Thursday, September 25, 2014

How to Change Session Timeout for OIM11g

You can change the session timeout by directly editing the web.xml
file in both the self-service application archive (oracle.iam.console.identity.self-service.ear) and the sysadmin application archive (oracle.iam.console.identity.sysadmin.ear) and then redeploying the applications . The change will require restart of OIM Manage Servers. 
 
Here are the location of files:
       /opt/idm/product/IAM11GR2/Oracle_IAM1/server/apps/oracle.iam.console.identity.sysadmin.ear
 
·     /opt/idm/product/IAM11GR2/Oracle_IAM1/server/apps/oracle.iam.console.identity.self-service.ear

The session timeout configuration is as below in web.xml

/identity console

15

/syadmin console

35

Change the value in the web.xml, recreate and redeploy the ear file.

Reference:

How to Identify the database session locking the tables

You can use the below command to find if any session has created lock on any database object:

Note: You need to have sys password to identify sessions which are causing the lock on tables and to kill those sessions.

select c.owner,c.object_name,c.object_type,b.sid,b.serial#,b.status,b.osuser,b.machine from
v$locked_object a ,v$session b,dba_objects c
where b.sid = a.session_id and a.object_id = c.object_id and c.owner='<>;

if above query returns any output, please use the below query to kill the session:

ALTER SYSTEM KILL SESSION 'SID,SERIAL';

Use the SID and SERIAL returned by the above query and execute the query.
I have used this query before running the OIM Bulk Load Utility.

How to take & read the JVM Thread Dump for OIM Servers

Each Java Application has its own thread dump. A thread dump is a snapshot of the state of all threads that are part of the process. The state of each thread is presented with a so called stack trace, which shows the contents of a thread’s stack. Some of the threads belong to the Java application you are running, while others are JVM internal threads.

A thread dump reveals information about an application’s thread activity that can help you diagnose problems and better optimize application and JVM performance.

The latest versions of JRockit include a utility called "jrcmd" which can be used to grab information from running JVMs as well as control the behaviour of the JVM. For example, it can be used to create thread stack dumps, print the heap usage, get the commandline used to start the JVM, enable the management console and a few other things.

In the most basic incarnation, jrcmd lists the currently running JVMs on the system. For example,

$./jrcmd

7693 weblogic.Server

13369 weblogic.NodeManager -v

7551 weblogic.Server

9420

Note: Please set the JAVA_HOME & PATH environment variables before running this utility.

The first number is the process id of the process followed by the name of the main class and any command line parameters.

The first number is the process id of the process followed by the name of the main class and any command line parameters.

./jrcmd 19570 print_threads >>thread.txt

Note: Here 19570 is the PID for oim_server2 in PROD.

19570:

===== FULL THREAD DUMP ===============
Wed Aug 27 08:55:58 2014
Oracle JRockit(R) R28.2.5-20-152429-1.6.0_37-20120927-1915-linux-x86_64

"Main Thread" id=1 idx=0x4 tid=19571 prio=5 alive, waiting, native_blocked
    -- Waiting for notification on: weblogic/t3/srvr/T3Srvr@0x12fc20ff0[fat lock]

"[STUCK] ExecuteThread: '0' for queue: 'weblogic.kernel.Default (self-tuning)'" id=15 idx=0x68 tid=24579 prio=1 alive, blocked, native_blocked, daemon

A thread that has the name STUCK in it’s name has been identified as not being returned to the thread pool for a configured amount of time, which defaults to 10 minutes.

