WARNING: This web is not used anymore. Please use PDBService.CpuJanuary06 instead!
 

Oracle CPU patch January 2006 installation instructions

This Wiki page has the scope of documenting the installation steps for the Oracle security patch CPUJAN2006 for the database servers at PSS.

Database Oracle Homes needs to be patched (all versions) as documented in Metalink's Note 343382.1 . A third-party link with a description of the vulnerabilities: http://www.red-database-security.com/advisory/oracle_cpu_jan_2006.html

The following Oracle home types are not affected by this CPU patched:

  • Oracle CRS
  • Oracle Agent
  • Oracle Client (there are 3 vulnerabilities for Oracle clients, but not relevant for our environment)
Note: Since Jan 20th the patchinstallation guide reports that CPU Jan06 patch is rolling installable for 10.1.0.4 and 10.2.0.1. The instructions here below refer to the previous indication were the patch was marked as non-rolling installable. Minor changes are needed for the rolling installation procedure.

Additional configurations steps are documented below. These steps require instance shutdown and therefore have been 'queued in' this maintenance window for CPUJAN06.

Patching schedule and DB List: ScheduleCPUJan2006

RAC 10gR1 (10.1.0.4)

Note: These are pre-install steps that should be done just before the maintenance window starts

  • If you want to copy-paste commands from this manual set properly the following environment variables (on both nodes):
         export RAC_DB_NAME=<name_of_the_database> (e.g. int2r)
         export RAC_INST_1=<first_RAC_instance>    (e.g. int2r1)
         export RAC_INST_2=<second_RAC_instance>   (e.g. int2r2)
         export RAC_NODE_1=<first_RAC_node>        (e.g. itrac05)
         export RAC_NODE_2=<second_RAC_node>       (e.g. itrac06)
       

  • Copy the patch to all cluster nodes:
         cd $HOME/oracle_binaries
         scp oracle@itrac05:~/oracle_binaries/p4751928_10104_LINUX.zip .
         $ORACLE_HOME/bin/unzip ./p4751928_10104_LINUX.zip
       

  • Copy the new version of OPatch to all cluster nodes and use it to replace the old OPatch:
         scp oracle@itrac05:~/oracle_binaries/p2617419_10102_GENERIC.zip .
    
         $ORACLE_HOME/bin/unzip ./p2617419_10102_GENERIC.zip 
         cd $ORACLE_HOME
         tar cvvf OPatch.tar OPatch
         rm -rf OPatch
         mv $HOME/oracle_binaries/OPatch .
         $ORACLE_HOME/OPatch/opatch lsinventory
       
    Note: command above should complete successfully and it should show that OPatch version 10.0.0.0.54 is being used.

Additional configuration steps

  • From one of the cluster nodes connect to the database and change value of the CLUSTER_DATABASE_INSTANCES parameter:
         sqlsys_DB
         SQL> ALTER SYSTEM SET CLUSTER_DATABASE_INSTANCES=4 SCOPE=spfile SID='*';
         SQL> exit
    
         sqlsys_ASM
         SQL> ALTER SYSTEM SET CLUSTER_DATABASE_INSTANCES=4 SCOPE=spfile SID='*';
         SQL> exit
       

  • Change the audit_file_destination to the /ORA/dbs00 filesystem:
         mkdir /ORA/dbs00/oracle/admin/$RAC_DB_NAME/adump
        (REPEAT for both RAC nodes)
    
         sqlsys_DB
         SQL> ALTER SYSTEM SET audit_file_dest='/ORA/dbs00/oracle/admin/EDIT_THIS_PART/adump' SCOPE=spfile SID='*';
         SQL> exit
         NOTE: change audit_file_dest only for the db instance, NOT the asm instance
         

  • Configure the dump directories to use the correct filesystem (/ORA/dbs00) when not already so. (Check the DB and the ASM instances).

Sample code:

  mkdir /ORA/dbs00/oracle/admin/DBNAMEHERE/bdump
  alter system set background_dump_dest='/ORA/dbs00/oracle/admin/DBNAMEHERE/bdump' scope=spfile;
  mv /ORA/dbs01/oracle/admin/DBNAMEHERE/bdump /ORA/dbs01/oracle/admin/DBNAMEHERE/OLD_bdump

  mkdir /ORA/dbs00/oracle/admin/DBNAMEHERE/udump
  alter system set user_dump_dest='/ORA/dbs00/oracle/admin/DBNAMEHERE/udump' scope=spfile;
  mv /ORA/dbs01/oracle/admin/DBNAMEHERE/udump /ORA/dbs01/oracle/admin/DBNAMEHERE/OLD_udump

  mkdir /ORA/dbs00/oracle/admin/DBNAMEHERE/cdump
  alter system set core_dump_dest='/ORA/dbs00/oracle/admin/DBNAMEHERE/cdump' scope=spfile;
  mv /ORA/dbs01/oracle/admin/DBNAMEHERE/cdump /ORA/dbs01/oracle/admin/DBNAMEHERE/OLD_cdump

  mkdir /ORA/dbs00/oracle/admin/DBNAMEHERE/adump
  alter system set audit_file_dest='/ORA/dbs00/oracle/admin/DBNAMEHERE/adump' scope=spfile;
  mv /ORA/dbs01/oracle/admin/DBNAMEHERE/adump /ORA/dbs01/oracle/admin/DBNAMEHERE/OLD_adump

