Review and complete these required tasks that are specified for your environment after you complete your upgrade.
You must complete these postupgrade tasks after you upgrade Oracle Database.
Setting Environment Variables on Linux and Unix Systems After Manual Upgrades
Check that required operating system environment variables point to the directories of the new Oracle Database release.
Typically, operating system environment variables are set in profiles and shell scripts. Confirm that the following Oracle user environment variables point to the directories of the new Oracle home:
Check PL/SQL Packages and Dependent Procedures
It is possible that packages that you installed in the earlier release Oracle Database are not available in the new release, which can affect applications.
After the upgrade, if you use AutoUpgrade, review the AutoUpgrade report on invalid objects. If you use a replay upgrade, then check to ensure that any packages that you may have used in your own scripts, or that you call from your scripts, are available in the new release. Testing procedures dependent on packages should be part of your upgrade plan.
Code in database applications can reference objects in the connected database. For example, Oracle Call Interface (OCI) and precompiler applications can submit anonymous PL/SQL blocks. Triggers in Oracle Forms applications can reference a schema object. Such applications are dependent on the schema objects they reference. Dependency management techniques vary, depending on the development environment. Oracle Database does not automatically track application dependencies.
Configuring the FTP and HTTP Ports and HTTP Authentication for Oracle XML DB
Oracle Database Configuration Assistant (DBCA) does not configure ports for Oracle XML DB on Oracle Database 12c and later releases. Upgrades use digest authentication.
Oracle recommends that when you configure ports, you also configure the authentication for HTTP for accessing Oracle XML DB Repository to take advantage of improved security features.
Starting with Oracle Database 12c, Oracle enhanced database security by supporting digest authentication. Digest authentication is an industry-standard protocol that is commonly used with the HTTP protocol. It is supported by most HTTP clients. Digest authentication ensures that passwords are always transmitted in a secure manner, even when an encrypted (HTTPS) connection is not in use. Support for digest authentication enables organizations to deploy applications that use Oracle XML DB HTTP, without having to worry about passwords being compromised. Digest authentication support in Oracle XML DB also ensures that the Oracle XML DB HTTP server remains compatible with Microsoft Web Folders WebDAV clients.
After installing or upgrading for the new release, you must manually configure the FTP and HTTP ports for Oracle XML DB as follows:
DBMS_XDB_CONFIG.setHTTPPort(HTTP_port_number)to set the HTTP port for Oracle XML DB:
SQL> exec DBMS_XDB_CONFIG.setHTTPPort(port_number);
DBMS_XDB_CONFIG.setFTPPort(FTP_port_number)to set the FTP port for Oracle XML DB:
SQL> exec DBMS_XDB_CONFIG.setFTPPort(FTP_port_number);
You can query the port numbers to use for FTP and HTTP in the procedure by using
To see all the used port numbers, query
Install Oracle Text Supplied Knowledge Bases After Upgrading Oracle Database
After an Oracle Database upgrade, all user extensions to the Oracle Text supplied knowledge bases must be regenerated.
Regenerating the user extensions affect all databases installed in the given Oracle home.
After an upgrade, the Oracle Text-supplied knowledge bases that are part of the companion products for the new Oracle Database are not immediately available. Any Oracle Text features dependent on the supplied knowledge bases that were available before the upgrade do not function after the upgrade. To re-enable such features, you must install the Oracle Text supplied knowledge bases from the installation media for the new Oracle Database release.
Replace the DEMO Directory in Read-Only Oracle Homes
After upgrading Read-Only Oracle homes, make a copy of the earlier release Oracle Database
demo directory, and replace the
demo directory in the Read-Only Oracle home with the new release
Oracle Database 18c and later releases contain a product demonstration directory in the file path
Oracle_home/rdbms/demo. These directories include examples and product demonstrations that are specific to the options and features for each Oracle Database release, some of which you can add to after upgrade by installing Oracle Database Examples. In your earlier release, if you downloaded and worked with the earlier release demonstration files, then you have two problems: you want to save your earlier release work for review and testing with the new release, and you want to obtain refreshes of the demonstrations that are specific to the new release.
After upgrading the Oracle home, and downloading and doing any other work you want to do with the new demonstration files, you can then refresh your old demonstration files.
Example 4-1 Copying the Earlier Release Demo Directory and Refreshing the Demonstrations in the Read-Only Oracle Home
After the upgrade, use this procedure to save any work in your earlier
demo directory in the Read-Only Oracle home, and and replace the earlier release
demo directory with the new release
Log in as the Oracle software owner user (
Check if the
rdbms/demodirectory is copied to the Read Only Oracle home.
In this example, the environment variable
ORACLE_BASE_HOMEis defined as the path to the Read-Only Oracle home.
Linux and Unix platforms:
$ ls -l -d $ORACLE_BASE_HOME/rdbms/demo /u01/app/oracle/product/19.0.0/dbhome_1/rdbms/demo
Microsoft Windows platforms
ls -l -d %ORACLE_BASE_HOME%\rdbms\demo %ORACLE_BASE_HOME%\rdbms\demo
Change directory to the Read-Only Oracle home, and make a copy, where
demo.old_release18is the name you give to your earlier release demonstration files:
cd $ORACLE_BASE_HOME/rdbms mv demo demo.old_release18
Copy the new
demodirectory from the upgraded Oracle home to the Read-Only Oracle home.
