problem here is that Apex installs to CDB$ROOT and XEPDB1, just you have to unlock users in XEPDB1 and setup your dads.conf configuration to connect to XEPDB1.

After that configure dads.conf, just pay attention to the bolded part - when connecting to instance, its not XE, it has to be XEPDB1.

In case you still get error ORA-28040: No matching authentication protocol, make sure you add these to /opt/oracle/product/18c/dbhomeXE/network/admin/sqlnet.ora

SQLNET.ALLOWED_LOGON_VERSION_CLIENT = 8
SQLNET.ALLOWED_LOGON_VERSION_SERVER = 8

And restart HTTP server:

opmnctl stopall
opmnctl startall

The key problem indicators after installing Apex and connecting it to HTTP server is path that can be seen when creating empty Apex workspace. Here is how it looks like before PROVISION_COMPANY error:













And here is where it should go:

ORA-01152: file 1 was not restored from a sufficiently old backup

This post covers a very specific situation and may not be the general solution for this Oracle error. Details for current situation:
- New Oracle 10.2.0.4 installation
- Restored database copy of the same version (using RMAN)
- Recovery noarchivelog
- Restart

When booting up the restored database it complaints about DBID for the first time, then it stops when restoration is repeated.

After next restart we have this particular error:

ALTER DATABASE OPEN RESETLOGS            
*
ERROR at line 1:
ORA-01152: file 1 was not restored from a sufficiently old backup
ORA-01110: data file 1:
'/data/oracle/product/10.2.0/db_1/oradata/aws/system01.dbf'

Fix in this situation is rather stupid - stop dartabase, delete redo log files (all of them, redo*), recover and startup your database (resetlogs).

Error in writing to directory /tmp Please ensure that this directory is writable and has atleast 60 MB of disk space. Installation cannot continue.

I recently got an increasing flood of the same error in all the server environments:

Error in writing to directory /tmp/OraInstallYYYY-MM-DD_HH-MM-SSAM Please ensure that this directory is writable and has atleast 60 MB of disk space. Installation cannot continue.

Tmp has always got 0777, always plenty of space, Oracle Installer creates a folder in Tmp, but fails writing. Some sources online suggest Temp2 type solution of creating another temporary folder, pass TMP and TEMP variables to the shell, but not all shells and environments accept those.

I have no cure, but based on recent testing it all boils down to this checklist:
- place installer in Oracle home directory (or complete equivalent)
- unpack zips, cpios with Oracle user you are going to use for installation
- run installer from an installation directory with Oracle user (not using full path)
- check if unzip is installed

At least last couple of times first step solved the problem. It looks like Oracle user fails writing somewhere, but it reports it with dummy error.

ApexLib on APEX 4.2, G_VALIDATION_IDS_IN_ERROR, APEXLIB_ERROR

People say ApexLib will not work on Apex > 4.1 (http://www.oracle-and-apex.com/apexlib-framework-on-oracle-apex-4-2/). After Apex upgrade to 4.2 ApexLib failed to compile - thats true. After primary installation (which was 3.2) all the Synonyms for user Apexlib are pointing to APEX_030200 user schema. First attempt was to recreate all the synonyms and I did that.

The only problem I bumped into was G_VALIDATION_IDS_IN_ERROR. Downloaded a new version of ApexLib, repeated the installation referencing to docs (http://apexlib.oracleapex.info/#apexlib_schema) - result is the same: G_VALIDATION_IDS_IN_ERROR.

The type G_VALIDATION_IDS_IN_ERROR is referenced in changelog for APEX_040200 WWV_FLOWS package, but is not found anywhere in the code, as well as a few other packages. So it looks like they were simply discarded sometime in 4.2.

There are 2 package errors you will see when ApexLib is failing, usually its just package that cant be compiled, one of them will be "ORA-04063: package body APEXLIB.
APEXLIB_ERROR has errors". Once you manage to fix all the synonyms and views - in the end you will still bump into G_VALIDATION_IDS_IN_ERROR.