Print Memory Usage

./jrcmd 6259 print_memusage

6259:
Total mapped                  6847396KB           (reserved=1206632KB)
-              Java heap      4194304KB           (reserved=0KB)
-              GC tables       140300KB
-          Thread stacks        63828KB           (#threads=198)
-          Compiled code      1048576KB           (used=63385KB)
-               Internal         1480KB
-                     OS       367452KB
-                  Other       491296KB
-            Classblocks        28416KB           (malloced=28323KB #70508)
-        Java class data       510720KB           (malloced=509750KB #327854 in 70508 classes)
- Native memory tracking         1024KB           (malloced=240KB #10)

Print JVM State

./jrcmd 6259 print_vm_state

6259:
Uptime       : 0 days, 01:20:55 on Wed Aug 27 10:30:06 2014
Version      : Oracle JRockit(R) R28.2.5-20-152429-1.6.0_37-20120927-1915-linux-x86_64
CPU          : Intel Core i7 (HT) SSE SSE2 SSE3 SSSE3 SSE4.1 SSE4.2 Core Intel64
Number CPUs  : 16
Tot Phys Mem : 76155084800 (72627 MB)
OS version   : Red Hat Enterprise Linux Server release 5.7 (Tikanga)
Linux version 2.6.32-300.41.2.el5uek (mockbuild@ca-build56.us.oracle.com) (gcc version 4.1.2 20080704 (Red Hat 4.1.2-50)) #1 SMP Tue May 7 21:19:44 PDT 2013 (x86_64)
Thread System: Linux NPTL
LibC release : 2.5-stable
Java locking : Lazy unlocking enabled (class banning) (transfer banning)
State        : JVM is running
LD_ASSUME_KERNEL:
LD_PRELOAD   :
StackOverFlow: 0 StackOverFlowErrors have occured
OutOfMemory  : 0 OutOfMemoryErrors have occured
C Heap       : Good; no memory allocations have failed
GC Strategy  : Mode: throughput, with strategy: genparpar (basic strategy: genparpar)
GC Status    : OC currently running, in phase: cleanup. This is OC#63.
             : YC is not running. Last finished YC was YC#729.
YC Promotion : Last YC successfully promoted all objects
YC History   : Ran 12 YCs before OC#59.
             : Ran 14 YCs before OC#60.
             : Ran 12 YCs before OC#61.
             : Ran 14 YCs before OC#62.
             : Ran 13 YCs before OC#63.
Heap         : 0x100000000 - 0x200000000  (Size: 4096 MB)
Compaction   : 0x1c0000000 - 0x1e0000000  (Current compaction type: external)
Allocation   : TLA-min: 2048, TLA-preferred: 65536 TLA-waste limit: 2048
NurseryList  : 0x118278e50 - 0x192d34590
KeepArea     : 0x178bed9a0 - 0x192d34590
KA Markers   : [ 0x1606298a0,  0x178bed9a0 , 0x192d34590 ]
Forbidden A  : (none)
Previous KA  : (none)
Previous FA  : (none)
CompRefs     : References are compressed, with heap base 0x0 and shift 3.

You can also use weblogic console to view the no. of threads which are in STUCK, HOGGING, STANDBY,ACTIVE state.

Known Limitations of jrcmd:

In order to issue diagnostic commands to a process, you must run jrcmd with the same user as the one running the Java process.

 How to Read Thread Dumps

29156:

// The thread dump starts with the date and time of the dump, and the version number of the JRockit JVM used

===== FULL THREAD DUMP ===============
Thu Sep  4 16:10:17 2014
Oracle JRockit(R) R28.2.5-20-152429-1.6.0_37-20120927-1915-linux-x86_64


//There is a thread information line, followed by information about locks and a trace of the thread’s stack at the moment of the thread dump.

// The main thread is running thread (alive), its either in executing JVM internal code and is currently waiting for an object to be released (waiting). Virtually, all the threads in thread dump will be alive.

"Main Thread" id=1 idx=0x4 tid=29157 prio=5 alive, waiting, native_blocked
    -- Waiting for notification on: weblogic/t3/srvr/T3Srvr@0x127aeec50[fat lock]
    at jrockit/vm/Threads.waitForNotifySignal(JLjava/lang/Object;)Z(Native Method)
    at java/lang/Object.wait(J)V(Native Method)
    at java/lang/Object.wait(Object.java:485)
    at weblogic/t3/srvr/T3Srvr.waitForDeath(T3Srvr.java:981)
    ^-- Lock released while waiting: weblogic/t3/srvr/T3Srvr@0x127aeec50[fat lock]
    at weblogic/t3/srvr/T3Srvr.run(T3Srvr.java:490)
    at weblogic/Server.main(Server.java:71)
    at jrockit/vm/RNI.c2java(JJJJJ)V(Native Method)
    -- end of trace

// JVM Internal threads. All these threads are daemon.          
           
