Blog Archives
ORA-12638: Credential retrieval failed
I’m hunting down more or less a sporadic error that sometimes our users get during initial attempt to connect to Oracle server.
Some facts:
– this error was never raised on NT4 domain; it was first noticed shortly after we migrated all our clients to Active Directory
– we don’t use OS authentication, all users are using classic Oracle accounts
– we do have SQLNET.AUTHENTICATION_SERVICES = (NTS) in the sqlnet.ora on all client machines
– so far, the only workaround is to remove SQLNET.AUTHENTICATION_SERVICES = (NTS) from sqlnet.ora on all worstations
– another observation is that we usually get several trace files generated in UDUMP, such as:
Dump file d:\oracle\admin\ora\udump\orcl_ora_3920.trc Tue Aug 21 08:18:17 2007 ORACLE V10.2.0.2.0 - Production vsnsta=0 vsnsql=14 vsnxtr=3 Oracle Database 10g Enterprise Edition Release 10.2.0.2.0 - Production With the Partitioning, OLAP and Data Mining options Windows Server 2003 Version V5.2 Service Pack 1 CPU : 4 - type 586, 4 Physical Cores Process Affinity : 0x00000000 Memory (Avail/Total): Ph:2488M/8190M, Ph+PgF:4528M/10044M, VA:1411M/3071M Instance name: orcl Redo thread mounted by this instance: 1 Oracle process number: 36 Windows thread id: 3920, image: ORACLE.EXE (SHAD) opiino: Attach failed! error=-1 ifvp=00000000
– Metalink Note:399727.1 “Opiino: Attach Failed! Error=-1 Ifvp=0″ Written Many Times Per Minute In Udump File And ORA-12500 In Listener.log” doesn’t apply to our situation, because there is only one database running on the server. Also, we do not observe ORA-12500 in the listener.log – this is weird.
Based on Event Log message at the client:
Warning - LsaSrv - SPNEGO (Negotiator) - Event 40961 The Security System could not establish a secured connection with the server ldap/server.domain.com/domain.com@domain.com. No authentication protocol was available.
…I would say that this is an OS issue, not an Oracle Net bug. Google search revealed that Event 40961 is usually a consequence of miss-configured DNS (missing reverse lookup entry for the server), but not in our case. If I’ll ever find the culprit for the error I’ll update this thread with a solution.
Oracle XE with character set EE8MSWIN1250
A short memo about the procedure to change LATIN1 to LATIN2 code page in Oracle XE (I can’t remember where I originally found this tip, probably somewhere on OTN!?):
1) Make sure you download and install Oracle XE (Western European) version of XE (single byte character set) and not Universal (Unicode)
2) change the database character set to EE8MSWIN1250:
cmd> sqlplus /nolog sql> connect / as sysdba sql> SHUTDOWN IMMEDIATE; sql> STARTUP MOUNT; sql> ALTER SYSTEM ENABLE RESTRICTED SESSION; sql> ALTER SYSTEM SET JOB_QUEUE_PROCESSES=0; sql> ALTER SYSTEM SET AQ_TM_PROCESSES=0; sql> ALTER DATABASE OPEN; sql> ALTER DATABASE CHARACTER SET INTERNAL_USE EE8MSWIN1250; sql> SHUTDOWN; sql> STARTUP RESTRICT; sql> SHUTDOWN; sql> STARTUP;
That’s it. Now, you have Oracle XE with EE8MSWIN1250. This can be useful if you want to support old clients (for example Oracle Forms) that doesn’t recognize AL32UTF8 code page that is used in Universal distribution.
Oracle JAccelerator NCOMP
Oracle made two silly mistakes when 10g was released:
- they put JAccelerator NCOMP (Java Native Compiler) component on Companion disk. Put mandatory component of the database on Companion disk and just wait for the flow of the Service Requests – and Oracle Support got the “feedback” from customers who overlooked the requirement to install this mandatory component from Companion disk.
- second silly decision is really an old story – I don’t know who is the genius behind the idea to not let us choose which component we would like to install with OUI. We had to install tons of demo stuff just to get JAccelerator component on our server, followed by de-installation of components that we don’t need. If I choose “Custom Installation” I want control of what will be installed and what not – please, don’t treat me like an idiot.
They learned the lesson and corrected a mistake in Oracle11g where JAccelerator is installed at the time database SW is installed (you may argue that JAccelerator is really not a mandatory component in 10g…this is only true if you run database without JVM. Do you support any such db?;-).
Now, it’s time for a confession :-). Today (before I got necessary dose of caffeine), I was too quick while preparing test installation of Oracle 10.2.0.3 – after I finished installation of 10.2.0.1 base release, I patched this version with Patchset 10.2.0.3. In the middle of 10.2.0.3 installation, it struck me that I forgot to install JAccelerator. Fortunately, I was installing Oracle SW without the database, so the fix was easy after 10.2.0.3 installation finished:
- I installed JAccelerator from 10.2.0.1 media
- then re-installed 10.2.0.3 patchset. OUI will display additional panel, if detects that some components are already patched, showing all the installed components and you can browse the tree and check that only JAccelerator will be patched from 10.2.0.1 to 10.2.0.3.
I’m not quite sure, what would be the exact procedure if you installed JAccelerator after database was already created without it (JVM loaded without NCOMP). I guess JVM needs to be reloaded (see Metalink 276554.1 “How to Reload the JVM in 10.1.0.X and 10.2.0.X”)– not for the faint of heart!
Regards,
Ales
Bug – DCD (Dead Client Detection) doesn’t work as expected
For quite some time we observed dead client connections on some of our production servers (in all cases: 32-bit Oracle10g 10.2.0.2, Windows 2003 SP1). We turned dead client detection ON by setting up SQLNET.EXPIRE_TIME in sqlnet.ora on the server side, trying different values (5, 10, 15 minutes). Despite of that, we noticed that DCD doesn’t work for no apparent reason. We confirmed that by tracing the session according to Metalink Note 1019019.102 “How to Check if Dead Connection Detection (DCD) is Enabled”. It was during this search on Metalink that we found out about Bug #5573896 “DCD IS NOT WORKING IF SET MORE THAN 1 MINUTE”. After setting SQLNET.EXPIRE_TIME=1 the problem with dead client connections disappeared – well, better said the problem was not as severe, as before we changed EXPIRE_TIME to 1 minute. Occasionally, we still find dead connections that Oracle doesn’t recognize as dead connections. According to Metalink note it’s a platform specific bug – it’s not known yet when’ll be fixed.
So far we found out that:
– this is the problem with Oracle 10.2.0.2/10.2.0.3 on Windows 2003 / XP
– we could not reproduce the problem running Oracle 10.2.0.2 on Windows 2000 (SP4)
– it doesn’t seems to affect Windows 2003 EMT64*
[Comment added, 2 November, 2007]
* Actually, it does affect Windows 2003 EMT64 as well. Last week we put in production Oracle 10.2.0.3 (+Patch 12) on 64-bit Windows 2003 EE with SP2. After a week in a production we noticed dead client connections as described above.
Regards,
Ales