Fix is rather simple, declare the missing types using possible expected Apex internal types in your package that is failing (in our case its APEXLIB.APEXLIB_ERROR). Simply define (there are 2 types missing) the types in APEXLIB_ERROR body, someplace were variables reside:

g_validation_ids_in_error wwv_flow_global.n_arr;
g_validation_message wwv_flow_global.vc_arr2;

Then go and replace all the references to these types (they will be like "wwv_flows.g_validation_ids_in_error and wwv_flows.g_validation_message) - simply remove the schema reference wwv_flows. A few snippets how does it look like:

Oracle installer 12 on Xming copy paste keyboard problem

Was running a few Oracle Installers via SSH X tunnel forward and Xming client on local Windows 10 box. I noticed that in some installers keyboard does not work.

Its ok sometimes, but Oracle HTTP Server 12.1.0.3 installer needs username and password input. Took a few days (maybe its just me), but looks like Windows Paste is mapped to a middle mouse button. I've found some hints confirming this in forum here. Although selecting and cutting did not work.

Editing still does not work, so some settings have to be changed manually after installation, but username and password can be prepared in Notepad or wherever and middle-clicked into fields. Be sure to pick exact values since its not possible to change them, they will be merged with previous Paste and you will have to run installer from the start.

Unix (Solaris) display forwarding after user switch (su)

Using X forward via SSH, Xming client running locally on Windows box. After login to SSH with your preferred tool (Putty or SSH Secure Shell) X applications do work, but they stop working after you switch to another user.
My objective was to run Oracle Installer without having root access or Oracle user via SSH only. User is not part of DBA group and new Oracle user (ora12213) does not have X access.

bash-4.1$ xclock
Error: Can't open display: localhost:10.0

Found plenty of resources online, but all of them missing something, here is a full list of steps to make it work.

1) setup your SSH tool for X forwarding (settings, checkbox)
2) save settings and restart the tool and connection (it appears that setting is only activated after a new connection or window is opened)
3) test xclock

bash-4.1$ xclock

4) echo these variables:

-bash-4.1$ xauth list
solserv102/unix:10  MIT-MAGIC-COOKIE-1  2359b71c685cf706bf4dec49e4136558
-bash-4.1$ echo $DISPLAY
localhost:10.0

5) do the user switch with parameters, minus is essential. Username is "ora12213":

-bash-4.1$ sudo su - ora12213
Oracle Corporation      SunOS 5.11      11.2    March 2015

6) export the variables listed above, looks like error can be ignored. In most of the tested examples "xauth add" part was not working, but after user switching with su, it looks like it okayed:

-bash-4.1$ xauth add solserv102/unix:10  MIT-MAGIC-COOKIE-1  2359b71c685cf706bf4dec49e4136558
xauth:  file /export/home/ora12213/.Xauthority does not exist

-bash-4.1$ export DISPLAY=localhost:10.0

7) test the X, should be working just fine.

-bash-4.1$ xclock

BONUS

Run the Solaris installer executable (it was downloaded, unzipped, moved to /stage_oracle folder, owned by DBA group):

-bash-4.1$ cd /stage_oracle/
-bash-4.1$ ./fmw_12.2.1.3.0_ohs_solaris_sparc64.bin
Launcher log file is /var/tmp/OraInstall2017-10-26_09-46-21AM/launcher2017-10-26_09-46-21AM.log.
Checking if CPU speed is above 300 MHz.   Actual 3600 MHz    Passed
Checking monitor: must be configured to display at least 256 colors.   Actual 16777216    Passed
Checking swap space: must be greater than 512 MB.   Actual 85678 MB    Passed
Checking if this platform requires a 64-bit JVM.   Actual 64    Passed
Checking temp space: must be greater than 300 MB.   Actual 1672 MB    Passed
Preparing to launch the Oracle Universal Installer from /var/tmp/OraInstall2017-10-26_09-46-21AM
Log: /var/tmp/OraInstall2017-10-26_09-46-21AM/install2017-10-26_09-46-21AM.log

Voila

Stephen Hawking dissertation for download

Cambridge university made recently made Stepen Hawkings 1966 PhD thesis available online. Hawking was 24 when he wrote it. Due to high demand university library had issues with server load. This exceptional work is open for viewing, 51 years have passed and some theories where proven wrong, some where ahead of their time and some physicists didnt agree back then.

