How to configure Oracle RMAN backup for the first time

RMAN is a oracle utility to backup, restore & recovery of database.

The following Steps will be demonstrated the configuration of oracle RMAN backup (for first time configuration)

Lets assume the database is in NOARCHIVELOG mode, by default the database is in NOARCHIVELOG mode, we need to change it to ARCHIVELOG mode for RMAN backup configuration.
We can configure RMAN backup with catalog/repository database as well as control file. It is strongly recommended & very good practice to configure RMAN backup with catalog/repository database.
catalog/repository database: It’s central repository & it requires separate database for backup operation. All registered target databases information stored in catalog database.
Control file: It contains registered target database information at server level itself & RMAN utility directly connects to target database by command “RMAN target /”
Note: Create catalog/repository database with the help of DBCA.

Lets consider following Step by Step syntax to do so:

Step # 1: Connect to Target database(Target DB: The database on which Backup & Recovery to be performed) as sysdba.

[oracle@centos ~]$ sqlplus "/ as sysdba"
SQL*Plus: Release 11.2.0.1.0 Production on Fri Jan 3 11:28:24 2014
Copyright (c) 1982, 2009, Oracle. All rights reserved.
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
SQL>

Step # 2: Ensure the database has been configured with ARCHIVELOG mode or not?

SQL> select log_mode from v$database;
LOG_MODE
------------
NOARCHIVELOG
Database is in NOARCHIVELOG mode.

Step # 3: If the database has been configured with ARCHIVELOG mode then skip the Step number 3 to 6, If not then Shutdown the database.

SQL> shutdown immediate;
Database closed.
Database dismounted.
ORACLE instance shut down.

Step # 4: Startup the database in mount state.

SQL> startup mount;
ORACLE instance started.
Total System Global Area 308981760 bytes
Fixed Size 2212896 bytes
Variable Size 163580896 bytes
Database Buffers 138412032 bytes
Redo Buffers 4775936 bytes
Database mounted.

Step # 5: Configure database in ARCHIVELOG mode.

SQL> alter database archivelog;
Database altered.

Step # 6: Alter database to open state.

SQL> alter database open;
Database altered.

SQL> select open_mode from v$database;
OPEN_MODE
--------------------
READ WRITE

Step # 7: Ensure ARCHIVELOG destination.

SQL> archive log list
Database log mode Archive Mode
Automatic archival Enabled
Archive destination USE_DB_RECOVERY_FILE_DEST
Oldest online log sequence 2
Next log sequence to archive 4
Current log sequence 4

In case you wish to change default archive log destination then issue the following command.

SQL> alter system set log_archive_dest_1='location=/home/oracle/arch' scope=both;
System altered.

SQL> archive log list
Database log mode Archive Mode
Automatic archival Enabled
Archive destination /home/oracle/arch
Oldest online log sequence 2
Next log sequence to archive 4
Current log sequence 4

Step # 8: Ensure the flash/fast recovery area location.

SQL> show parameter db_recovery_file_dest

Step # 9: Connect to RMAN prompt with target database.

[oracle@centos ~]$ rman target /
Recovery Manager: Release 11.2.0.1.0 - Production on Fri Jan 3 11:46:22 2014
Copyright (c) 1982, 2009, Oracle and/or its affiliates. All rights reserved.
connected to target database: ORCL (DBID=1363580714)
RMAN>

Step # 10: Configure RMAN with controlfile auto-backup feature that will be auto-backup controlfile in case of major changes done in database.

RMAN> configure controlfile autobackup on;

Step # 11: To enable backup optimization run the following command, by default backup optimization has been configured OFF.

RMAN> configure backup optimization on;

Step # 12: Configure retention policy for backup.

RMAN> CONFIGURE RETENTION POLICY TO RECOVERY WINDOW OF 7 DAYS;

Step # 13: Connect to the recovery catalog database(RMAN Repository) & Create a tablespace to store RMAN catalog database objects.

[oracle@centos ~]$ sqlplus "/ as sysdba"
SQL> select global_name from global_name;
GLOBAL_NAME
--------------------------------------------------------------------------------
CATALOGD

SQL> create tablespace catalogtbs datafile '/home/oracle/dbfile/catalogtbs1.dbf' size 100M autoextend on maxsize unlimited;
Tablespace created.

Step # 14: Create a RMAN user, assign RMAN tablespace to RMAN user as a default & grant recovery catalog owner,connect & resource privileges to RMAN user.

SQL> create user recoveryman identified by recoveryman;
User created.

SQL> alter user recoveryman default tablespace catalogtbs temporary tablespace temp;
User altered.

SQL> grant recovery_catalog_owner to recoveryman;
Grant succeeded.

SQL> grant connect,resource to recoveryman;
Grant succeeded.

Step # 15: Connect to RMAN on target and recovery catalog database.

[oracle@oracle ~]$ rman target / catalog recoveryman/recoveryman@catalogdb
Recovery Manager: Release 11.2.0.1.0 - Production on Sat Jan 4 14:30:28 2014
Copyright (c) 1982, 2009, Oracle and/or its affiliates. All rights reserved.
connected to target database: ORCL (DBID=1363580714)
connected to recovery catalog database

Step # 16: create catalog by issuing the following command in RMAN prompt.

RMAN> create catalog;
recovery catalog created

Step # 17: After creating catalog, Ensure RMAN repository tables by logging into repository database as RMAN user. This is only for the first time.

[oracle@oracle ~]$ sqlplus "recoveryman/recoveryman@catalogdb"
SQL> show user;
USER is "RECOVERYMAN"

SQL> select table_name from user_tables;

Step # 18: Register database with recovery catalog.

RMAN> register database;
database registered in recovery catalog
starting full resync of recovery catalog
full resync complete

Step # 19: Check whether registration was successful.

