How to find the DNS domain name of your server

There is a command called domainname in Unix. However, the 'domainname' command returns the NIS domain name. This is unrelated to the DNS domain, although you could set them to be the
same. Unfortunately, there's no general way to obtain the DNS domain. Parsing the 'domain' line from /etc/resolv.conf is probably the best way. If the local hostname is fully-qualified, you could split it at the first dot to obtain the hostname. If it isn't, you could qualify it with a DNS lookup first.

awk '$1=="domain" {print $2}' /etc/resolv.conf

How to find out the file through which an Apps standard package is created

Veera Boda pinged me today. He gave me this error which was coming during adconfig:

Cause: afpgdbcf failed due to ORA-04063: package body "APPS.FND_PROFILE" has errors
ORA-06508: PL/SQL: could not find program unit being called: "APPS.FND_PROFILE"
ORA-06512: at "APPS.FND_WEB_CONFIG", line 269
ORA-06512: at "APPS.FND_SECURITY_PKG", line 350

He said that he had followed Metalink Note 178001.1 to drop obsolete objects. On checking 178001.1, I found that it was related to 11.5.2 and advised running a script $FND_TOP/admin/sql/fnddold.sql which dropped obsolete objects. Apparently that script also dropped some objects like FND_PROFILE and FND_USER_PKG. Boda wanted to know how he could create those dropped objects. I thought of Electronic Technical Reference Manual available thru http://etrm.oracle.com which requires metalink login. However etrm has definitions of objects starting from 11.5.7. They don't have 11.5.2 objects. Then I thought of an easy way which I had discovered for fixing invalid objects. If you query a package's source code, you can find the line which has the version information. The version information line has the name of the file through which the package was created. For example:

select line,text from dba_source where object_name='FND_USER_PKG' and line < style="font-weight: bold;">/* $Header: AFSCUSRB.pls 115.150 2007/06/01 16:37:07 fskinner ship $ */
3
4
/* START PARTY */


From the above query I come to know that AFSCUSRB.pls file created the package body FND_USER_PKG. The naming convention of the files is like this:

If the file's primary name ends with an S then it creates the package specification.
If the file's primary name ends with a B then it creates the package body.

For example AFSCUSRS.pls creates package specification of FND_USER_PKG and AFSCUSRB.pls creates the package body.

After tracing the files which created the dropped packages, Boda was able to recreate all of them and restore normalcy to his instance.

Disable Anonymous access to Diagnostics

Recently we had a security scan from security team. Here's one high vulnerability item they highlighted:

Users from "guest" role can see sensitive information by calling "jtfqalgn.htm"
test page.
URIs:
· http://erp11i.justanexample.com:8000/OA_HTML/jtfqalgn.htm
Steps to Reproduce Exploit:
1. Type in the address bar the following URL:
http://erp11i.justanexample.com:8000/OA_HTML/jtfqalgn.htm and press
Enter key
2. You will see the page "Oracle Diagnostic" and you get access like "guest".
3. You can access application's test, do click on combo box and select the
application or click on registered test number.
4. Click on the "Run All Groups" button
5. You will see the report with test that you can run.
6. Click on the report image.
7. You will see test details.

Recommendations
1. Remove this test page from the production server.

Removing the page from the server is not a good solution, as further diagnostic patches will bring back the page. We have an SR logged with Oracle for this. However based on the documentation in metalink note 230331.1:

Diagnostic Roles
Diagnostic Roles determine the activities or tasks that a user can perform on
Diagnostics. Some activities of importance are:

>> Running test cases (with different input values
incase of advanced tests)
>> Viewing detailed test reports after tests have been run
>> Configuring input values for test cases
>> Adding, deleting test cases and test groups across
applications registered with Diagnostics
>> Viewing historical reports for test runs using the LogViewer

We decided that it was appropriate to permit these and other diagnostic
activities according to different roles (explained below).

