Oracle DBSAT Compliance Standard Known Issues

The following is a list of known issues and their most common solutions for Oracle DBSAT Compliance Standard.

• In some instance Compliance score initially states 100% for all targets. There are several ways to verify that your Oracle DBSAT Compliance Standards are configured correctly:
  • Verify Run DBSAT settings:
    1. From the Targets menu, select Databases. On the Databases page, select Database Name.
    2. On the selected Database page, go to the Oracle Database drop down menu, select Configuration, then select Latest.
    3. On the Database page with Identity Latest Configuration, click on Database, select Oracle Database Security Assessment Tool (2.2.2) Configuration then select 2_Run_DBSAT. This shows the current run execution of DBSAT any errors will be listed here.

    Figure 26-5 Run DBSAT Settings

    
  • Verify DBSAT Result settings:
    1. From the Targets menu, select Databases. On the Databases page, select Database Name.
    2. On the selected database page, go to the Oracle Database drop down menu, select Configuration, then select Latest.
    3. On Database page with Identity Latest Configuration components, click on Database, select Oracle Database Security Assessment Tool (2.2.2) Configuration then select 3_Result_DBSAT. If the Source field is blank, DBSAT execution failed to generate valid results. Check the errors displayed in Run DBSAT for possible remediation.

    Figure 26-6 DBSAT Results Settings

    
• Required Data Available shows No even though a report was successfully generated. There are situations where the DBSAT script runs and creates the expected data and report, but the script also reports non-zero exist status which causes the Enterprise Manager agent to report an error. To verify go to Enterprise then select Compliance and click on Results. This opens the Compliance Results page, every row represents one standard associated to a number of targets. Clicking a standard opens the results for that combination, for DBSAT even when valid results data is obtained, the column shows No. This is because the DBSAT script reports a false error even though it managed to collect the required data.

  Figure 26-7 Required Data Available

  

  There is no remedial action to take, do not trust the Required Data Available column only for DBSAT. Instead verify the status of the actual DBSAT command by following the steps previously outlined.

• DBSAT data is sent by the DBSAT target every 24 hours. This data is collected in a central store by the management server as it arrives from each target. The Compliance Evaluation is performed every 4 hours by referring to the latest DBSAT data available in the central store at that time. To verify that the jobs are running properly go to Enterprise, then Job and click on Activity. On Jobs Page, in the Available Criteria components panel, select Name and Search by entering value CCSREEVALDATA, information will show targets with their respective associated standards. If there are none or missing, reassociate targets to their respective standards.

  Figure 26-8 DBSAT Job Overview

  
• DBSAT and the Enterprise Manager integration tool do not work if there is a space character in the database monitoring user's password. Common database password guidelines discourage usage of a space character in password. To remedy change the password of the Oracle Database monitoring user (typically DBSNMP).