RMAN> report schema;
Report of database schema for database with db_unique_name ORCL
List of Permanent Datafiles
===========================
File Size(MB) Tablespace           RB segs Datafile Name
---- -------- -------------------- ------- ------------------------
1    670      SYSTEM               YES     /home/oracle/app/oracle/oradata/orcl/system01.dbf
2    490      SYSAUX               NO      /home/oracle/app/oracle/oradata/orcl/sysaux01.dbf
3    30       UNDOTBS1             YES     /home/oracle/app/oracle/oradata/orcl/undotbs01.dbf
4    5        USERS                NO      /home/oracle/app/oracle/oradata/orcl/users01.dbf
List of Temporary Files
=======================
File Size(MB) Tablespace  Maxsize(MB) Tempfile Name
---- -------- ----------- ---------   -------------------------------
1    20       TEMP        32767       /home/oracle/app/oracle/oradata/orcl/temp01.dbf

OR

RMAN> LIST INCARNATION OF DATABASE;
List of Database Incarnations
DB Key  Inc Key DB Name  DB ID            STATUS Reset SCN    Reset Time
------- ------- -------- ---------------- ------------ ---    --------
89      102     ORCL     1363580714       PARENT       1      15-AUG-09
89      90      ORCL     1363580714       CURRENT      945184 02-JAN-14

Target database is registered with the RMAN.

Now you can backup your target(registered) database as per your convenience.

***********************************************************************

hotbackup script

#!/bin/bash

.  /u01/PROD/oraprod/db/tech_st/11.2.0/PROD_abr-ln-orc2.env
NOWDATE=`date +%d%b%y`
sqlplus '/ as sysdba' <
alter system switch logfile;

alter database begin backup;

exit;
eof

cd /u01/PROD/oraprod/db/

tar cvf - apps_st | gzip -c > /u01/PROD/oraprod/db/prod_data_top_hot_$NOWDATE.tgz

sqlplus '/ as sysdba' <
alter database end backup;

ALTER SYSTEM ARCHIVE LOG CURRENT;

ALTER DATABASE BACKUP CONTROLFILE TO TRACE as '/u01/PROD/oraprod/db/$NOWDATE.ctl';

exit;
eof
~

How to set DB Schema password to 'never expire'

As a Hyperion admin, I have time and again run into this issue with my hyperion schemas where the password sometimes expires and wreaks havoc on the application.

The key indicator for these error messages are the log files. They are quite descriptive .

Basic test to make sure that the schema is working correctly will be to login to the DB hosts and issue this command:

conn username/password;

To resolve this issue ,

connect to your DB as sysdba and run

ALTER PROFILE DEFAULT LIMIT PASSWORD_LIFE_TIME UNLIMITED;


Restart all Services and ensure all the log files under diagnostics\logs\services directory startup properly.

This should resolve the issue.

Hyperion Financial Management Error "Bad Gateway. Request could not be processed. Invalid response received by proxy or gateway server" When Browsing Content Within an Application

Hyperion Financial Management Error "Bad Gateway. Request could not be processed. Invalid response received by proxy or gateway server" When Browsing Content Within an Application

To Bottom

---

In this Document Symptoms Cause Solution References APPLIES TO: Hyperion Financial Management - Version 11.1.2.1.000 and later Information in this document applies to any platform. SYMPTOMS Users receive the following error messages a few minutes after they start accessing Hyperion Financial Management (HFM) application content (e.g. opening HFM applications, opening HFM web forms, etc.): Bad Gateway Request could not be processed. Invalid response received by proxy or gateway server Notes: Users access the Workspace user interface through OHS (Oracle HTTP Server), SSL has been enabled on both OHS (Workspace web server) and IIS (HFM web server). The following error message is being returned in the OHS error log at the time of the issue: [tid: 3044] [user: SYSTEM] [VirtualHost: epmdev.hyperion.com:0] ssl_engine_kernel.c:2363: Inter-Process Session Cache: request=REM status=OK id=65376265333730333164633838663538373 (session dead)^M [2011-11-23T22:28:23.2350-08:00] [OHS] [NOTIFICATION:32] [OHS-9999] [core.c] [host_id: vm0sgennai127] [host_addr: 192.168.0.127] [pid: 4440] [tid: 3044] [user: SYSTEM] [VirtualHost: epmdev.hyperion.com:0] (OS 10054) CAUSE The error code 10054 visible in the OHS log file indicates that the error occurred on the other side of the connection (i.e. on the IIS side in this case), causing the connection to drop. In particular, IIS is dropping the connection with OHS on asp pages during the SSL handshake, causing users to receive a '502 Bad Gateway' error message when attempting to access HFM content through Workspace. This issue only occurs if the session cache is enabled on the OHS side. The session cache allows existing SSL sessions to be resumed ('cheaper handshake'). While resuming existing SSL sessions between the OHS and the IIS components, IIS drops the connection during the handshake. This is when the issue occurs. SOLUTION IIS is unable to handle the resuming of cached SSL sessions properly. Thus, disabling such session caching prevents the issue from occurring. Please find below the steps to be followed for disabling the session caching on the OHS side: Note: These steps have to be followed on all servers hosting the Oracle HTTP Server (OHS) component. Navigate to the below folder: \Middleware\user_projects\epmsystem1\httpConfig\ohs\config\OHS\ohs_component Make a backup copy of the file SSL.conf Open SSL.conf in a text editor (ie. Windows Notepad) In the file find the following section: # Inter-Process Session Cache: # Configure the SSL Session Cache: First the mechanism # to use and second the expiring timeout (in seconds). SSLSessionCache "shmcb:${ORACLE_INSTANCE}/diagnostics/logs/${COMPONENT_TYPE}/${COMPONENT_NAME}/ssl_scache(512000)" SSLSessionCacheTimeout 300 Modify this file section, so that it looks like this: # Inter-Process Session Cache: # Configure the SSL Session Cache: First the mechanism # to use and second the expiring timeout (in seconds). # SSLSessionCache "shmcb:${ORACLE_INSTANCE}/diagnostics/logs/${COMPONENT_TYPE}/${COMPONENT_NAME}/ssl_scache(512000)" # SSLSessionCacheTimeout 300 SSLSessionCache none SSLSessionCacheTimeout 15 Save and close the file. Restart the OHS component for the changes to be taken into account - for instance by restarting the 'Oracle Process Manager (ohsInstanceXXXXXXXX)' service.

