OID: User's Provisioning status stuck in Pending state.

Recently we hit an error when trying to provision a user for Real Time Collaboration within Oracle Collaboration Suite. When the user logged in they were met with the following error:

<username> is not provisioned to this application.

Via the Oracle Internet Directory (OID) Provisioning Console I could see that this user was stucking in pending status. Working with Oracle Support we determined that this user was deleted and recreated for some reason and there was orphan data.

By querying the RTC.RTC_USERS table within the OID database the PROVISION_STATUS column for this user had a value of DELETED. The solution to this problem was to:

• delete the user via the OID Provisining Console
  
• remove the ophan data
  
• recreate the user
  
• Re-provision the user for the applications they required.
  

Some queries:

select * from rtc.rtc_users where upper(user_name) = 'JOHNDOE';

Oracle support mentioned there may be more than one row of orphan data. So this query is just to determine how many bad rows there are.

Backup the table just in case you make a mistake or something goes horribly wrong.

create table rtc.rtc_users.BAK20090420 as select * from rtc.rtc_users;

Delete the bad data:

delete * from rtc.rtc_users where upper(user_name) = 'JOHNDOE';

Verify row count is the same as your first query above and commit. You can now recreate the user and provisioning should go through.

RPM Tip - Determining the architecture of an installed package.

As many of you are aware, one of the first steps prior to installing Oracle is to determine which operating system packages are required. On 64bit systems you are required to have both the 32bit and 64bit versions installed for some.

For example, one such required package is libstdc++-devel. If you execute rpm with the -qa options (q for query mode, a for all installed packages) you will see the following if it is installed:

[oravis@myserver~]$ rpm -qa | grep libstdc++-devel
libstdc++-devel-3.4.6-10

If your on a 64bit OS how do you know if this is the 32bit or 64bit version? You need specify a query format in the rpm command. In the following example I extract the name, version, release and architecture information for the libstdc++-devel package.

[oravis@myserver ~]$ rpm -qa --qf "%{NAME}-%{VERSION}-%{RELEASE}_%{ARCH}.rpm  \
 %{INSTALLTIME:date}\n" | grep libstdc++
libstdc++-devel-3.4.6-10_x86_64.rpm  Mon 06 Oct 2008 07:46:50 PM EDT
libstdc++-devel-3.4.6-10_i386.rpm  Mon 06 Oct 2008 07:46:50 PM EDT

So based on this output I have both of the required packages and I can quickly identify which package I need to install if one is missing. Note: I always pipe rpm to grep because if you don't specify the package name properly you won't get any results. ie:

[oravis@myserver ~]$ rpm -qa --qf "%{NAME}-%{VERSION}-%{RELEASE}_%{ARCH}.rpm \
  %{INSTALLTIME:date}\n" libstdc
[oravis@myserver ~]$

Linux Tip: Configuring Sendmail to use Gmail as an SMTP Server

[Update 03102010]

My linux server recently suffered a hardware failure and had to be rebuilt.   I had to setup this up again and rain into issues.   I found another article which is much more straightforward.

http://www.linuxarticles.org/2010/09/relay-email-using-gmail-account-shell-prompt/

[/Update]

Wireless networking is pretty much common place these days. I've been using it at home for a number of years now and have been using security from day 1. Today I noticed that my Linksys router forgot my Wireless Security settings, leaving me exposed. I have no idea how long i've been open so needless to say i'm not pleased.

I have a script which polls my router and if my ip address has changed, it updates my dynamic dns account. So I thought it should be pretty easy to write a script to check my wireless security settings.

The script was pretty simple:

#!/bin/sh

cd /scripts

wget https://192.168.1.1/WL_WPATable.asp --http-user=admin \
  --http-passwd=admin --no-check-certificate
success=`grep "\"wpa_personal\" selected" WL_WPATable.asp | wc -l`

if [ $success -ne 1 ]; then
mailx -s "WIRELESS SECURITY DISABLED" MyEmailAddr@mydomain.com <<EOF
Please check wireless security settings.  There seems to be a problem.
EOF

echo "WIRELESS SECURITY DISABLED!!"
fi
rm WL_WPATable.asp

Note: Notice the rm command at the end of the script. You need to do this if your using wget because if it detects the page your trying to download already exists it appends a version number to the end. ie. WL_WPATable.asp.1 If this happens, your script won't be checking the right file.

