emcli is a utility for interacting with Oracle Cloud Control from the command line.<\/p>\n
We configure autologin to conveniently use it in our automation scripts:<\/p>\n
emcli setup -url=\"https:\/\/oms:7803\/em\" -username=\"test<\/span>\" -autologin<\/code><\/pre>\ntest<\/span> is a Cloud Control account, which must exist prior to running the command above.<\/p>\nNow you can start using emcli. For example, you can list the registered targets:<\/p>\n
emcli list -resource=\"Targets\" -format=\"name:csv\"\n\nTARGET_NAME,TARGET_TYPE,TARGET_GUID,TYPE_VERSION,TYPE_QUALIFIER1,TYPE_QUALIFIER2,TYPE_QUALIFIER3,TYPE_QUALIFIER4,TYPE_QUALIFIER5,EMD_URL,TIMEZONE_REGION,DISPLAY_NAME,HOST_NAME,LAST_METRIC_LOAD_TIME,TYPE_DISPLAY_NAME,BROKEN_REASON,BROKEN_STR,OWNER,LAST_LOAD_TIME_UTC,CREATION_DATE\nEM Console Service,oracle_em_service,54ABB160C4A4146A7F8167B56739216D,3.0, , , , , , ,Europe\/Zurich,EM Console Service, ,2021-01-11 11:18:38.0,EM Service,0, ,SYSMAN,2021-01-11 10:18:38.0,2021-01-07 16:20:09.0\nEM Jobs Service,oracle_em_service,F0E4D5A3A4489A66964A5F2894638605,3.0, , , , , , ,Europe\/Zurich,EM Jobs Service, ,2021-03-03 12:01:25.0,EM Service,0, ,SYSMAN,2021-03-03 11:01:25.0,2021-01-07 16:19:55.0\n...<\/code><\/pre>\nThe other day, emcli couldn’t log in to the database anymore:<\/p>\n
emcli list -resource=\"Targets\" -format=\"name:csv\"\nORA-01017: invalid username\/password; logon denied<\/span><\/code><\/pre>\nThe password of the test<\/span> account hasn’t changed – I could still log in to both the database and Cloud Control.<\/p>\nThe question arose: what credentials was emcli sending to the database? Even the emcli log with the highest logging level didn’t reveal anything. So I configured database auditing:<\/p>\n
audit session<\/code><\/pre>\nThe following audit entry provided useful information:<\/p>\n
SESSIONID:[7] \"2287527\" ENTRYID:[1] \"1\" STATEMENT:[1] \"1\" USERID:[9] \"MGMT_VIEW<\/span>\" USERHOST:[14] \"oms<\/span>\" TERMINAL:[7] \"unknown\" ACTION:[3] \"100\" RETURNCODE:[4] \"1017\" COMMENT$TEXT:[135] \"Authenticated by: DATABASE;AUTHENTICATED IDENTITY: MGMT_VIEW<\/span>; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=x.x.x.x)(PORT=35590))\" OS$USERID:[6] \"oracle\" DBID:[10] \"2187817836\" CURRENT_USER:[9] \"MGMT_VIEW<\/span>\"<\/code><\/pre>\nFirst, it was the MGMT_VIEW<\/span> account which couldn’t log in. Second, it wasn’t emcli who attempted to log in, it was the OMS<\/span> instead.<\/p>\nIn other words, emcli logs in to Cloud Control with its configured account. Then, OMS<\/span> logs in with MGMT_VIEW<\/span> to execute the query on emcli’s behalf.<\/p>\nIn this case, a glimpse on dba_users.password_change_date revealed that someone changed the password. This should never be done except with the following emctl command, which also corrected the problem.<\/p>\n
emctl config oms<\/span> -change_view_user_pwd -auto_generate<\/code><\/pre>\nIn summary, emcli uses the configured account just to initially connect to Cloud Control. Then, Cloud Control creates another session with a different account to execute emcli’s request. If the password of this intermediary account doesn’t match the password stored in the repository, ORA-01017<\/span> will be passed to emcli, but unfortunately, without any further information. Luckily, you can use database auditing to find out the affected user.<\/p>\n","protected":false},"excerpt":{"rendered":"A hidden dependency in emcli Continue Reading