SSL-Enable Oracle Database

 SSL-Enable Oracle Database

Take these steps to SSL-enable Oracle database:

1. Create a root CA and a certificate for the DB. Here is an example:
   Note:

   Self-signed certificates are not recommended for production use. For information about obtain production wallets, see Section 8.4.8.3, "Changing a Self-Signed Wallet to a Third-Party Wallet.".

   mkdir root
   mkdir server
    
   # Create root wallet, add self-signed certificate and export
   orapki wallet create -wallet ./root -pwd password
   orapki wallet add -wallet ./root -dn CN=root_test,C=US -keysize 2048 -self_signed -validity 3650 -pwd password
   orapki wallet display -wallet ./root -pwd password
   orapki wallet export -wallet ./root -dn CN=root_test,C=US -cert ./root/b64certificate.txt -pwd password
    
   #Create server wallet, add self-signed certificate and export
   orapki wallet create -wallet ./server -pwd password
   orapki wallet add -wallet ./server -dn CN=server_test,C=US -keysize 2048 -pwd password
   orapki wallet display -wallet ./server -pwd password
   orapki wallet export -wallet ./server -dn CN=server_test,C=US -request ./server/creq.txt -pwd password
    
   # Import trusted certificates
   orapki cert create -wallet ./root -request ./server/creq.txt -cert ./server/cert.txt -validity 3650 -pwd password
   orapki cert display -cert ./server/cert.txt -complete
   orapki wallet add -wallet ./server -trusted_cert -cert ./root/b64certificate.txt -pwd password
   orapki wallet add -wallet ./server -user_cert -cert ./server/cert.txt -pwd password
   orapki wallet create -wallet ./server -auto_login -pwd password}}
   

2. Update listener.ora, sqlnet.ora, and tnsnames.ora for the database.
   1. This example shows the default listener.ora:

      SID_LIST_LISTENER =
      (SID_LIST =(SID_DESC =(SID_NAME = PLSExtProc)(ORACLE_HOME = /path_to_O_H)(PROGRAM = extproc)))
      LISTENER =(DESCRIPTION_LIST =(DESCRIPTION =
      (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1))
      (ADDRESS = (PROTOCOL = TCP)(HOST = mynode.mycorp.com)(PORT = 1521))
      (ADDRESS = (PROTOCOL = TCPS)(HOST = mynode.mycorp.com)(PORT = 2490))
      ))
       
      WALLET_LOCATION=(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=/wallet_location)))
       
      SSL_CLIENT_AUTHENTICATION=FALSE}}
      

      And here is an updated listener.ora file, illustrating a scenario with no client authentication:

      SID_LIST_LISTENER =
        (SID_LIST =
          (SID_DESC =
            (GLOBAL_DBNAME = dbname)
            (ORACLE_HOME = /path_to_O_H)
            (SID_NAME = sid)
          )
        )
       
      SSL_CLIENT_AUTHENTICATION = FALSE
       
      WALLET_LOCATION =
        (SOURCE =
          (METHOD = FILE)
          (METHOD_DATA =
            (DIRECTORY = /wallet_path)
          )
        )
       
      LISTENER =
        (DESCRIPTION_LIST =
          (DESCRIPTION =
            (ADDRESS = (PROTOCOL = IPC)(KEY = EXTPROC1521))
          )
          (DESCRIPTION =
            (ADDRESS = (PROTOCOL = TCP)(HOST = mynode.mycorp.com)(PORT = 1521))
          )
          (DESCRIPTION =
            (ADDRESS = (PROTOCOL = TCPS)(HOST = mycorp.com)(PORT = 2490))
          )
        )
      

      Note that the SSL port has been added.
   2. Likewise, a modified sqlnet.ora file may look like this:

      NAMES.DIRECTORY_PATH= (TNSNAMES, EZCONNECT)
      SQLNET.AUTHENTICATION_SERVICES=(BEQ,TCPS,NTS)
      WALLET_LOCATION=(SOURCE=(METHOD=FILE)(METHOD_DATA=(DIRECTORY=/directory)))
      SSL_CLIENT_AUTHENTICATION=FALSE
      

   3. A modified tnsnames.ora file may look like this:

      OID =
        (DESCRIPTION =
          (ADDRESS = (PROTOCOL = TCP)(HOST = mynode.mycorp.com)(PORT = 1521))
          (CONNECT_DATA =
            (SERVER = DEDICATED)
            (SERVICE_NAME = mynode.mycorp.com)
          )
        )
         
      SSL =
        (DESCRIPTION =
          (ADDRESS_LIST =
            (ADDRESS = (PROTOCOL = TCPS)(HOST = mynode.mycorp.com)(PORT = 2490))
          )
          (CONNECT_DATA =
            (SERVICE_NAME = mynode.mycorp.com)
          )
          (SECURITY=(SSL_SERVER_CERT_DN=\"CN=server_test,C=US\"))
        )
      