Pretty simple script, the only problem is, I didn't receive an email. My linux server is on my home network, which doesn't have an smtp server and I believe they are blocked by my ISP anyways.

I found a webpage which describes how to configure sendmail to use gmails smtp server.

A correction and addition. He mentions to "Create or edit the /etc/authinfo file and with this codes". However if you cut and paste his instructions the path placed in sendmail.mc for this file is

FEATURE(`authinfo’, `Hash -o /etc/mail/authinfo’)dnl

So make sure you create authinfo in the same location. Towards the end he mentions to execute the make command. If you don't have the sendmail source this will not work for you. So instead of:

make all install restart

use:

[root@stockade mail]# m4 sendmail.mc > sendmail.cf
[root@stockade mail]# /etc/init.d/sendmail restart

Note: Any email now sent from your server will be from your gmail account. I've sent the emails to my phone and gmail account, so if my wireless security gets disabled again i'll know right away.

Anyways, thought it may be useful.

rhn_register/up2date - OpenSSL.SSL.Error

Now that I work for a small company there are no fine lines between roles. DBA's are responsible for some system administration for example. I've been using Linux since Slackware version .8 (or some such) but i've never configured and supported it in a work environment before. I installed Red Hat on a server a few days ago and preparing to install Oracle I had to update some packages.

The first time you execute up2date you need to register with the Red Hat network. However, it would accept my username and password. It would keep sending me back to the login screen or provide me with the option to register later. (Which means you can't download updates until you register.)

I noticed on the command line from which I launched up2date:

[root@server ~]# rhn_register
An error has occurred:
OpenSSL.SSL.Error
See /var/log/up2date for more information

The log file was of no use... Searching google and the Red Hat knowledge base didn't help either. So I tried to run up2date without the GUI using the --nox option and I saw this:

 [root@server ~]# up2date --nox
There was an SSL error: [('SSL routines',
 'SSL3_GET_SERVER_CERTIFICATE', 'certificate verify failed')] A common cause of 
this error is the system time being incorrect. Verify that the time on this 
system is correct.

Bingo! I checked the system date/time and the year was 2008... Once I fixed that up2date ran fine. I have no idea why it would care if the system date was in the past.

Monitoring your RMAN backup scripts

There is an easy way to monitor your RMAN backup scripts in a unix environment. I've seen quite a few DBA's log the rman output to a file and then grep it for errors. Ex.

rman target / CMDFILE /home/oracle/scripts/rman.sql LOG $logfile
errors=`cat $logfile|grep -i error|wc -l`
if test $errors -gt 0
then
   mailx -s "BACKUP FAILED" email1@myserver.com, email2@myserver.com <<\! 
`cat $logfile`
!
fi

Another method would be to examine the return code from the rman client. Rman returns a value of 0 to the shell if the backup was successful. Otherwise it returns a nonzero value and from what I have seen this is always 1. (Have you seen any other values?)

So another way of writing the above script would be

rman target /  CMDFILE /home/oracle/scripts/rman.sql LOG $logfile
status=$?

if [ $status -gt 0 ] ; then
 mailx -s "BACKUP FAILED: TESTDB" email1@myserver.com <<\!
 `cat $logfile`
\! 
else
 mailx -s "SuccessfulBackup: TESTDB" email1@myserver.com <<\!
`cat $logfile`
\!
fi 

NOTE: Ignore the backlashes before the exclamation points above. I'm not sure how to format it properly within blogger. I'll see if I can fix it later.

As you can see above, after rman executes I set a status variable. $? is automatically set to the return code from the rman client. After that I check the value and there was an error I send an email saying the backup failed and put the contents of the log file into the body of the message. If the backup was successful, I still send a copy of the logfile.

The reason I do this is because each day I will expect to see either a successful or failed email. I've had issues in the past with cron not executing scheduled jobs (for numerous reasons). So if I don't receive an email I'll verify the backup manually.