You can download original copy from Cambridge library repository.
An alternative copy is stored here for download.

In a statement, Hawking said that he hoped the thesis would "inspire people around the world to look up at the stars and not down at their feet," and added that everyone should have free access to all research.

Simple Centos unzip problem

[root@storage Bilder_JB]# unzip 19.zip 
unzip:  cannot find or open 19.zip, 19.zip.zip or 19.zip.ZIP.
[root@storage Bilder_JB]# ll -h
total 12G
-rwxr-xr-x.  1 root root  12G Oct 31 17:30 19.zip

Was trying to unzip large file, started with 2G, 4G, then 12G - looks like unzip has some kind of a limit. Solution is rather simple: JAVA

[root@storage Bilder_JB]# jar xvf 19.zip 

Viewing csv files in Linux (custom separated)

column -t -s $'|' sSak.csv | less --chop-long-lines

Nagios custom script checklist

Host

#cd /usr/lib64/nagios/plugins
- create script with EXIT 0/1/2  ie "check_raid_disks"
#nano /etc/nagios/nrpe.cfg
- define command[check_raid_disks]=/usr/bin/sudo /usr/lib64/nagios/plugins/check_raid_disks
#/etc/init.d/nrpe restart

* please notice that command definition includes sudo, normally nrpe scripts do not require this, but here we will be running custom executable inside our script. If sudo is not used nrpe responds with "NRPE: Unable to read output". Sudo-ers workaroud follows:

#nano /etc/sudoers (add nrpe user rule, comment out TTY requirement)
   nrpe ALL=(ALL) NOPASSWD:/usr/lib64/nagios/plugins/check_raid_disks
   # Defaults    requiretty
#setenforce 0 (disable selinux)

Nagios server

#/usr/lib64/nagios/plugins/check_nrpe -H 172.30.2.191 -c check_raid_disks
#nano /etc/nagios/servers/awsdb.cfg  (server name file)
- define service{
        use                             generic-service
        host_name                       awsdb
        service_description             Raid Disks
        check_command                   check_nrpe!check_raid_disks
         }
#/etc/init.d/nagios restart

Example script

#!/bin/sh

# Exit codes

STATE_OK=0

STATE_WARNING=1

STATE_CRITICAL=2

STATE_UNKNOWN=3

# server awsDB - virtual drives (vd's) count: 3

# server awsDB - physical drives count: 8

hds=$(/root/bin/MegaCli64 -PDList -aALL | grep state | grep Online -c)

# echo $dds

# Check for missing parameters

if [[ -z "$hds" ]]; then

  echo "Script error, check setup, environment or parameters"

  exit 2

fi

if [[ "$hds" = "8" ]]; then

  echo "OK - virtual disk count: $hds"

  exit 0

fi

if [[ "$hds" -lt "8" ]]; then

  echo "CRITICAL - not all disks are Online: $hds/8"

  exit 2

fi

echo "WARNING - Script error"

exit 1

Nagios debug command notes

#/usr/lib64/nagios/plugins/check_nrpe -H 172.30.2.246 -c check_cpu

#nagios -v /etc/nagios/nagios.cfg

Apex 3.2 idle session cleanup and WWV_FLOW_DATA cleanup

Abstract

When users login they get a temporary 'nobody' session with a few populated variables (or many if you have public translations or custom values), after login user gets an assigned session id and starts populating WWV_FLOW_DATA with item values.

Problem

If not maintained WWV_FLOW_DATA explodes and performance degrades.
I suspect that session idle setting is not working in Apex 3.2, tested many settings and checked Apex tables - nothing changes no matter what the settings are. Sessions pile up during the day, default cache purge procedures only allow cleaning up old sessions by date, not by idle period. Thus I can only run it at night or not at all (if environment gets international).