Diagnostics Super User Role:
Has unrestricted privileges to execute, configure, view reports and
setup security for all groups and all applications. Out of the box,
we have granted this role to CRM Foundation application responsibility
"CRM HTML Administration" which in turn has been assigned to user: "sysadmin"

Application Super User:
Has unrestricted privileges (execute, configure, view reports and setup security for
test groups) for the application associated with his responsibility.
However, this role also permits the user to execute and configure inputs
for test groups of low and medium sensitivities across other applications.

End User:
Can execute and configure inputs for test groups of "low
sensitivity" only. This user cannot view detailed test reports.

Anonymous User:
If none of the user's responsibilities have an association with any of the above
3 roles, then the user is considered to be an Anonymous user. The Diagnostics engine
will restrict access to HTML Platform only. All other test groups across applications are restricted from this user.

Roles can be granted to users through responsibilities.
In case a responsibility has been granted a particular ROLE and that responsibility
is accessible to a user, the user automatically gets a grant on that ROLE.

So Anonymous User access is allowed by design. I have no idea how they can circumvent this without changing their existing code.

ORA-4030 during ASCP plan run due to swap issues

Recently we had an agonizing problem of ASCP Plan failing with ORA-4030 error, every time it was launched. After a lot of research, I found that it was due to a known bug and that we were running out of swap. After I added a 10GB swapfile as described in previous post, the error was resolved.

Solaris swap

Think of swap space as an overflow area for RAM. Here's how you can add swap space as given in Sun's official documentation:

How to Create a Swap File and Make It Available

1. Become superuser.

   You can create a swap file without root permissions. However, to avoid accidental overwriting, root should be the owner of the swap file.

2. Create a directory for the swap file, if needed.

3. Create the swap file.

   # mkfile nnn[k|b|m] filename

   The swap file of the size nnn (in Kbytes, bytes, or Mbytes) and filename you specify is created.

4. Activate the swap file.

   # /usr/sbin/swap -a /path/filename

   You must use the absolute path name to specify the swap file. The swap file is added and available until the file system is unmounted, the system is rebooted, or the swap file is removed. Keep in mind that you can't unmount a file system while some process or program is swapping to the swap file.

5. Add an entry for the swap file to the /etc/vfstab file that specifies the full path name of the file, and designates swap as the file system type, as follows:

   /path/filename - - swap - no -

6. Verify that the swap file is added.

   $ /usr/sbin/swap -l

Example—Creating a Swap File and Making It Available

The following examples shows how to create a 100–Mbyte swap file called /files/swapfile.

# mkdir /files
# mkfile 100m /files/swapfile
# swap -a /files/swapfile
# vi /etc/vfstab
(An entry is added for the swap file):
/files/swapfile   -      -       swap     -     no     -
# swap -l
swapfile             dev  swaplo blocks   free
/dev/dsk/c0t0d0s1   136,1      16 1638608 1600528
/files/swapfile        -       16 204784  204784

How to Remove Unneeded Swap Space

1. Become superuser.

2. Remove the swap space.

   # /usr/sbin/swap -d /path/filename

   The swap file name is removed so that it is no longer available for swapping. The file itself is not deleted.

3. Edit the /etc/vfstab file and delete the entry for the swap file.

4. Recover the disk space so that you can use it for something else.

   # rm /path/filename

   If the swap space is a file, remove it. Or, if the swap space is on a separate slice and you are sure you will not need it again, make a new file system and mount the file system.

   For information on mounting a file system, see Chapter 39, Mounting and Unmounting File Systems (Tasks).

5. Verify that the swap file is no longer available.

   # swap -l

Example—Removing UnneededSwap Space

The following examples shows how to delete the /files/swapfile swap file.

# swap -d /files/swapfile # (Remove the swap entry from the /etc/vfstab file) # rm /files/swapfile # swap -l swapfile dev swaplo blocks free /dev/dsk/c0t0d0s1 136,1 16 1638608 1600528

While searching about swap, I found a very good blog post Myths and Facts about Solaris swap space on Jim Laurent's blog.

