What should our DBA know?

My company recently had an assessment performed on our Oracle DB, and quite a few recommendations were passed back to us. As someone who knows very, very little about Oracle, I'm trying to assess whether or not these statements are as dire as they sound. (We do have an Oracle DBA, and it's not me ;) ). Obviously, with a single DBA, this isn't a huge system, but I'm not sure what metrics to give here for reference.

It seems that there has not been a regular performance analysis of database automated workload repository and diagnostics monitor. No daily checklist of monitoring and management activities. Mostly reactive care, rather than proactive.

Tests done during this assessment showed that there was a pattern of virtual memory being exhausted. This was not discovered prior to the assessment.

The File System IO was not set to direct IO in the initialization parameter file.

Installed release is 10gR2, which means we are 7 releases behind, and have missed over 25 Critical Patch Updates.

So - are these signs of a distracted/overburdened DBA? Does this sound like a normal system? Any thoughts you guys may have would be greatly appreciated.

no, seems ok

10gr2 is not 7 releases behind, its 2 - 11g r2 has only just been released so you are only really once release behind and 10g r2 is very stable so no shame there

25 critical updates? are they for bugs which affect you, if not why fix what isnt broken?

direct io is fine - if you need it

first point sounds a bit off, but a lot of people dont use AWR.

So the real question is, is your database at risk - for that you would need to get proper external experts in to assess your business needs vs what you have

not an easy answer

Many thanks. Sometimes it's hard to know if someone is trying to sell their services by creating an artificial need, or if they are giving you the straight scoop. Will continue to investigate. Thanks!

Hi

Every quarter oracle releases CPU patches which contain bug fixes and secirity patches aslo i think you should apply the cpu patches no ?

its like running windows without running the security patches that microsoft releases.

regards

Quote:

---

Originally Posted by hrishy

Hi

Every quarter oracle releases CPU patches which contain bug fixes and secirity patches aslo i think you should apply the cpu patches no ?

its like running windows without running the security patches that microsoft releases.

regards

---

blindly applying them is as bad as not applying them

work out what they do for you - what the risk is and do what the best outcome is

Hi Davey23uk

Most fo the customers i have been to do tend to apply the CPU patches even though they might not have been hit by bugs .

The common answer seems to be twofold.
Paranoidism
SOX requirements (America) or as a part of Audit requirements.

I would love to hear what others think of these view point .

regards

I agree with Hrishy.

Both of my clients in US tend to apply CPU patches to fulfill the SOX requirements. Of course with due testing in dev, test, and qa environments before applying in production.

Thanks,

I have to agree with both Dave and hrishy.

On one hand, blindly applying patches is the best way to keep awakening bugs; on the other hand different regulations force DBA to apply CPU patches - at least in the U.S.

There is also the fact that any bug related TAR opened with Oracle on a non-fully-patched DB is almost guaranteed to result in a patch-first-and-try-again answer.

Quote:

---

Originally Posted by jhmartin

There is also the fact that any bug related TAR opened with Oracle on a non-fully-patched DB is almost guaranteed to result in a patch-first-and-try-again answer.

---

yeah... and once you do that the next answer from Oracle support would be "upgrade" :D

Hi

What happens if you are in the UK.
I know that UK has something similar like SOX called FSA finacial Services Authority.

Arent the UK dba's supposed to apply the security patches as per regulations .

I am also curious about INDIA what happens there since they have massive databases owing to its population

regards

Majority of the Indian local shops don't like to disturb the Database as long is it is running smooth. Currently I am on site in Fiji Islands and here also management doesn't like to apply any patch unless until they hit a bug.

Thanks,

not everyone is regulated by the FSA either - and no there is no rule to apply patches just because they exist

there is a rule to protect the data

Quote:

---

Originally Posted by davey23uk

not everyone is regulated by the FSA either - and no there is no rule to apply patches just because they exist

there is a rule to protect the data

---

So when there is a known bug that doesn't require authentication, thenwe as good DBA's should apply the patch? So its balancing between allowing for new bugs, and leaving vulnerabilities unpatched in a database that could be exploited by someone nefarious.

balance risk and cost

simple as that

As an FYI... in the retail industry, patching is required per the PCI (Payment Card Industry) Standards. You have to have a good reason NOT to apply CPU patches.