Findings

With this query we can find sessions which had no activity for more then 4 hours:

SELECT last, userid, session_id
FROM
(SELECT to_char(max(time_stamp),'DDMMYYYY HH24:MI') last, userid, session_id, max(time_stamp) mx
FROM apex_030200.wwv_flow_activity_log1$ l
--where userid = 'ADAM'
WHERE exists (select 1 from apex_030200.wwv_flow_sessions$ s where id = l.session_id)
GROUP BY userid, session_id
)
WHERE mx < sysdate-4/24;

Was digging Apex 3.2 packages for a couple of hours looking for a procedure to logout or cleanup. Looks like they where only introduced in 4.1. All the existing procedures are relying on Cookie values or session variables which I was not able to set manually.
Eureka moment. Even though Apex packages are wrapped - there was a comment or piece of code visible, that cleanup procedures simply delete from the views. So likely there are some instead triggers running which do the job.

Code

1) grant delete on apex_030200.wwv_flow_sessions$ to ;
2) Create procedure in your schema:

create or replace procedure "S_CLEAR_SESSIONS"
is
  n NUMBER := 0;
BEGIN
  FOR c IN (SELECT last, userid, session_id
            FROM
              (SELECT to_char(max(time_stamp),'DDMMYYYY HH24:MI') last, userid, session_id, max(time_stamp) mx
               FROM apex_030200.wwv_flow_activity_log1$ l
               --where userid = 'ADAM'
               WHERE exists (select 1 from apex_030200.wwv_flow_sessions$ s where id = l.session_id)
               GROUP BY userid, session_id
              )
            WHERE mx < sysdate-4/24
            
            UNION
            
            SELECT last, userid, session_id
            FROM
              (SELECT to_char(max(time_stamp),'DDMMYYYY HH24:MI') last, userid, session_id, max(time_stamp) mx
               FROM apex_030200.wwv_flow_activity_log1$ l
               WHERE nvl(userid,'nobody') = 'nobody'
               AND exists (select 1 from apex_030200.wwv_flow_sessions$ s where id = l.session_id)
               GROUP BY userid, session_id
              )
            WHERE mx < sysdate-1/24
           )
  LOOP
    ---htp.p('dead session: '||c.userid || ' sess: '||c.session_id);
    DELETE FROM apex_030200.wwv_flow_sessions$
    WHERE id = c.session_id;
  END LOOP;
END;

3) Run the procedure:
begin
  S_CLEAR_SESSIONS();
end;

Testing

select count(*) from apex_030200.wwv_flow_data;

Returns 130364

begin S_CLEAR_SESSIONS(); end;
select count(*) from apex_030200.wwv_flow_data;

Returns 129318

And thats only while writing this article. My first drop was from 1300000 items to just 200000, then added a shorter 'nobody' session killer as you can see in the code.

Charts

Nightly cleanup used to look like this:

Implemented a session cleanup at 15:00:

And here is one more from couple of days later when I added 1 hour grace period for all 'nobody' sessions independent of their activity:

Oracle Apex internals: template, source, conditional SQL storage

Abstract

While working with Apex I was building, backing up, customizing applications. I also had a few custom themes, theme-rebuilds. Now I need to update interfaces for 22 applications. Update includes custom CSS, JS'es, styles and HTML customizations for regions, region sources, templates, items, buttons. My applications contain hundreds of regions and items, its time to start digging Apex internals. Some of them can be found documented in forums, some of them I was not able to locate.

Warning

Any mistype or abuse may damage Apex IDE, usability, upgradability and your own application sources. Consider yourself warned.

General remarks

Flow_id - Apex application ID, consider always including in your query or at least limiting to a range below 4000.
Flow_step_id - application page ID.
Make database and application backups. At least copy some stuff to comments column.
If you have at least a couple applications most of the columns are self explanatory and follow same naming notation across all Apex tables.