3. Test the connection to the database using the new connect string. For example:

   $ tnsping ssl
   $ sqlplus username/password@ssl

How to Create a Database Server Distinguished Name Certificate

*** This article is being delivered in Draft form and may contain errors. Please use the MetaLink "Feedback" button to advise Oracle of any issues related to this article. *** PURPOSE ------- This note provides a generic example of creating a Database Distinguished Name Certificate for use with a client server TCPS connection or Enterprise User Security. SCOPE & APPLICATION ------------------- Distinguished Name Certificates can be required for both server certificates in TCPS connections and for each database used in an enterprise security realm. This note assumes the reader is familiar with how to sign a certificate request with their select certificate authority and therefore provides no instruction on how to sign the server certificate. Oracle Wallet Manager creates certificate requests in BASE64 format and only imports User and Trusted certificates encoded in BASE64. Step by step instructions on creating a database server distinguished name certificate ------------------------------------------------------------------------------------- Step 1: Create a new wallet and certificate request from Oracle Wallet Manager. 1. Open Oracle Wallet Manager, OWM, and select Wallet->New 2. Enter a new wallet password which conforms to the conditions stated on the screen and select OK 3. Select YES to create a certificate request 4. On the next screen choose the desired Key Size and select Advanced - there is no need to complete any other fields 5. Replace any text in the DN field with your required distinguished name. Note: The general form of a database distinguished name is cn=DB_NAME, cn=OracleContext, dc=DOMIAN_COMPONENT_N, .. ,dc=DOMIAN COMPONENT_2, dc=DOMIAN COMPONENT_1 When a database is registered in OID via DBCA an rdbms_server_dn is added to the pfile or spfile. It is recommended that the value of this parameter is copied directly into the DN field in the Advanced Certificate Request form. e.g. cn=sales,cn=OracleContext,dc=oracle,dc=com If the certificate is used by the OID server for SSL authentication then the DN is not as significant but convention may either be to use the database repository distinguished name or the OID server name. 6. Select ok to complete the certificate request creation process. A Certificate [Requested] entry should appear in the Wallet Manager main window 7. Save the wallet, File->Save 8. Save the certificate request, re-select the certificate request in the Main Window and then go to Operation->Export Certificate Request. Save to a suitable file name, e.g. sales.csr Step 2: Sign the certificate. The export file created by OWM in the previous step will be a BASE64 format X509 certificate request. This certificate request can be signed by most commercial certificate authorities or self signed. Oracle provides it's own certificate authority, OCA, with 10g iAS. For test purposes it is also possible to use OpenSSL which is supplied with many Linux installations. Step 3: Import the trusted CA root certificate and signed certificate into OWM Wallet manager will only import a signed certificate if the complete signing trusted certificate chain exists in the wallet. The trusted certificates for a commercial CA are generally available from their web site. If you have used your own certificate authority then you will need to locate the BASE64 files which were used to sign your certficate. For the purpose of this note it is assumed that both the CA trusted certificate(s) and the signed user certficate have been copied to the server which is running OWM. 1. Import the root certificate from the select CA into OWM, Operations->Import Trusted Certificate 2. Select the option to "Select a file that contains the certificate. 3. Browse to the file and select OK, the Common Name of you CA should now appear in the main window under Trusted Certificate 4. Import the signed certificate from the CA into OWM, Operations->Import User Certificate 5. Select the option to "Select a file that contains the certificate. 6. Browse to the file containing your signed certicate and select OK, the requested Certificate should now have a status of Ready Save your wallet. Step 4: Enable the wallet for database access When the database accesses the wallet it does not provide a password, instead it reads an open instantiation of the wallet file, ewallet.p12. The open wallet file is names cwallet.sso. To enable the wallet for unattended login tick the box next to File->Auto Login. Save the wallet again. REFERENCES ---------- Oracle's primary reference for SSL is the Oracle Advanced Security Administrator's Guide. This guide describes Oracle's SSL solution and configuration in greater detail, see Configuring Secure Sockets Layer Authentication. The guide is available on the documentation CD and at: http://download-west.oracle.com/docs/cd/B10501_01/network.920/a96573/asossl.htm#1004601 Note:189260.1: An Example on How to Configure TCPS Using a DN Certificate from Signed by Thwate Note.262394.1: A Simple Example of a TCPS Loopback Connection Using OpenSSL

Configuring SSL for Client Authentication and Encryption With Self Signed Certificates On Both Ends Using orapki

Configuring SSL for Client Authentication and Encryption With Self Signed Certificates On Both Ends Using orapki

Applies to:
Advanced Networking Option - Version 10.2.0.5 to 11.2.0.2 [Release 10.2 to 11.2]
Information in this document applies to any platform.
Checked for relevance on 29-Apr-2013
Purpose

The note has been written using Oracle Enterprise Linux 4.0 and 5.0,  and Oracle  RDBMS versions 10.2.0.5, 11.1.0.7, and 11.2.0.2, although the steps are generic and should apply to all platforms.

In this note the client and server are separate machines to help clarify which configuration is server side and which is client side. This connection authenticates both the server and the client.


One can set up the SSL authentication as described in this note only when testing this authentication method or when the number of  the users authenticated via SSL is not large. The rationale is that in this note the client signs it's own certificate and we import the root certificate of the client into the wallet of the server. As such for a large number of different users we will end up with too many client root certificates being imported into the wallet of the server.



This note uses the Oracle command line tool orapki to generate self signed certificates and to manipulate the wallets. Some of the steps could be done using Oracle Wallet Manager but this note will focus on using orapki.

Oracle's primary reference for SSL is the Oracle Advanced Security Administrator's Guide. This guide describes Oracle's SSL solution and configuration in greater detail, see Configuring Secure Sockets Layer Authentication. The guide is available on the documentation CD.
Scope

This note is intended for use by Database Administrators.

Details

Configuring the server and client wallets


1) Create and configure the server wallet


All of the steps to create and configure the wallet are done from the UNIX shell (or cmd.exe on Windows).

The first step is optional and is to create a directory to put the wallet in if one does not already exist,


$> mkdir /u01/10.2/server_wallet



Then change directory into this directory,

$> cd /u01/10.2/server_wallet
$> cd /u01/10.2/server_wallet



Next we will use orapki to create the initial wallet,


$> orapki wallet create -wallet /u01/10.2/server_wallet -auto_login -pwd Welcome1



This will have created two new files in the directory,

$> ls -la /u01/10.2/server_wallet

-rw------- 1 oracle dba 7940 Nov 29 08:14 cwallet.sso
-rw------- 1 oracle dba 7912 Nov 29 08:14 ewallet.p12



The next step is to create a self-signed certificate. This will generate both a user certificate and the CA root certificate that is signing it,


$> orapki wallet add -wallet /u01/10.2/server_wallet -dn "CN=server" -keysize 512 -self_signed -validity 365 -pwd Welcome1




If this wallet was opened using Oracle Wallet Manager (owm) it is possible to see these 2 new certificates.

The final step is to export the CA root certificate,


$> orapki wallet export -wallet /u01/10.2/server_wallet -dn "CN=server" -cert server_ca.cert


2) Create and configure the client wallet

All of the steps to create and configure the wallet are done from the UNIX shell (or cmd.exe on Windows).

The first step is optional and is to create a directory to put the wallet in if one does not already exist,


$> mkdir /u01/10.2/client_wallet



Then change directory into this directory,


$> cd /u01/10.2/client_wallet



Next we will use orapki to create the initial wallet,


$> orapki wallet create -wallet /u01/10.2/client_wallet -auto_login -pwd Welcome2



This will have created two new files in the directory,


$> ls -la /u01/10.2/client_wallet

-rw------- 1 adam adam 7940 2006-11-29 09:21 cwallet.sso
-rw------- 1 adam adam 7912 2006-11-29 09:21 ewallet.p12



The next step is to create a self-signed certificate. This will generate both a user certificate and the CA root certificate that is signing it,


$> orapki wallet add -wallet /u01/10.2/client_wallet -dn "CN=adam" -keysize 512 -self_signed -validity 365 -pwd Welcome2


If this wallet was opened using Oracle Wallet Manager (owm) it is possible to see these 2 new certificates.

The next step is to export the CA root certificate,


$> orapki wallet export -wallet /u01/10.2/client_wallet -dn "CN=adam" -cert client_ca.cert


The final step is to import the server's root certificate (server_ca.cert) into the client wallet,

and to import the client's root certificate (client_ca.cert) into the server wallet. It is assumed that the exported files are transferred via ftp or another mechanism between the machines.

