diff --git a/heartbeat/oracle b/heartbeat/oracle
index 5ecc2f3..c629eb6 100755
--- a/heartbeat/oracle
+++ b/heartbeat/oracle
@@ -27,6 +27,9 @@
# OCF_RESKEY_ipcrm (optional; defaults to "instance")
# OCF_RESKEY_clear_backupmode (optional; default to "false")
# OCF_RESKEY_shutdown_method (optional; default to "checkpoint/abort")
+# OCF_RESKEY_monuser (optional; defaults to "OCFMON")
+# OCF_RESKEY_monpassword (optional; defaults to "OCFMON")
+# OCF_RESKEY_monprofile (optional; defaults to "OCFMONPROFILE")
#
# Initialization:
@@ -56,6 +59,11 @@ oracle_usage() {
!
}
+# Defaults
+OCF_RESKEY_monuser_default="OCFMON"
+OCF_RESKEY_monpassword_default="OCFMON"
+OCF_RESKEY_monprofile_default="OCFMONPROFILE"
+
oracle_meta_data() {
cat <<END
<?xml version="1.0"?>
@@ -100,6 +108,39 @@ If this does not work for you, just set it explicitely.
<content type="string" default="" />
</parameter>
+<parameter name="monuser" unique="0">
+<longdesc lang="en">
+Monitoring user name. Every connection as
+sysdba is logged in an audit log. This can
+result in a large number of new files created.
+A new user is created (if it doesn't exist) in
+the start action and subsequently used in monitor.
+It should have very limited rights. Make sure
+that the password for this user does not expire.
+</longdesc>
+<shortdesc lang="en">monuser</shortdesc>
+<content type="string" default="$OCF_RESKEY_monuser_default" />
+</parameter>
+
+<parameter name="monpassword" unique="0">
+<longdesc lang="en">
+Password for the monitoring user. Make sure
+that the password for this user does not expire.
+</longdesc>
+<shortdesc lang="en">monpassword</shortdesc>
+<content type="string" default="$OCF_RESKEY_monpassword_default" />
+</parameter>
+
+<parameter name="monprofile" unique="0">
+<longdesc lang="en">
+Profile used by the monitoring user. If the
+profile does not exist, it will be created
+with a non-expiring password.
+</longdesc>
+<shortdesc lang="en">monprofile</shortdesc>
+<content type="string" default="$OCF_RESKEY_monprofile_default" />
+</parameter>
+
<parameter name="ipcrm" unique="0">
<longdesc lang="en">
Sometimes IPC objects (shared memory segments and semaphores)
@@ -216,7 +257,7 @@ execsql() {
if [ "$US" = "$ORACLE_OWNER" ]; then
sqlplus -S /nolog
else
- su - $ORACLE_OWNER -c ". $ORA_ENVF; sqlplus -S /nolog"
+ su - $ORACLE_OWNER -s /bin/sh -c ". $ORA_ENVF; sqlplus -S /nolog"
fi
}
@@ -250,7 +291,7 @@ dbasql() {
runsql "connect / as sysdba" $*
}
monsql() {
- runsql "connect $MONUSR/$MONUSR" $*
+ runsql "connect $MONUSR/\"$MONPWD\"" $*
}
# use dbasql_one if the query should result in a single line output
# at times people stuff commands in oracle .profile
@@ -325,22 +366,73 @@ getipc() {
echo "oradebug tracefile_name"
echo "oradebug ipc"
}
+show_mon_profile() {
+ echo "select PROFILE from dba_profiles where PROFILE='$MONPROFILE';"
+}
+mk_mon_profile() {
+ cat<<EOF
+create profile $MONPROFILE limit FAILED_LOGIN_ATTEMPTS UNLIMITED PASSWORD_LIFE_TIME UNLIMITED;
+EOF
+}
show_mon_user() {
echo "select USERNAME, ACCOUNT_STATUS from dba_users where USERNAME='$MONUSR';"
}
mk_mon_user() {
cat<<EOF
-create user $MONUSR identified by $MONUSR;
+create user $MONUSR identified by "$MONPWD" profile $MONPROFILE;
grant create session to $MONUSR;
grant select on v_\$instance to $MONUSR;
EOF
}
-check_mon_user() {
+show_mon_user_profile() {
+ echo "select PROFILE from dba_users where USERNAME='$MONUSR';"
+}
+set_mon_user_profile() {
+ echo "alter user $MONUSR profile $MONPROFILE;"
+}
+reset_mon_user_password() {
+ echo "alter user $MONUSR identified by $MONPWD;"
+}
+check_mon_profile() {
local output
- dbasql show_mon_user | grep -w "^$MONUSR" >/dev/null &&