Main Apex tables and their purpose

Apex schemas are named HTMLDB or APEX with trailing version number (examples: HTMLDB_020000, APEX_030200, APEX_040100, APEX_050000, dont recall if WEBDB had its own naming pattern). Tables are mainly starting with WWV_(FLOW) prefix.

WWV_FLOW_STEP_ITEMS - page items (like P101_USERNAME), I mainly use this table for mass item template changes (ITEM_FIELD_TEMPLATE), label alignment change (LABEL_ALIGNMENT), some very specific template changes (I use simple items to display clickable icons). My personally favorite field is TAG_ATTRIBUTES - custom HTML, CSS, Javascript code input.

WWV_FLOW_REGION_REPORT_COLUMN - report-type region column description and customization. I mainly use report columns for links with icons (COLUMN_LINKTEXT), other uses may include massive label or value alignment changes.

WWV_FLOW_ROW_TEMPLATES - report templates (not regions), I use them for massive HTML/CSS changes, class updates. Almost every column in this table is obvious and usable.

WWV_FLOW_STEP_BUTTONS - page buttons (obviously). I mainly use this table when I change button template (remember that application template ID's are different - I change one item in Apex, then update the rest based on changes in table). Column BUTTON_IMAGE. Can also be used for massive button alignment, condition or image changes.

WWV_FLOW_PAGE_PLUGS - hardest one to find or come up with, but also one of the most important ones - Region definition and sources. I do have some conditional SQL which displays certain icons (URL from webserver storage), I use PLUG_SOURCE column for mass updates when changing design templates. Can be used for condition, template or title changes.

WWV_FLOW_WORKSHEET_COLUMNS - this one may also be tricky to locate - interactive report region column desciptions. I mainly use this table for icon/image changes, mass link or interactive report column alignment changes.

Drupal performance improvement (valid for version 7)

Abstract

Drupal version 7, objective is to improve both Desktop and mobile versions of your website, improve SEO ratings like page loading speed, text to HTML ratio, number of CSS files, Javascript footprint size, overall page footprint size, number of files to load.

Improvement process

Drupal is module based CMS, so you are going to need only a couple of modules added to your installation. Each module and its use follows. Hopefully this article will be updated quite a few times.

PHP filter + Browscap

There are a couple of Drupal modules that allow hiding content based on device size (mobile or desktop). Tried quite a few Mobility modules, but none of them seem to work, where old or required modules like Cache to be turned off. And its not what I wanted.

In mobile versions I sometimes disable large slideshow blocks or page images, if you are up for that, here is what you do: download browscap, deploy it and enable both modules (PHP filter is native Drupal module). Open you block, enable PHP condition and paste this snippet:

<?php 
$mobile_agent = browscap_get_browser() ;
if($mobile_agent['ismobiledevice'] == "false"){return true;} 
?> 

Minify

This module simply removes all the unnecessary characters from your HTML and Javascript files. Compresses and creates copies of all you Javascript includes. This makes your files download faster. Some of the files are not being compressed due to their already small footprint, pay no attention to them. I will not describe how to use this module, its self explanatory. Once deployed you will find it under cache/performance management. Link for download. Suggesting enabling it when production ready since output HTML and JS files are hardly human readable.

Advagg

Full module name is Advanced CSS/JS Aggregation. This module combines (even cached) css files into a single file, which gives quite a few performance points in some of SEO evaluation tools. Combining your CSS files also reduces text/html ratio. Setup has quite a few tabs, but just follow the setup and enable CSS compression.

Summary

Usage of all these modules above may improve your website SEO evaluation by up to 10%. If not, then they will at least improve your page loading speed and overall performance compared to your competitors. Any feedback to this article is highly appreciated.

Oracle Apex Textarea printing with line breaks

Objective

Use Text Fields or Text Area fields for text input to build a document template generator. Oracle Apex version 4.