"(Signal Handler)" id=2 idx=0x8 tid=29158 prio=5 alive, native_blocked, daemon

"(OC Main Thread)" id=3 idx=0xc tid=29159 prio=5 alive, native_waiting, daemon

"(GC Worker Thread 1)" id=? idx=0x10 tid=29160 prio=5 alive, daemon

"(GC Worker Thread 2)" id=? idx=0x14 tid=29161 prio=5 alive, daemon

"(GC Worker Thread 3)" id=? idx=0x18 tid=29162 prio=5 alive, daemon

Note: By default, the stack trace is not printed for JVM Internal threads.

Types of Lock

There are four types of Locks;

Fat Lock: A fat lock is a lock with history of contention (several threads try to take the lock simulatenously)

Thin Lock: A thin lock is a lock that doesn’t have any contention.

Recursive Lock: A recursive lock is when a thread takes several locks on an object without releasing it.

Lazy Lock: A Lazy Lock is a lock that’s not released when a critical section is exited.

Lock Chains:

Thread A and B form a chain when thread A holds lock on an object on which thread B is trying to take the lock.




OIM –OIA Integration Loggers

Please set the below loggers in OIM & OIA to troubleshoot any integration issue:

OIM

Logger Name
Logger Level
XELLERATE.SERVER
TRACE:32
XELLERATE.PREPAREDSTATEMENT
TRACE:32
XELLERATE.DATABASE'
TRACE:32
XELLERATE.SCHEDULER.TASK
TRACE:32

Note: Please use the /em console to enable the logging. No need to restart OIM after enabling the logging.

OIA

Logger Name
Logger Level
com.vaau.rbacx.iam
DEBUG
com.vaau.rbacx.iam.db.DBIAMSolution
DEBUG
com.vaau.rbacx.iam.db.dao.ibatis
DEBUG
com.vaau.rbacx.iam.util.oracle.oimapi
DEBUG
com.vaau.rbacx.scheduling.executor.iam.IAMJobExecutor
DEBUG


Note:  Make this change on each server and restart OIA.

Enterprise Manager (EM) throws with java.lang.NullPointerException after clicking oim(11.1.2.0.0)


if you launch Enterprise Manager (EM) & click on "Identity and Access" -> OIM -> oim(11.1.2.0.0) and see the following error occur:
ERROR

-----------------------

java.lang.NullPointerException at  oracle.sysman.emas.model.iam.oim.OIMHomeModel.fetchEventsHandlerData(OIMHomeModel.java:166) at oracle.sysman.emas.model.iam.oim.OIMHomeModel.initializeData(OIMHomeModel.java:86) at oracle.sysman.core.model.util.ModelUtil$EMObjectResetter.initOrResetEMObject(ModelUtil.java:319)


then, download and apply  patch 17375780 for Enterprise Manager (EM) 11.1.1.6.0

OIM11gR2 : Common Bulk Load Issues

Based on my experience with OIM Bulk Load Utility, below are the common issues/error one might encounter and how to solve/fix them:
 
Bulk Load Utility Does Not Handle Account Load With Employee Number In Recon Rule
 
When running the account data bulk load for one of the resource which has reconciliation rule based on Employee Number, the load failed with the following error
 
Exception in thread "main" java.sql.SQLException: ORA-00904: "null": invalid identifier
ORA-06512: at "DEV_OIM.OIM_BLKLD_PKG_ACCOUNT_LOAD", line 1562
ORA-06512: at line 1
  at oracle.jdbc.driver.SQLStateMapping.newSQLException(SQLStateMapping.java:74)
  at oracle.jdbc.driver.DatabaseError.newSQLException(DatabaseError.java:131)
  at oracle.jdbc.driver.DatabaseError.throwSqlException(DatabaseError.java:204)
  at oracle.jdbc.driver.T4CTTIoer.processError(T4CTTIoer.java:455)

  ......
 