+ output=`dbasql show_mon_profile`
+ if echo "$output" | grep -iw "^$MONPROFILE" >/dev/null; then
return 0
+ fi
+ output=`dbasql mk_mon_profile show_mon_profile`
+ if echo "$output" | grep -iw "^$MONPROFILE" >/dev/null; then
+ return 0
+ else
+ ocf_log err "could not create $MONPROFILE oracle profile"
+ ocf_log err "sqlplus output: $output"
+ return 1
+ fi
+}
+check_mon_user() {
+ local output
+ local output2
+
+ output=`dbasql show_mon_user`
+ if echo "$output" | grep -iw "^$MONUSR" >/dev/null; then
+ if echo "$output" | grep -w "EXPIRED" >/dev/null; then
+ dbasql reset_mon_user_password
+ fi
+ output=`dbasql show_mon_user_profile`
+ if echo "$output" | grep -iw "^$MONPROFILE" >/dev/null; then
+ return 0
+ else
+ output=`dbasql set_mon_user_profile`
+ output2=`dbasql show_mon_user_profile`
+ if echo "$output2" | grep -iw "^$MONPROFILE" >/dev/null; then
+ return 0
+ fi
+ ocf_log err "could not set profile for $MONUSR oracle user"
+ ocf_log err "sqlplus output: $output( $output2 )"
+ return 1
+ fi
+ fi
output=`dbasql mk_mon_user show_mon_user`
- if echo "$output" | grep -w "^$MONUSR" >/dev/null; then
+ if echo "$output" | grep -iw "^$MONUSR" >/dev/null; then
return 0
else
ocf_log err "could not create $MONUSR oracle user"
@@ -417,7 +509,7 @@ ipcdesc() {
}
rmipc() {
local what=$1 id=$2
- ipcs -$what | filteroraipc | grep -w $id >/dev/null 2>&1 ||
+ ipcs -$what | filteroraipc | grep -iw $id >/dev/null 2>&1 ||
return
ocf_log info "Removing `ipcdesc $what` $id."
ipcrm -$what $id
@@ -447,6 +539,8 @@ is_proc_running() {
# instance in OPEN state?
instance_live() {
local status=`monsql_one dbstat`
+ [ "$status" = OPEN ] && return 0
+ status=`dbasql_one dbstat`
if [ "$status" = OPEN ]; then
return 0
else
@@ -473,7 +567,7 @@ ora_cleanup() {
}
oracle_getconfig() {
- ora_common_getconfig "$OCF_RESKEY_sid" "$OCF_RESKEY_home" "$OCF_RESKEY_user" "$OCF_RESKEY_tns_admin"
+ ora_common_getconfig "$OCF_RESKEY_sid" "$OCF_RESKEY_home" "$OCF_RESKEY_user"
clear_backupmode=${OCF_RESKEY_clear_backupmode:-"false"}
shutdown_method=${OCF_RESKEY_shutdown_method:-"checkpoint/abort"}
@@ -493,7 +587,7 @@ oracle_getconfig() {
oracle_start() {
local status output
if is_proc_running; then
- status="`monsql_one dbstat`"
+ status="`dbasql_one dbstat`"
case "$status" in
"OPEN")
: nothing to be done, we can leave right now
@@ -541,6 +635,11 @@ oracle_start() {
fi
output=`dbasql dbopen`
+ # check/create the monitor profile
+ if ! check_mon_profile; then
+ return $OCF_ERR_GENERIC
+ fi
+
# check/create the monitor user
if ! check_mon_user; then
return $OCF_ERR_GENERIC
@@ -650,7 +749,12 @@ show_procs() {
proc_pids() { show_procs | awk '{print $1}'; }
PROCS_CLEANUP_TIME="30"
-MONUSR="OCFMON"
+MONUSR=${OCF_RESKEY_monuser:-$OCF_RESKEY_monuser_default}
+MONPWD=${OCF_RESKEY_monpassword:-$OCF_RESKEY_monpassword_default}
+MONPROFILE=${OCF_RESKEY_monprofile_default:-$OCF_RESKEY_monprofile_default}
+
+MONUSR=$(echo $MONUSR | awk '{print toupper($0)}')
+MONPROFILE=$(echo $MONPROFILE | awk '{print toupper($0)}')
OCF_REQUIRED_PARAMS="sid"
OCF_REQUIRED_BINARIES="sqlplus"
ocf_rarun $*
diff --git a/heartbeat/oralsnr b/heartbeat/oralsnr
index 2409017..a91eeab 100755
--- a/heartbeat/oralsnr
+++ b/heartbeat/oralsnr
@@ -158,7 +158,7 @@ runasdba() {
(
echo ". $ORA_ENVF"
cat
- ) | su - $ORACLE_OWNER
+ ) | su -s $SH - $ORACLE_OWNER
fi
}
@@ -268,7 +268,7 @@ oralsnr_validate_all() {
# used in ora-common.sh
show_procs() {
ps -e -o pid,user,args |
- grep '[t]nslsnr' | grep -w "$listener" | grep -w "$ORACLE_OWNER"
+ grep '[t]nslsnr' | grep -i -w "$listener" | grep -w "$ORACLE_OWNER"
}
proc_pids() { show_procs | awk '{print $1}'; }
PROCS_CLEANUP_TIME="10"