Problem(s)

With version 4 Apex introduced quite a few variable session handling changes, if you had a long experience with V3 - you will be stuck quite a few times. When you enter text in Rich Text editor or Text Area field and later try to print it in HTML area - either all HTML tags are exposed or removed. In the end you get plain text with different level of garbage. In V3 you could solve this by copying text to a simple Display Only item and use it hidden, then all the HTML tags could be prevented. Here are the three Text Areas used. Text with simple line breaks () or paragraph breaks (+) - which are invisible in UI of Text Area. 

Solution


In HTML area add <pre> and </pre> tags for the Text Area fields. Same tag applies if you change your item to read-only on display. Print preview looks great.

ImageMagick and ghostscript delegate problem: sh gs command not found

PROBLEM

Recent ImageMagick update kicked a little in the nuts. I mainly convert PDF to PNG and then use them for OCR. Here is how it welcomed me after an update to 6.7.2:

sh: gs: command not found
convert: missing an image filename

It works ok from a command line, but fails from Java or any external environments. At first the error may look like a command line syntax change, but it isnt, dont start moving your flags places or in-front/after PDF file - this is not the problem here.

SOLUTION

1) # which gs
2) locate delegates.xml file in your system
3) open the file for editing (# nano /etc/ImageMagick/delegates.xml)
4) find all occurrences of "gs", which will be simply put in html quotes:  <...>command=""gs" -q <..> and replace it with the output of you "which gs" result, in my case it looked like this: <..>command=""/usr/local/bin/gs" -q <..>. Leave the surrounding syntax intact.

After that just save the file and run you external command again. There will be around 10 occurrences, replace them all to be on the safe side, I suspect that its only PS configurations that had to be changed.

SSL certificate hash transition from SHA1 to SHA2. ORA-28857

Abstract

The SHA-1 cryptographic hash algorithm has been known to be considerably weaker than it was designed to be since at least 2005. As part of their SHA-2 migration plan, Google, Microsoft and Mozilla have announced that they will stop trusting SHA-1 SSL certificates. Google will begin phasing out trust in SHA-1 certificates by the end of 2014, while Microsoft and Mozilla will begin phasing out trust for SHA-1 certificates in 2016.

Problem(s)

If you are using Google Chrome - some https websites or services using SHA1 will not be opened and you will likely get an error displayed in article image. Another situation that you may bump into is Oracle Wallet. Looks like Oracle up to 11.2.0.2 doesn’t support SHA-2 based certificates. If you have a 10.x wallet and website changed its certificate to SHA2 - you will not be able to import it - you will get an error "some trusted certificates could not be installed". See image attached.
Also when connecting to such a site using UTL_HTTP.REQUEST you will end up with an ORA error: "Request Failed: ORA-28857: Unknown SSL error".

Suggestions

Upgrade Java, Tomcat and Oracle.

Dates to remember

November 2014 - SHA-1 SSL Certificates expiring any time in 2017 will show a warning in Chrome 39.
December 2014 - SHA-1 SSL Certificates expiring after May 31, 2016 will show a warning in Chrome 40.
January 2015 - SHA-1 SSL Certificates expiring any time in 2016 will show a warning in Chrome 41.
January 1, 2016 - Microsoft ceases to trust Code Signing Certificates that use SHA-1.
January 1, 2017 - Mozilla Firefox and Microsoft ceases to trust SSL Certificates that use SHA-1.

Services currently supporting SHA2

Apache server 2.0.63+ with OpenSSL 0.9.8o+
Java based servers using Java 1.4.2+
OpenSSL based servers using OpenSSL 0.9.8o+
Oracle Wallet Manager 11.2.0.1+
Oracle Weblogic 10.3.1+

Larry Ellison on self

“When you write a program for Android, you use the Oracle Java tools for everything, and at the very end you push a button and say, ‘Convert this to Android format.'” - Larry Ellison, 2013, CBS interview.

Oracle 10g on Centos 6.7 - x86 issues: ntcontab.o, snmccolm.o, ORA-27125

Abstract

Its getting harder and harder to install good old 10g on newer Centos versions. Last attempt on 6.5 was semi-problematic, with some extra packages missing, 6.7 deployment was even more challenging.