In this example, the environment variable ORACLE_HOME is defined as the new release Oracle home.
Linux and Unix:
cp -r $ORACLE_HOME/rdbms/demo demo
xcopy c:\%ORACLE_HOME%\rdbms\demo c:%ORACLE_BASE_HOME%\rdbms\demo /E
Configure Access Control Lists (ACLs) to External Network Services
Oracle Database 12c and later releases include fine-grained access control to the
If you have applications that use these packages, then after upgrading Oracle Database you must configure network access control lists (ACLs) in the database before the affected packages can work as they did in earlier releases. Without the ACLs, your applications can fail with the error "ORA-24247: network access denied by access control list (ACL)."
Oracle Database Security Guide for more complicated situations, such as connecting some users to host A and other users to host B
Enabling Oracle Database Vault After Upgrading Oracle Database
Depending on your target database release, you can be required to reenable Oracle Database Vault, or revoke Oracle Database Vault role granted for upgrade.
Upgrading Oracle Database Without Disabling Oracle Database Vault
To upgrade to Oracle Database 21c or later releases, either grant the
DV_PATCH_ADMIN role to
SYS commonly in the root
container, and revoke after the upgrade, or disable Oracle Database Vault and reenable it
If Oracle Database Vault is enabled and you are upgrading an entire CDB, then use one of the following methods:
- CDB upgrade method 1: Temporarily grant the
SYScommonly by logging into the root container as a common user with the
DV_OWNERrole, and then issuing the
GRANT DV_PATCH_ADMIN TO SYS CONTAINER=ALLstatement. Oracle Database Vault controls will be in the same state as it was before the upgrade. When the upgrade is complete, log into the root container as the
DV_OWNERuser, and revoke the
SYSby issuing the
REVOKE DV_PATCH_ADMIN FROM SYS CONTAINER=ALLstatement.
- CDB upgrade method 2: Log into each container as a user who has the
DV_OWNERrole, and then execute the
DBMS_MACADM.DISABLE_DVprocedure. You must first disable the PDBs (in any order) and then after that, disable the root container last. If you are upgrading only one PDB, then you can disable Oracle Database Vault in that PDB only. After you have completed the upgrade, you can enable Oracle Database Vault by logging into each container as the
DV_OWNERuser and then executing the
DVSYS.DBMS_MACADM.ENABLE_DVprocedure. The order of enabling Oracle Database Vault must be the root container first and PDBs afterward. You can enable the PDBs in any order, but the root container must be enabled first.
If you manually disable Oracle Database Vault before the upgrade, then you must enable Oracle Database Vault manually after the upgrade.
If you did not have Oracle Database Vault enabled before the upgrade, then you can enable it manually after the upgrade.
Enable Oracle Database Vault in the upgraded database by using the procedure
dvsys.dbms_macadm.enable_dv(). Run this procedure with a user account that is granted
DV_OWNER. After you run the procedure, restart the database instance so that the procedure takes effect.
Postupgrade Scenarios with Oracle Database Vault
Postupgrade tasks for Oracle Database Vault change, depending on your target Oracle Database release, and the option you chose to prepare for upgrade.
Upgrades to Oracle Database 21c and Later
You must choose one of the following options:
- Grant the
- Disable Oracle Database Vault before upgrade.
If you granted the
DV_PATCH_ADMIN role to
SYS before the upgrade, then revoke the
DV_PATCH_ADMIN role from
SYS after the
upgrade. If you disabled Oracle Database Vault, then reenable it after the upgrade
Upgrades to Oracle Database 18c and 19c
You do not need to disable Oracle Database Vault.
For all upgrades, after the upgrade is complete, Oracle Database Vault has the same enforcement status that was in place for your source database before the upgrade.
Check for the SQLNET.ALLOWED_LOGON_VERSION Parameter Behavior
Connections to Oracle Database from clients earlier than release 10g fail with the error
ORA-28040: No matching authentication protocol.
Starting with Oracle Database 18c, the default value for the
SQLNET.ALLOWED_LOGON_VERSION parameter changed from 11 in Oracle Database 12c (12.2) to 12 in Oracle Database 18c and later releases. The use of this parameter is deprecated.
SQLNET.ALLOWED_LOGON_VERSION is now replaced with the
SQLNET.ALLOWED_LOGON_VERSION_CLIENT parameters. If you have not explicitly set the
SQLNET.ALLOWED_LOGON_VERSION_SERVER parameter in the upgraded database, then connections from clients earlier than release 10g fail with the error
ORA-28040: No matching authentication protocol. For better security, check the password verifiers of your database users, and then configure the database to use the correct password verifier by setting the
If you have password-protected roles (secure roles) in your existing database, and if you upgrade to Oracle Database 18c and later releases with the default
SQLNET.ALLOWED_LOGON_VERSION_SERVER setting of 12, because those secure roles only have release 10g verifiers, then the password for each secure role must be reset by the administrator so that the secure roles can remain usable after the upgrade.
Oracle Database Security Guide for information about ensuring against password security threats
Oracle Database Security GuideOracle Database Security Guide for information about setting the password versions of users