 Note 1: Similar settings for the ASM instance (audit_file_dest ONLY on the DB instance)
 Note 2: Directory and filesystem changes have to be applied to all RAC nodes

  

  • ASM instance memory allocation
         sqlsys_ASM
         SQL> alter system set shared_pool_size=64m scope=spfile sid='*';
         SQL> alter system set large_pool_size=40m scope=spfile sid='*';
         SQL> exit
       

  • ASM instance memory (other option, as they are dynamic). From each instance:
         sqlsys_ASM
         SQL> alter system set shared_pool_size=64m scope=both sid='+ASM1';
         SQL> alter system set large_pool_size=40m scope=both sid='+ASM1';
         SQL> exit
    
       

  • ATLAS ONLY: set the service_names parameter to null (it's supposed to be handled dynamically by CRS):
         sqlsys_DB
         SQL> alter system reset service_names scope=spfile sid='*';
         SQL> exit
       

NOTE: Service downtime starts here

  • From one of the cluster nodes shutdown the database, ASM instances and node applications:
         srvctl stop database -d $RAC_DB_NAME
         srvctl stop asm -n $RAC_NODE_1
         srvctl stop asm -n $RAC_NODE_2
         srvctl stop nodeapps -n $RAC_NODE_1
         srvctl stop nodeapps -n $RAC_NODE_2
       

  • Check whether everything is really stopped:
         crsstat.sh
       

  • Go to each node of the cluster and apply the patch:
         cd $HOME/oracle_binaries/4751928
         $ORACLE_HOME/OPatch/opatch apply -local
       
    (Note a message asking to rollback Patch 4567866 will appear, answer Y)

  • Once the OPatch succeeds on both nodes startup node aplications, ASM instance and DB instance on one of the cluster nodes and from this node execute patch post-installation steps:
         srvctl start nodeapps -n $RAC_NODE_1
         srvctl start asm -n $RAC_NODE_1
         srvctl start instance -d $RAC_DB_NAME -i $RAC_INST_1
    
         crsstat.sh
    
         cd $ORACLE_HOME/cpu/CPUJan2006
         sqlsys_DB
         SQL> select count(*) from dba_objects where status='INVALID';
         SQL> @catcpu.sql
         SQL> @?/rdbms/admin/utlrp.sql
         SQL> select count(*) from dba_objects where status='INVALID';
         SQL> exit
       

  • Review the log created in the $ORACLE_HOME/cpu/CPUJan2006 directory

  • Startup the rest of the RAC:
         srvctl start nodeapps -n $RAC_NODE_2
         srvctl start asm -n $RAC_NODE_2
         srvctl start instance -d $RAC_DB_NAME -i $RAC_INST_2
    
         crsstat.sh
    
         srvctl start service -d $RAC_DB_NAME
    
         crsstat.sh
       

RAC 10gR2 addendum (10.2.0.1)

Same patch installation instructions as for 10gR1 apply here with the additions:

  • the patchset is rolling (tested successfully, but only on a test DB with no users)
  • 10.2.0.1-specific binaries are required both for the patchset and the opatch utility (see metalink for details)
    • CPUpatch: 4751931 (version from 20th Jan)
    • Opatch version: 10.2.0.1.1

Note: on January 20th Oracle released a 2nd version of this patch. Oracle homes patched with the previous version need to be repatched.

10g (10.1.0.4)

Note: These are pre-install steps that should be done just before the maintenance window starts

  • Make sure you have Perl 5.00503 (or later)
       perl -v
       

  • You must use OPatch version 1.0.0.0.54 or later.

Check the current version:

   $ORACLE_HOME/OPatch/opatch version
   

If not, install it. To the $ORACLE_HOME directory copy the p2617419_10102_GENERIC.zip and unzip it:

   cp p2617419_10102_GENERIC.zip $ORACLE_HOME/
   mv $ORACLE_HOME/OPatch/ $ORACLE_HOME/OPatch.bak
   cd $ORACLE_HOME
   unzip p2617419_10102_GENERIC.zip
   

Check again the current version and if it works:

   $ORACLE_HOME/OPatch/opatch lsinventory
   

  • Before starting the installation check whether "java" and "jar" executables are present in your Oracle Home. In a standard Oracle installation, "java" is available in $ORACLE_HOME/jre//bin directory and "jar" is available in $ORACLE_HOME/jdk/bin directory.

   ls -l $ORACLE_HOME/jre/<JDKversion>/bin
   ls -l $ORACLE_HOME/jdk/bin
   

If you don't have a standard installation and these commands are not present, then invoke the "opatch apply" command with the -jdk flag, specifying the full path to the JDK to be used.