So on the client the server's root certificate is imported with,


$> orapki wallet add -wallet /u01/10.2/client_wallet -trusted_cert -cert server_ca.cert -pwd Welcome2


and on the server the client's root certificate is import with,

$> orapki wallet add -wallet /u01/10.2/server_wallet -trusted_cert -cert client_ca.cert -pwd Welcome1



Configuring sqlnet for TCPS on the server and client


1) Server side Listener Configuration

Configure a TCPS listener address

Use Net Manager to create an new TCPS listener or add new TCPS address to an existing listener. You will also need to add the wallet location. For example,


LISTENER =
   (DESCRIPTION_LIST =
     (DESCRIPTION =
        (ADDRESS = (PROTOCOL = TCP)(HOST = ukp12692.uk.oracle.com)(PORT = 1521))
     )
     (DESCRIPTION =
       (ADDRESS = (PROTOCOL = TCPS)(HOST = ukp12692.uk.oracle.com)(PORT = 1522))
     )
  )

WALLET_LOCATION =
  (SOURCE=
   (METHOD=File)
    (METHOD_DATA=
     (DIRECTORY=/u01/10.2/server_wallet)))


2) Server side sqlnet.ora Configuration


SQLNET.AUTHENTICATION_SERVICES= (BEQ, TCPS)
SSL_VERSION = 0
SSL_CLIENT_AUTHENTICATION = TRUE
WALLET_LOCATION =
  (SOURCE =
   (METHOD = FILE)
    (METHOD_DATA =
     (DIRECTORY = /u01/10.2/server_wallet)
    )
   )



3) Client side sqlnet.ora Configuration

In the client sqlnet.ora set TCPS as an authentication method and set the wallet location,


SQLNET.AUTHENTICATION_SERVICES= (BEQ, TCPS)
SSL_VERSION = 0
SSL_CLIENT_AUTHENTICATION = TRUE

WALLET_LOCATION =
  (SOURCE =
   (METHOD = FILE)
   (METHOD_DATA =
   (DIRECTORY = /u01/10.2/client_wallet)
   )
  )




4) Client side tnsnames.ora Configuration


Use Net Manager or Net Configuration Assistant to create a service name using TCPS, e.g.


v10g =
  (DESCRIPTION =
    (ADDRESS_LIST =
     (ADDRESS = (PROTOCOL = TCPS)(HOST = ukp12692.uk.oracle.com)(PORT = 1522))
    )
    (CONNECT_DATA =
     (SERVICE_NAME = v10g)
    )
   )




Configuring the database

1) OS_AUTHENT_PREFIX and REMOTE_OS_AUTHENT

The database parameter OS_AUTHENT_PREFIX must be null and REMOTE_OS_AUTHENT must be FALSE.

For example,


SQL> alter system set remote_os_authent=FALSE scope=spfile;



and


SQL> alter system set os_authent_prefix='' scope=spfile;



The instance will need to be restarted for these changes to take effect.

2) Create the user within the database

The user within the database has to be created specifying the distiguished name (DN) on their certificate. For example,


SQL> create user adam identified externally as 'CN=adam';



The user should have have create session granted so they are able to connect,


SQL> grant create session to adam;




Testing it

1) The first test is to confirm the client is able to tnsping the alias for the TCPS listener.

This will confirm that the client wallet is properly accessible by the client. For example,

$> tnsping v10g

TNS Ping Utility for Linux: Version 10.2.0.2.0 - Production on 29-NOV-2006 10:16:32

Copyright (c) 1997, 2005, Oracle. All rights reserved.

Used parameter files:
/u01/10.2/network/admin/sqlnet.ora

Used TNSNAMES adapter to resolve the alias
Attempting to contact (DESCRIPTION = (ADDRESS_LIST = (ADDRESS = (PROTOCOL = TCPS)(HOST = 138.3.128.29)(PORT = 1522))) (CONNECT_DATA = (SID = v10g)))
OK (100 msec)



2) The second test is to connect as the TCPS authenticated user. For example,


$> sqlplus /@v10g

SQL*Plus: Release 10.2.0.2.0 - Production on Wed Nov 29 10:17:27 2006

Copyright (c) 1982, 2005, Oracle. All Rights Reserved.

Connected to:
Oracle Database 10g Enterprise Edition Release 10.2.0.2.0 - Production
With the Partitioning, OLAP and Data Mining options

SQL>



3) Then it is possible to confirm that the connection is for the correct user we created earlier,


SQL> select user from dual;

USER
------------------------------
ADAM



4) A final confirmation is to verify the network_protocol from the userenv, for example:


SQL> select sys_context('userenv','network_protocol') from dual;

SYS_CONTEXT('USERENV','NETWORK_PROTOCOL')
--------------------------------------------------------------------------------
tcps



 

How to Create a Wallet with a Self-Signed Certificate and Export the Certificate using ORAPKI

How to Create a Wallet with a Self-Signed Certificate and Export the Certificate using ORAPKI

Applies to:Oracle Security Service - Version 10.1.0.5 to 11.2.0.3 [Release 10.1 to 11.2]
Information in this document applies to any platform.

Goal : How to Create a Wallet with a Self-Signed Certificate and Export the Certificate:

Solution

The following steps illustrate creating a wallet, adding a self-signed certificate to it, viewing the wallet and exporting the certificate:
1. Create a wallet
        orapki wallet create -wallet /private/user/orapki_use/root
        The wallet is created ain the specified directory ( /private/user/orapki_use/root ).
2. Add a self-signed certificate to the wallet
         orapki wallet add -wallet /private/user/orapki_use/root -dn 'CN=root_test,C=US' -keysize 2048 -self_signed -validity 3650
       This creates a self-signed certificate with a validity of 3650 days. The distinguished name of the subject is CN=root_test,C=US. The key size for the certificate is 2048 bits.
3. View the contents of the wallet wallet
        orapki wallet display -wallet /private/user/orapki_use/root
   
4. Export the certificate
       orapki wallet export -wallet /private/user/orapki_use/root -dn 'CN=root_test,C=US' -cert /private/user/orapki_use/root/b64certificate.txt

     This exports the self-signed certificate to file b64certificate.txt. Note that the distinguished name used is the same as in step 2.