Jim says that the rule of thumb for swap size is 30% of RAM. He has given many other links like Solaris Internals Wiki which are a must visit.

Swap works differently in Solaris 2 as compared with other Unix systems, including SunOS 4. These systems must always have some swap space, and it must be bigger than RAM. Every program in RAM has its total size reserved on the swap disk in case it needs to be swapped out to disk. Since there are systems with 5 gigabytes (SPARCcenter 2000) or more of RAM, it seems ridiculous that systems that already have huge RAM capacity would need huge swap disks that would probably not be used. Solaris 2 changes the rules by adding the RAM and the disk space. If you can buy enough RAM for your workload, you can run with no swap disk at all! In practice common database applications that are sized to run in a few gigabytes of RAM will actually need many gigabytes of disk allocated as swap space.

Exception in TimedProcess...Failed to execute command

$ adstpall.sh apps/apps

You are running adstpall.sh version 115.19

Executing service control script:
/erp11i/apperp/comn/admin/scripts/$CONTEXT_NAME/adalnctl.sh stop
script returned:
****************************************************
ERROR :
Exception in TimedProcess...Failed to execute command = /erp11i/apperp/comn/admin/scripts/$CONTEXT_NAME/adalnctl.sh stop apps/apps
****************************************************


Executing service control script:
/erp11i/apperp/comn/admin/scripts/$CONTEXT_NAME/adcmctl.sh stop
script returned:
****************************************************
ERROR :
Exception in TimedProcess...Failed to execute command = /erp11i/apperp/comn/admin/scripts/$CONTEXT_NAME/adcmctl.sh stop apps/apps
****************************************************


Executing service control script:
/erp11i/apperp/comn/admin/scripts/$CONTEXT_NAME/adrepctl.sh stop
script returned:
****************************************************
ERROR :
Exception in TimedProcess...Failed to execute command = /erp11i/apperp/comn/admin/scripts/$CONTEXT_NAME/adrepctl.sh stop apps/apps
****************************************************


Executing service control script:
/erp11i/apperp/appl/ieo/11.5.0/admin/scripts/$CONTEXT_NAME/ieoicsm.sh stop
script returned:
****************************************************
AC-00003: Service Script - /erp11i/apperp/appl/ieo/11.5.0/admin/scripts/$CONTEXT_NAME/ieoicsm.sh stop not found.
Raised by oracle.apps.ad.autoconfig.ServiceControl
****************************************************


Check logfile /erp11i/apperp/comn/admin/log/$CONTEXT_NAME/08040824.log for details

Exiting with status 4
$ adcmctl.sh stop apps/apps

You are running adcmctl.sh version 115.28

Shutting down concurrent managers for erp11i ...
Submitted request 619203 for CONCURRENT FND SHUTDOWN


adcmctl.sh: exiting with status 0

$ adalnctl.sh stop

adalnctl.sh version

Shutting down listener process APPS_erp11i.

adalnctl.sh: exiting with status 0

$ adrepctl.sh stop

You are running adrepctl.sh version 115.32

stopping Reports Server for erp11i on port 9036.
kill -9 13523
Reports Server for erp11i successfully stopped.

adrepctl.sh: exiting with status 0

$

This is most probably due to the fact that the server is maxed out on memory.

adstpall.sh and adstrtal.sh use this code to stop and start all services. $STOP is passed as a parameter to stop and $START is passed as a parameter to start

#

# Call the ServiceControl API

# Add the logfile parameter to the service control API

{ echo $unpw; } | $JAVA_TOP -classpath "${CLASSPATH}:${JAVA_TOP}:${FND_TOP}/java/3rdparty/stdalone/xmlparserv2.zip"

oracle.apps.ad.autoconfig.ServiceControl -e $APPL_TOP/admin/$CONTEXT_FILE -m $START -l $LOGFILE -debug -promptmsg hide

Each individual script like adfrmctl.sh, adapcctl.sh has the actual calls which execute the binaries. So, running each script separately worked fine.