Solution:
 
This is a known  Bug# 17357095 and is fixed in OIM 11g R2 PS1 BP07 as per oracle. However, what i noticed that in some of the environment, the issue got resolved after applying patch and in some environment, the issue persists even after applying patch. So, as a workaround, I added the UserID/Login field was added in the Process Form, Resource Object and reconciliation rule was build using the UserID/Login. The field User ID was set with property Visible as false. Also, while generating the input account data file, I make sure that it contains use the UserID/Login field.
 
Bulk Load Utility throwing Null Pointer Exception while Trying To Load Account Data
 
When trying to bulk load account data with privileges and roles, having the following error after inputting the table space name to be used for creating temp tables :
 
Exception in thread "main" java.lang.NullPointerException
at bulkload.AccountLoad.createTmpTableNames(AccountLoad.java:857)
at bulkload.AccountLoad.inputCSV(AccountLoad.java:502)
at bulkload.AccountLoad.showSubMenu(AccountLoad.java:138)
at bulkload.AccountLoad.main(AccountLoad.java:1160)
Don't see any other error in the log file, and the utility just stops.
 
Solution:
 
The issue is encountered when the column in the input file doesn’t start with UD_ prefix.  For example, the file with below header will see this issue. So, review your file header and fix the column name and retry the bulk load.
 
Bulk Load Of Account Data When Child Tables Need Not Be Populated
 
While using OIM Bulk Load utility for Loading Account Data( For examplefor OID User (UD_OID_USR) resource which doesn’t have any data in the child table UD_OID_GRP), specifying an input file for just the parent table does not work. The oim bulk loader forces the user to pass file names for the child tables as well. Output from the bulk loader is as below:
 
**********************************
Select the input for account load:
**********************************
1) DB Table
2) CSV File
3) Exit
Enter your option (1, 2 or 3):
2
 
Enter the resource object name:
OID User
 
Enter the comma separated CSV file names (parent CSV followed by child CSVs):
UD_OID_USR.csv
 
ERROR ==> The number of CSV files provided as input does not match with the number of account tables.

Exiting Utility ....

 
Solution:
 
Even if there is no data in the child table, you have to create files for both the parent & child tables and specify them during the bulk load utility.
 
Bulk Load Utility throwing ORA-01502 index or partition of such index is in unusable state
 
While loading the user/account data in OIM using bulk load utility, below error is encountered:
 
Exception in thread "main" java.sql.SQLException: ORA-01502: index 'HA_OIM.IDX_OIU_ORC_KEY' or partition of such index is in unusable state
ORA-06512: at "HA_OIM.OIM_SP_MANAGEENTITLEMENT", line 81
ORA-06512: at "HA_OIM.UD_PSHCM_R_ENT_TRG", line 4
ORA-04088: error during execution of trigger 'HA_OIM.UD_PSHCM_R_ENT_TRG'
ORA-06512: at "HA_OIM.OIM_BLKLD_PKG_ACCOUNT_LOAD", line 1847
ORA-06512: at line 1
 
Solution: 
 
Bulk Load Utility tries to access an index or index partition i.e., 'HA_OIM.IDX_OIU_ORC_KEY' that has been marked unusable.
 
DROP the specified index, or REBUILD the specified index, or REBUILD the unusable index partition. Here are the queries DBA have been you using to do this:
Procedure to verify and Rebuild indexes:
 
1. Verify Indexes :
select * from dba_indexes  WHERE   status <> 'VALID' and owner in (‘HA_OIM’);
 
2. Create script to rebuild indexes online:
Spool rebuild_index.sql
SELECT 'alter index '||owner||'.'||index_name||'  rebuild online ;'  FROM DBA_INDEXES WHERE  owner='HA_OIM' and status <> 'VALID' ;
Spool off;
 
