General Known issues in OCI GoldenGate

Learn about general known issues that apply to the entire service and how to work around them.

After upgrading to Oracle GoldenGate 23.26.x, deployment console access may encounter 502 Bad Gateway error or fail to list GoldenGate processes after login

Oracle Cloud Infrastructure GoldenGate 23.26 deployments may become unhealthy after upgrading from earlier labels to version 23.26.x, or after performing a stop/start operation on a 23.26.x deployment.

Workaround: Upgrade impacted Oracle deployments to label oggoracle:23.26.1.0.0_260331, to fix this issue.

For Big Data and other non-Oracle labels, a fix will be announced shortly. Contact Support for the interim manual mitigation to prevent impact.

AdminClient: Issue with info profile command

Using the info profile command in AdminClient returns error 302.

Workaround: Use the following REST API command:

GET https://<deployment URL>/services/adminsrvr/v2/config/types/ogg:managedProcessSettings/values/ogg:managedProcessSettings:Default

Distribution and Receiver Paths may fail after 21.x deployments upgraded to 21.17

Beginning with Oracle GoldenGate versions 21.17 and 26ai, Paths use the default reserved domain name, “Network,” so existing Paths that use any other domain name fail with the following error reported:

ERROR\| Exception Message: The network connection could not be established: 'OGG-10351' - 'Generic error -1 noticed. Error description - credential store alias not found in domain.'

Workaround: In the OCI GoldenGate deployment console, edit each Path and change the domain name to “Network,” and then restart the Path. To verify, check the domain of the Path auth user in the Credential store section of the Configuration page.

If you prefer to use Admin Client, run the following commands to update the domain name. Ensure that you replace the <path_name> and <alias> placeholders:

For source-initiated paths:

ALTER DISTPATH <path_name> TARGET AUTHENTICATION USERIDALIAS <alias> domain
    Network

For target-initiated paths:

ALTER RECVPATH <path_name> SOURCE AUTHENTICATION USERIDALIAS <alias> domain
    Network

Issues upgrading to Oracle GoldenGate 21.17 for Big Data

Users upgrading from Oracle GoldenGate versions 21.14, 21.15, or 21.16 for Big Data to version 21.17 with truststore and/or keystore connection properties configured are failing with the following errors reported:

Caused by: oracle.goldengate.util.GGException: An exception occurred when creating the Kafka Producer object.
Caused by: org.apache.kafka.common.KafkaException: Failed to construct kafka producer
Caused by: org.apache.kafka.common.KafkaException: Failed to load SSL  keystore /u02/connections/<connection OCID>/trustStore of type JKS
Caused by: java.io.IOException: keystore password was incorrect

Workaround:

1. Convert the JKS truststore and keystore to PKCS12.

   1. For the keystore, it should prompt for a password. Keytool is a utility in the JDK.

      keytool -importkeystore -srckeystore [MY_KEYSTORE.jks] -destkeystore [MY_KEYSTORE.p12] -srcstoretype JKS -deststoretype PKCS12 -deststorepass [PASSWORD_PKCS12]

   2. For truststore, it should prompt for a password.

      keytool -importkeystore -srckeystore [MY_TRUSTSTORE.jks] -destkeystore [MY_TRUSTSTORE.p12] -srcstoretype JKS -deststoretype PKCS12 -deststorepass [PASSWORD_PKCS12]

2. In the Kafka producer properties file, set the following:

   ssl.truststore.type=PKCS12
   ssl.keystore.type=PKCS12

Issues during rollback from 21.15 or 23.x builds to 21.14

When attempting to rollback a 21.15 or 23.x build to one of the following builds:

• Oracle (21.14.0.0.0_240525)

• Big Data (21.14.0.0.0_240515)

• MySQL (21.14.0.0.0_240404)

• MSSQL (21.14.0.0.0_240404)

You may encounter one of the following issues:

• Missing Connections/Credentials issue due to new wallet encryption feature introduced 21.15 onwards.

  Workaround: You must unassign and reassign existing connections to the deployment and recreate missing users required for any Distribution or Receiver paths in use.

• Service Manager fails to start due to an issue with Performance Metrics Service in rollbacks from 23.x to 21.14. Contact Oracle Support if you encounter this issue.

• Oracle GoldenGate processes fail with the error, “OGG-02431 Invalid record header found in checkpoint file.”

  Workaround: Upgrade the deployment to the latest 21.14 build available in the series. Contact Oracle Support if the issue persists.

Invalid redirect url error when trying to access an IAM-enabled deployment using an IP

When attempting to access an IAM-enabled deployment using the deployment’s IP address, you encounter the following error:

{"error":"invalid_redirect_uri","error_description":"Client
        xxxxxxxx1ocioraclecloudcom_APPID requested an invalid redirect URL: https://192.x.x.x/services/adminsrvr/v2/authorization. ECID:
        xxxx"}

Workaround: You can do one of the following:

Option 1: Add the deployment IP address to your Identity Domain Application. To make this change, you must be part of the user group assigned to the application.

1. In the Oracle Cloud navigation menu, select Identity & Security, then under Identity, select Domains.

2. Select your domain from the Domains list.

3. From the domain's Identity Domain resource menu, select Oracle Cloud Services.

4. Select your application from the Oracle Cloud Services list. For example, GGS INFRA Application for Deployment Id:<deployment OCID>.

5. On the application page under OAuth configuration, select Edit OAuth configuration.

6. For Redirect URL, enter the deployment's Console URL with the deployment's IP in place of the domain. For example: https://<deployment-ip>/services/adminsrvr/v2/authorization.

7. Save your changes.

Option 2: Add an entry in your client hosts file to map 127.0.0.1 to your deployment FQDN (replace <region> with the appropriate region). For example:

127.0.0.1 xx.deployment.goldengate.<region>.oci.oraclecloud.com

Unable to update custom certificates on IAM deployments

The service prohibits updates to the FQDN as it impacts cross region access and requires updates to IAM resources in the target region.

Workaround: To work around this issue, create a new deployment to use the updated FQDN.

Oracle GoldenGate REST APIs return 302 redirects to an index page

You can use the GoldenGate REST APIs to manage your OCI GoldenGate deployments. For those familiar with Oracle GoldenGate, note that the Service Manager is not exposed in OCI GoldenGate and any calls made to Service Manager won’t be able to return.

AdminClient: Unable to negotiate: no matching host key type found

When you use AdminClient in Cloud Shell to connect to your deployment, you may encounter the following message:

FIPS mode initialized.
Unable to negotiate with <ip-address> port 22: no matching host key type found. Their offer: ssh-ed25519
Action completed. Waiting until the work request has entered state: ('SUCCEEDED',)
FIPS mode initialized.
Unable to negotiate with <ip-address> port 22: no matching host key type found. Their offer: ssh-ed25519
Cannot create ssh tunnelnel

Workaround: Complete the following steps:

1. Open a new Cloud Shell session.

2. Create a file using the following command:

   cat .ssh/config

3. Enter the following into the .ssh/config file, and then save it:

   HostkeyAlgorithms ssh-rsa,ssh-ed25519
   PubkeyAcceptedKeyTypes ssh-ed25519,ssh-rsa

4. If there's an existing .ssh/known_hosts file, delete it.

5. Close the Cloud Shell session.

6. Select Launch Admin Client on your deployment details page.