How to Start and Stop Financial Management (HFM) Server Windows Processes

What are the main Windows processes of an HFM application server?

The main Windows processes of a HFM application server are HsxService.exe, HsxServer.exe, CASSecurity.exe and HsvDatasource.exe.

What happens when I start the HFM Windows Service?

Oracle's Hyperion Financial Management can be started by starting the Windows Service "Hyperion Financial Management - Management Service". When this service is started, a process called HsxService.exe will become visible in the Windows Task Manager, and will remain running until the Windows Service is stopped. The HsxServer.exe, CASSecurity.exe and HsvDataSource.exe processes are also started.

What happens when I stop the HFM Windows Service?

When the Hyperion Financial Management Windows service is stopped, the HsxService.exe process will be stopped along with the HsvDataSource.exe, CASSecurity.exe and HsxServer.exe processes.

Why should I use the HFM Windows Service?

Oracle typically recommends that customers use the Windows Service approach only when their individual applications within their HFM database are known to take several minutes to start up. By starting the Windows Service, the application server will pre-launch each application, which will then be "active" and already started when the first user attempts to connect to the application. In this way, the user will not experience any "delay" while logging in, due to application startup time.

Applications may take longer to start up when their metadata dimensions are very large, when an application server or database is under heavy load, or when the rules file of the application contains a slow performing "NoInput" rules section. This section may take longer to execute if it contains many loop statements through many different metadata Point of View (POV) members. Care should be taken when designing metadata and NoInput rules routines to reduce the start up time of an individual application.

When should I not use the HFM Windows Service?

A potential disadvantage of using the Windows Service approach is that all applications are started, regardless of the true requirement and usage of the end users. If there are many applications that exist in the HFM database, unnecessary memory and CPU cycles may be used launching applications which are not needed by the end users. For this reason, Oracle recommends that customers not keep unused HFM applications in production environment HFM databases, or to not use the HFM Windows Service approach if there are known unused HFM applications in the database.

Allowing HFM to start and stop as needed.

If the HFM Windows Service is not being used as above, Financial Management will start itself when end users attempt to log on to an HFM application. When any end user connects to HFM for the first time on a particular application server, the process HsxServer.exe will be started. This process builds connections to the HFM database repository, authenticates the user connecting, and returns a list of available HFM applications within the database. There will only be one HsxServer.exe process on each application server. If the end user who connected to the HFM application server then proceeds to select an HFM application name to open, the HsxServer.exe process will then launch the HsvDataSource.exe Windows process to start that application. The HsxServer.exe process will remain running until there are no users logged on to that application server and all HsvDataSource.exe processes have also stopped.

Why do I see multiple HsvDataSource.exe processes on an HFM application server?

Hyperion Financial Management opens one HsvDataSource.exe (HSVDAT~1.EXE) process on the HFM server per active application. Connections are application specific. If multiple applications are opened, multiple HsvDataSource.exe processes will be launched.

When an application is opened, a database connection pool is created between the application process and the relational database (SQL Server / Oracle / DB2 etc). However, connections are not released on an application basis - they are released on an application server basis. All connections are not released until the application server has no Financial Management users accessing any application.

When does the HsvDataSource.exe process stop itself?

When an application server determines that all users of a particular application on that application server have correctly logged off or timed out (e.g. web time out), then it sends a signal to the HsvDataSource.exe process running that application to stop itself.

When all HsvDataSource.exe processes on a particular application server have stopped themselves, then the HsxServer.exe and CASSecurity.exe processes will also be stopped. After a short delay, under normal circumstances, all HFM processes will stop themselves. Only when all HFM processes on all HFM application servers have been stopped is it safe to make changes to the relational database for example, copying applications, taking or restoring backups of the database or powering down the database. Changes to the database should NOT be made while any HsvDataSource.exe process is seen running in the Windows Task Manager.

Why might the HsvDataSource.exe not stop by itself?

If end users log off incorrectly, their sessions may not have stopped. Hyperion Reports, Financial Reporting, Web Analysis, Financial Data Quality Management, Shared Services task flows or other modules may be holding open connections to Financial Management applications. All other Hyperion processes and services which may be connecting to Financial Management should be stopped first. Financial Management administrators may like to use the "Users on System" module of Financial Management to stop end user connections. When Financial Management decides that all connections have stopped, it should proceed to shut itself down automatically.

What is the CASSecurity.exe process?

Another Windows process is CASSecurity.exe. This is a process that manages the interface between Financial Management and Hyperion Shared Services modules. It handles some of the authorization and authentication processes of HFM, as well as security related features while the application is running.  Important Note:  Any change in the Shared Services external provider configuration REQUIRES the CASSecurity.exe process to be recycled in order gain access to the provider changes.  Follow the "In what order should the HFM processes be stopped" section.

In what order should the HFM processes be stopped?

If Financial Management appears to have frozen / crashed it may be necessary to stop the processes. Processes should be stopped in the following order:

1. The Hyperion Financial Management Windows Service (HsxService.exe) should be stopped via the Windows Services if it seen to be running.
2. The HsvDataSource.exe for each application should be shut down. Ideally it should be observed that the HsvDataSource.exe is using 00% CPU in the Windows Task Manager before it is stopped using "End Process". Care should be taken when stopping running processes.
3. Any CASSecurity.exe process which is still running in the Windows Task Manager should be stopped using "End Process"
4. If any HsxServer.exe process is still running, it should be stopped using "End Process"
   
   CAUTION: In a multi-server environment where multiple application servers are connecting to the same relational database, the process of stopping HFM should be repeated on ALL HFM application servers before attempting to restart any HFM processes or "bring up" the applications once again. It is not recommended to stop and start any one server independently but instead to stop the whole environment and then bring it back up.

Hyperion Installation Pre Requisites

Install Operating system windows 2008 32bit  with

1)    MS office 2007

2)    IIS and IIS7

3)    .Net Framework 3.5

4)    Disable the firewall and UAC

5)    install Application server in server manger roles

6)    Provide all privileges for DCOM user(hfmuser) on the server (IP).
++  Act as a part of the operating system
++  Allow Log on Locally
++  Log on as services
++  Log on as a batch job.
++  everyone
++  Anonymous logon
++  network service

How To Find Oracle Application File Versions.

How To Find Oracle Application File Versions.

In this post, sharing the way of finding the correct version of Oracle Applicatins file version of different component. This should be helpful while patching the applications.