3. Rebuild indexes:
Start  rebuild_index.sql
Index rebuild for OIU Table:
 
• alter index HA_OIM.IDX_OIU_ORC_KEY REBUILD ONLINE ;
• alter index HA_OIM.IDX_OIU_USR_KEY REBUILD ONLINE ;
• alter index  HA_OIM.IDX_OIU_OBI_KEY REBUILD ONLINE ;
• alter index  HA_OIM.IDX_OIU_OST_KEY REBUILD ONLINE ;
• alter index  HA_OIM.IDX_OIU_APP_INSTANCE_KEY REBUILD ONLINE ;
• alter index  HA_OIM.FDX_OIU_ACCOUNT_TYPE REBUILD ONLINE ;
• alter index  HA_OIM.IDX_OIU_REQ_KEY REBUILD ONLINE ;
• alter index HA_OIM.IDX_USG_USR_KEY rebuild online ;
• alter index HA_OIM.IDX_USG_UGP_KEY_USG_PRIORITY rebuild online ;
 
Creating Indexes Online:
 
CREATE INDEX HA_OIM.IDX_OIU_ORC_KEY ON HA_OIM.OIU
(ORC_KEY)
LOGGING
TABLESPACE HA_OIM
PCTFREE    10
INITRANS   2
MAXTRANS   255
STORAGE    (
            INITIAL          64K
            NEXT             1M
            MINEXTENTS       1
            MAXEXTENTS       UNLIMITED
            PCTINCREASE      0
            BUFFER_POOL      DEFAULT
            FLASH_CACHE      DEFAULT
            CELL_FLASH_CACHE DEFAULT
           )
NOPARALLEL online;
Note: I faced this issue only in production environment and it seems to be coming for every bulk load operation I did. I also noticed this issue I try to rename the logs folder before the bulk load utility complete all its operation, I mean enabling and re-building indexes.
 
Addendum on this issue:
 
ORA-08104: this index object HA_OIM.IDX_OIU_ORC_KEY is being online built or rebuilt
 
Due to missing index on ORC_KEY, the below sql statement was causing performance issue on the data load operation:
 
SELECT OST.OST_KEY, OIU.OIU_KEY, OIU.USR_KEY
  FROM OST OST, OIU OIU
WHERE OIU.OST_KEY = OST.OST_KEY AND OIU.ORC_KEY = :B1
 
After the data load got complete for one of the resource, DBA ran the dbms_repair.online_index_clean function.
 
 
 
 
 
 
 


 

Tuesday, September 23, 2014

OIM11gR1: Query to find who has assigned what role to which user

You can use below query to find who has assigned what role to which user on what date:

select
extractvalue(upa_xml.deltas,'/Changes/Change/Attribute[@name=''Groups.Group Name'']/NewValue') AS "Role Assigned",
usr.usr_login "Assigned To",
extractvalue(upa_xml.deltas,'/Changes/Change/Attribute[@name=''Groups-Users.Created By Login'']/NewValue') AS "Assigned By",
extractvalue(upa_xml.deltas,'/Changes/Change/Attribute[@name=''Groups-Users.Membership Type'']/NewValue') AS "Membership Type",
extractvalue(upa_xml.deltas,'/Changes/Change/Attribute[@name=''Groups-Users.Creation Date'']/NewValue') AS "Assigned On"
from upa,(SELECT upa_key, xmltype(deltas) deltas FROM upa) upa_xml,usr where upa.upa_key = upa_xml.upa_key and usr.usr_key=upa.usr_key and
SRC LIKE '%CREATE.RoleUser%';


In 11gR2, the usg table contains the field usg_prov_by which contains the usr_key of the user who has assigned the role. You can use the below query:

select ugp_name as "Assigned Role", usr_login as "Assigned To", usg.usg_prov_by as "Assigned By" from usr,ugp,usg
where usr.usr_key=usg.usr_key and ugp.ugp_key=usg.ugp_key and ugp.ugp_name NOT IN ('ALL USERS','SYSTEM ADMINISTRATORS');