  • Check if the following executables must be present in the $PATH: make, ar, ld, and nm.

  • Copy the p4751928_10104_LINUX.zip file to your oracle's home directory, unzip it there and go to the 4751928 subdircetory.

   unzip p4751928_10104_LINUX.zip
   cd ~/4751928
   


NOTE: Service downtime starts here

  • Shutdown all instances and listeners associated to the ORACLE_HOME being updated:
       lsnrctl stop
       sqlplus "/ as sysdba";
       SQL>  shutdown immediate;
       SQL>  exit;
       

  • Apply the CPU:
       $ORACLE_HOME/OPatch/opatch apply
    
       If you encounter any errors, please refer to the "Known issues" section of the 343384.1 document.
       

  • Start up all database instances running out of the ORACLE_HOME being patched and run a postinstallation script.

   cd $ORACLE_HOME/cpu/CPUJan2006
   sqlplus "/ as sysdba";
   SQL> startup;
   SQL> @catcpu.sql;
   SQL> exit;
   

Examin the log file. If you encounter any errors, please refer to the "Known issues" section of the 343384.1 document.

  • If catcpu.sql reports any Invalid Objects, compile the invalid objects using the following:

   cd $ORACLE_HOME/rdbms/admin
   sqlplus "/ as sysdba";
   SQL> @utlrp.sql
   

Check again if invalid objects exist:

   SQL> select OBJECT_NAME from DBA_OBJECTS where status = 'INVALID';
   SQL> exit;
   

  • Start the listener:
       lsnrctl start
       

9i (9.2.0.7)

Note: These are pre-install steps that should be done just before the maintenance window starts

  • Make sure you have Perl 5.00503 (or later)
       perl -v
       

  • You must use OPatch version 1.0.0.0.54 or later.

Check the current version:

   $ORACLE_HOME/OPatch/opatch version
   

If not, install it. To the $ORACLE_HOME directory copy the p2617419_10102_GENERIC.zip and unzip it:

   cp p2617419_10102_GENERIC.zip $ORACLE_HOME/
   mv $ORACLE_HOME/OPatch/ $ORACLE_HOME/OPatch.bak
   cd $ORACLE_HOME
   unzip p2617419_10102_GENERIC.zip
   

Check again the current version and if it works:

   $ORACLE_HOME/OPatch/opatch lsinventory
   

  • Before starting the installation check whether "java" and "jar" executables are present in your Oracle Home. In a standard Oracle installation, "java" is available in $ORACLE_HOME/jre//bin directory and "jar" is available in $ORACLE_HOME/jdk/bin directory.

   ls -l $ORACLE_HOME/jre/<JDKversion>/bin
   ls -l $ORACLE_HOME/jdk/bin
   

If you don't have a standard installation and these commands are not present, then invoke the "opatch apply" command with the -jdk flag, specifying the full path to the JDK to be used.

  • Check if the following executables must be present in the $PATH: make, ar, ld, and nm.

  • Copy the p4751923_92070_LINUX.zip file to your oracle's home directory, unzip it there and go to the 4751923 subdircetory.

   unzip p4751923_92070_LINUX.zip
   cd ~/4751923
   


NOTE: Service downtime starts here

  • Shutdown all instances and listeners associated to the ORACLE_HOME being updated:
       lsnrctl stop
       sqlplus "/ as sysdba";
       SQL>  shutdown immediate;
       SQL>  exit;
       

  • Apply the CPU:
       $ORACLE_HOME/OPatch/opatch apply
    
       If you encounter any errors, please refer to the "Known issues" section of the 343384.1 document.
       

  • Start up all database instances running out of the ORACLE_HOME being patched and run a postinstallation script.

   cd $ORACLE_HOME/cpu/CPUJan2006
   sqlplus "/ as sysdba";
   SQL> startup;
   SQL> select OBJECT_NAME from DBA_OBJECTS where status = 'INVALID';
   SQL> @catcpu.sql;
   SQL> exit;
   

Examin the log file. If you encounter any errors, please refer to the "Known issues" section of the 343384.1 document.

  • If catcpu.sql reports any Invalid Objects, compile the invalid objects using the following:

   cd $ORACLE_HOME/rdbms/admin
   sqlplus "/ as sysdba";
   SQL> @utlrp.sql
   

Check again if invalid objects exist:

   SQL> select OBJECT_NAME from DBA_OBJECTS where status = 'INVALID';
   SQL> exit;
   

  • Start the listener:
       lsnrctl start
       

Edit | Attach | Watch | Print version | History: r16 < r15 < r14 < r13 < r12 | Backlinks | Raw View | WYSIWYG | More topic actions
Topic revision: r16 - 2006-03-01 - LucaCanali
 
    • Cern Search Icon Cern Search
    • TWiki Search Icon TWiki Search
    • Google Search Icon Google Search

    PSSGroup All webs login

This site is powered by the TWiki collaboration platform Powered by PerlCopyright & 2008-2020 by the contributing authors. All material on this collaboration platform is the property of the contributing authors.
Ideas, requests, problems regarding TWiki? Send feedback