Use the following information for the appropriate file type.

FORM 

adident
cd $AR_TOP/forms/US
Ex. adident Header ARXTWLIN.fmx

strings -a  form.frm |  grep  Revision
Ex.
cd $AU_TOP/forms/US
strings -a POXPOVCT.fmb | grep Revision

Use \Help Version

Or Help, About Oracle Applications

REPORT
cd $AR_TOP/reports
adident
adident Header report.rdf
Ex. adident Header ARBARL.rdf

strings -a  report.rdf  |  grep  Header
Ex.
strings -a ARBARL.rdf  |  grep Header

SQL 
more  sqlscript.sql  Ex.  more ARTACELO.sql

The version will be in a line that starts with 'REM  $Header', and should be one of the first lines in the .sql file.
grep '$Head' sqlscript.sql
Ex.
grep '$Head' ARTACELO.sql

BIN or EXECUTABLE 
An executable in the bin directory will contain numerous C code modules, each with its own version. All of the following examples use ident or strings,
but the difference is what you grep for.

1.  Get ALL file versions contained in the executable.
adident Header executable (Ex. adident Header RACUST)
strings -a  executable  |  grep  Header  (Ex. strings -a RACUST | grep Header)

2.  Get ALL of the product specific file versions.
adident  Header executable (Ex.  adident Header RACUST)
strings -a  executable  |  grep  Header
(Ex.  strings -a  RACUST  |  grep  Header)

3.  Get only the version of a specified module.
strings -a  executable  |  grep  module  (Ex. strings -a RAXTRX | grep raaurt)

4.   A Collection of class file versions

from the directory where the classfile exists in a command prompt run the following:
strings -a Classname.class | grep Header

Get ALL of the product specific file versions.
  
strings -a  executable  |  grep  'Header: product_short_name'
cd $FND_TOP/bin
strings -a WFLOAD | grep 'Header: afspc'
        
Get only the version of a specified module.
  
strings -a  executable  |  grep  module

ORACLE REPORTS 
From the form, select Help, About Oracle Reports.

RDBMS 
1. Use \Help Version
2. Or Help, About Oracle Applications
3. Get into SQL*Plus using any userid/password. You will get a string that tells you the PL/SQL version and data

Purging Strategy for eBusiness Suite 11i

Purging Strategy for eBusiness Suite 11i


In this Document
Abstract
History
Details
  Concurrent Jobs to purge data
  Additional Notes
Summary
References
APPLIES TO:

Oracle Application Object Library - Version 11.5.10.0 to 12.1.3 [Release 11.5 to 12.1]
Information in this document applies to any platform.
Checked for relevance on 30-NOV-2013
ABSTRACT

There is no single Archive/Purge routine that is called by all modules within eBusiness Suite, instead each module has module specific archive/purge procedures.
   
This note lists the Purging routines available for the "System Administrator" (FND module)   Not all of these purging processes will be appropriate for all customers, so review the documentation to confirm which are necessary for your own environment and how often they should be run.

Update : November 2008  - since this note was written, a much more comprehensive article has been published in Note 752322.1 "Reducing Your Oracle E-Business Suite Data Footprint using Archiving, Purging, and Information Lifecycle Management"

HISTORY

Author :  Mike Shaw
Create Date 18-Aug-2008

DETAILS

Concurrent Jobs to purge data

Purge Obsolete Workflow Runtime Data (FNDWFPR)
 Oracle Applications System Administrators Guide - Maintenance Release 11i (Part No. B13924-04)
 Note 132254.1  Speeding up and Purging Workflow
 Note 277124.1  FAQ on Purging Oracle Workflow Data
 Note 337923.1  A closer examination of the Concurrent Program Purge Obsolete Workflow Runtime Data

Purge Debug Log and System Alerts (FNDLGPRG)
  Note 332103.1  Purge Debug Log And System Alerts Performance Issues

Purge Signon Audit data (FNDSCPRG)
  Note 1016344.102   What Tables Does the Purge Signon Audit Data Concurrent Program Affect?
  Note 388088.1   How To Clear The Unsuccessful Logins

Purge Concurrent Request and/or Manager Data (FNDCPPUR)
Oracle Applications System Administrator Guide - Maintenance Release 11i (Part No. B13924-04)
   Note 565942.1   Which Table Column And Timing Period Does The FNDCPPUR Purge Program Use
   Note 104282.1  Concurrent Processing Tables and Purge Concurrent Request and/or Manager Data Program (FNDCPPUR)
 Note 92333.1   How to Optimize the Process of Running Purge Concurrent Request and/or Manager Data (FNDCPPUR)

Delete Diagnostic Logs (DELDIAGLOG)
 Note 466593.1   How To Delete Diagnostic Logs and Statistics?

Delete Diagnostic Statistics (DELDIAGSTAT)
 Note 466593.1   How To Delete Diagnostic Logs and Statistics?

Purge FND_STATS History Records (FNDPGHST)
  Oracle Applications System Administrators Guide - Configuration Release 11i (Part No. B13925-06)
   Note 423177.1  Date Parameters For "Purge Fnd_stats History Records" Do Not Auto-Increment

Page Access Tracking Purge Data (PATPURGE)
  Note 413795.1   Page Access Tracking Data Purge Concurrent Request Fails With Ora-942
  Note 461897.1   Which Tables store the Page Access Tracking Data?
  Note 402116.1   Page Access Tracking in Oracle Applications Release 12

Purge Obsolete Generic File Manager Data (FNDGFMPR)
 Oracle Applications System Administrators Guide - Configuration Release 11i (Part No. B13925-06)
  Note 298698.1   Avoiding abnormal growth of FND_LOBS table in Application
  Note 555463.1   How to Purge Generic or Purchasing Attachments from the FND_LOBS Table

Summarize and Purge Concurrent Request Statistics (FNDCPCRS)
(no references found)

Purge Inactive Sessions (ICXDLTMP)
  Note 397118.1  Where Is 'Delete Data From Temporary Table'  Concurrent Program - ICXDLTMP.SQL

Purge Obsolete ECX Data (FNDECXPR)
  Note 553711.1   Purge Obsolete Ecx Data Error ORA-06533: Subscript Beyond Count
  Note 338523.1   Cannot Find ''Purge Obsolete Ecx Data'' Concurrent Request
  Note 444524.1   About Oracle Applications Technology ATG_PF.H Rollup 6

    The tables being purged by "Purge Obsolete ECX Data (FNDECXPR)" are:

ecx_error_msgs
ecx_msg_logs
ecx_outbound_logs
ecx_external_retry
ecx_inbound_logs
ecx_outbound_logs
ecx_external_logs
ecx_oxta_logmsg
ecx_doclogs
Purge Rule Executions (FNDDWPURG)
      The table being purged by "Purge Rule Executions (FNDDWPURG) is:

fnd_debug_rule_executions
Additional Notes

You can monitor and run purging programs through OAM by navigating to the Site Map--> Maintenence --> Purge section.