System specifications

Centos version (/etc/issue): CentOS release 6.7 (Final)
Oracle version: Version 10.2.0.1.0 Production (10201_database_linux_x86_64.cpio)

Problems and solutions

#1: Error invoking target 'ntcontab.o' of makefile

This error occurred around 65% in installation progress, aborting is not an option - more errors will follow and in the end whole process fails. Did some testing and it appears that one process is building the file, next one is instantly deleting it:

# cp /misc/oracle/product/10.2.0/db_1/lib32/ntcontab.o /misc/oracle/product/10.2.0/db_1/lib/

But in the end it looks like it was one of the following (where not needed in 6.5):

# yum install libaio-devel.i686 -y
# yum install zlib-devel.i686 -y
# yum install glibc-devel -y
# yum install glibc-devel.i686 -y
# yum install libaio-devel -y
# yum install ksh -y
# yum install glibc-headers

#2: /misc/oracle/database/product/10.2.0/db_1/sysman/lib/snmccolm.o: could not read symbols: File in wrong format

It might be that it may be solved with some more x86 packages thrown into the pile, I was not able to find the exact culprit. Many of the sources online simply telling to ignore this and fix it with 10.2.0.4 patch. Thats what we'll do: Ignore.

#3: ORA-27125: unable to create shared memory segment

Reason is unknown, it was thrown by DBCA with continuous installation process.
The solution is very simple, first check the oracle user group information:

[oracle@storage] $ id oracle 
uid = 500 (oracle) gid = 502 (oinstall) groups = 502 (oinstall), 501 (dba) 
[oracle@storage] $ more /proc/sys/vm/hugetlb_shm_group 
0 

Execute the following command as root, the dba group is added to the system kernel:

[oracle@storage] $ echo 501 > /proc/sys/vm/hugetlb_shm_group

Continue with DBCA, step will fail, but then retry DBCA, the problem disappeared and database was created.

#4: bonus problem, not Centos 6.7 related: You do not have enough free disk space to create the database

My bad was that I had 12TB storage mounted, looks like I missed the 10g storage requirement: 400MB, but less then 2TB. Found no other solution then to unmount /dev/sdb1, shrink it with gparted to get ~500GB space, ext4 it and mount the new device /dev/sdb2 to another mount point /oracle.

Conclusion

Move to 11i or 12c, its about time.

Server monitoring recipe with SNMP: Observium + Nagios

Objective

Everyone having at least couple of servers, even a single server, would want to monitor it eventually. Some time ago I used MRTG for all that, but as the needs expanded I could do less and less with it and in the end it even became too complicated to use. MRTG is powerful, yet vulnerable to simple server restarts - you have to remap your pins.

Recipe

Will jump to it right away: the best option currently is Observium + Nagios. Will tell about the first one in a separate paragraph, it might suffer from an early death some day, but currently its a good tool for the job. I ended up using two tools because Nagios has a very good alerting system, but lacks interfaces and as you probably guessed already Observium has interfaces, but lacks alerting system.

Observium

The peckers behind this tool are pretty questionable. Some time ago they had a fundraising campaign to collect some doe and implement an alerting system. After funds were raised - they removed the promised functionality from the Community release and made it part of their paid version. Money is money, but hey, Internet knows everything. Further more I tried to communicate with them on Facebook - all my page messages and comments where removed and all PM's ignored.
Nevermind the folks, their tool is good for one thing - drawing nice charts:

Nagios

Where Observium fails - Nagios can help. Its an open source project, no need to tell more. It lacks interfaces and historical information (excluding payed plugins and extensions), but it has a powerful alerting system. Just setup a couple of users with emails and you are done:

Conclusions

Nagios allows you to receive an email in the middle of the forest when your backup drive hits a warning limit while Observium helps you analyze and plan you infrastructure, workloads and record historical events. I can now see that admin still hasnt added memory to our webserver and I asked for that a week ago.