SUMMARY

Purging of un-needed data is an activity that needs to be performed on all systems to ensure best performance and minimize disk space requirements.   This note outlines some of the processes that may be required from the FND perspective

REFERENCES

NOTE:104282.1 - Concurrent Processing - Purge Concurrent Request and/or Manager Data Program (FNDCPPUR)
NOTE:132254.1 - Speeding Up And Purging Workflow
NOTE:277124.1 - FAQ on Purging Oracle Workflow Data
NOTE:298698.1 - Avoiding abnormal growth of FND_LOBS table in Applications 11i
NOTE:332103.1 - Purge Debug Log And System Alerts Performance Issues
NOTE:337923.1 - A Closer Examination Of The Concurrent Program Purge Obsolete Workflow Runtime Data
NOTE:338523.1 - Cannot Find The Purge Obsolete ECX Data Concurrent Request
NOTE:387459.1 - ATG Supplied Data Purge Requests
NOTE:402116.1 - Page Access Tracking in Oracle Applications Release 12
NOTE:388088.1 - How to Purge Data from the FND_UNSUCCESSFUL_LOGINS Table?
NOTE:397118.1 - Where Is 'Delete Data From Temporary Table' Concurrent Program - ICXDLTMP.SQL
NOTE:413795.1 - Page Access Tracking Data Purge Concurrent Request Fails With Ora-942
NOTE:423177.1 - Date Parameters For "Purge Fnd_stats History Records" Do Not Auto-Increment
NOTE:444524.1 - About Oracle Applications Technology ATG_PF.H Rollup 6
NOTE:461897.1 - Which Tables Store the Page Access Tracking Data?
NOTE:466593.1 - How To Delete Diagnostic Logs and Statistics?
NOTE:553711.1 - Purge Obsolete Ecx Data Error ORA-06533: Subscript Beyond Count
NOTE:555463.1 - How to Purge Generic or Purchasing Attachments from the FND_LOBS Table
NOTE:565942.1 - Which Table Column And Timing Period Does The FNDCPPUR Purge Program Use
NOTE:1016344.102 - Concurrent Processing - List of Tables Accessed by the Purge Signon Audit Data Concurrent Program
NOTE:752322.1 - Reducing Your Oracle E-Business Suite Data Footprint using Archiving, Purging, and Information Lifecycle Management
NOTE:92333.1 - Concurrent Processing - How to Optimize the Process of Running Purge Concurrent Request and/or Manager Data (FNDCPPUR)

Coldbackup EBS Script

#Runs preclone process in DB Tier
su - oracle /u01/d01/tech_st/11.1.0/appsutil/scripts/JPROD_training/adpreclone.pl dbTier apps/apps
#Runs preclone process in Apps Tier
su - applmgr /u01/d02/inst/apps/JPROD_training/admin/scripts/adpreclone.pl appsTier apps/apps
#Shutdown process for Apps then DB
su - applmgr /u01/d02/inst/apps/JPROD_training/admin/scripts/adstpall.sh apps/apps
su - oracle /u01/d01/tech_st/11.1.0/appsutil/scripts/JPROD_training/addbctl.sh stop immediate
su - oracle /u01/d01/tech_st/11.1.0/appsutil/scripts/JPROD_training/addlnctl.sh stop JPROD
#Creates a new folder with current date
NOWDATE=`date +%d-%m-%y-%H_JPRODBKP`
export NOWDATE
mkdir /root/Desktop/$NOWDATE
#zip all the Tiers of Database and Apps
#Backup inst (in Apps Tier)
NOWDATE=`date +%d-%m-%y-%H_Apps_inst`
export NOWDATE
tar cvf - /u01/d02/inst | gzip -c > /root/Desktop/`date +%d-%m-%y-%H_JPRODBKP`/$NOWDATE.tgz
#zip all the Tiers of Database and Apps
#Backup inst (in Apps Tier)
NOWDATE=`date +%d-%m-%y-%H_Apps_inst`
export NOWDATE
tar cvf - /u01/d02/inst | gzip -c > /root/Desktop/`date +%d-%m-%y-%H_JPRODBKP`/$NOWDATE.tgz
#
#Backup apps  (in Apps Tier)
NOWDATE=`date +%d-%m-%y-%H_Apps_apps`
export NOWDATE
tar cvf - /u01/d02/apps | gzip -c > /root/Desktop/`date +%d-%m-%y-%H_JPRODBKP`/$NOWDATE.tgz
#
#Backup apps_st (in DB Tier)
NOWDATE=`date +%d-%m-%y-%H_DB_apps_st`
export NOWDATE
tar cvf - /u01/d01/apps_st | gzip -c > /root/Desktop/`date +%d-%m-%y-%H_JPRODBKP`/$NOWDATE.tgz
#
#Backup Archive (in DB Tier)
NOWDATE=`date +%d-%m-%y-%H_DB_Archive`
export NOWDATE
tar cvf - /u01/d01/Archive | gzip -c > /root/Desktop/`date +%d-%m-%y-%H_JPRODBKP`/$NOWDATE.tgz
#
#Backup tech_st (in DB Tier)
NOWDATE=`date +%d-%m-%y-%H_DB_tech_st`
export NOWDATE
tar cvf - /u01/d01/tech_st | gzip -c > /root/Desktop/`date +%d-%m-%y-%H_JPRODBKP`/$NOWDATE.tgz
#After complition of zipping process it will start the DB and Apps automatically
su - oracle /u01/d01/tech_st/11.1.0/appsutil/scripts/JPROD_training/addbctl.sh start
su - oracle /u01/d01/tech_st/11.1.0/appsutil/scripts/JPROD_training/addlnctl.sh start JPROD
su - applmgr /u01/d02/inst/apps/JPROD_training/admin/scripts/adstrtal.sh apps/apps
#