User Management Guide

Transcription

1 IBM Tivoli Monitoring for Databases: Oracle User Management Guide Version GC

2

3 IBM Tivoli Monitoring for Databases: Oracle User Management Guide Version GC

4 Note Before using this information and the product it supports, read the information in Notices on page 121. First Edition (September 2002) This edition applies to version of IBM Tivoli Monitoring for Databases: Oracle and to all subsequent releases and modifications until otherwise indicated in new editions. Copyright International Business Machines Corporation All rights reserved. US Government Users Restricted Rights Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.

5 Contents About this guide v Who should read this guide v What this guide contains v Publications vi IBM Tivoli Monitoring for Databases: Oracle library vi Related publications vi Accessing softcopy publications vi Using the guide online vii Viewing online help vii Ordering publications vii Providing feedback about publications.... vii Accessibility viii Contacting Customer Support viii Conventions used in this guide viii Typeface conventions viii Operating System-dependent variables and paths viii Chapter 1. Overview of user management Policy-based management Management-by-subscription About the default policy About the validation policy Profile distribution Chapter 2. Setting up profiles Adding or removing resource types Creating profiles Creating profile managers Adding subscribers Removing subscribers Chapter 3. Setting up profile policies 13 Defining the default policy Selecting the default type Defining the validation policy Selecting the default validation type Validating profiles Chapter 4. Managing profiles Renaming profiles Populating profiles Listing user, role, or resource information Locking and unlocking records Distributing a profile to subscribers Distributing all profiles Creating a new copy of a profile Setting distribution defaults Scheduling a distribution Deleting profiles Chapter 5. Managing users Accessing and understanding the Database User Profile window Adding a user record Setting the tablespace list Setting tablespace quotas Setting the default and temporary tablespace Setting and clearing default values Granting roles to users Granting system privileges to users Setting object privileges Viewing object privileges Editing a user record Editing multiple user records Copying user records Moving user records Deleting user records Chapter 6. Managing roles Accessing and understanding the Database Role Profile window Adding role records Setting and clearing default values Searching and sorting the role database Granting role records to role profiles Granting system privileges Editing a role record Editing multiple role records Copying role records Moving role records Deleting role records Chapter 7. Managing resources Accessing and understanding the database resource profile window Setting and clearing default values Adding resource records Editing a resource record Editing multiple resource records Copying resource records Moving resource records Deleting resource records Appendix. Notices Trademarks Index iii

6 iv IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

7 About this guide Who should read this guide What this guide contains The IBM Tivoli Monitoring for Databases: Oracle User Management Guide contains information about database and instance management using IBM Tivoli Monitoring for Databases: Oracle and how it is integrated into Tivoli Enterprise software. This document is also required for installing the IBM Tivoli Monitoring for Databases: Oracle User Management application. Note: Refer to the IBM Tivoli Monitoring For Databases: Oracle Installation and Setup Guide for installation instructions. This document is intended for system administrators and database adminstrators. It describes the concepts you should know to effectively use IBM Tivoli Monitoring for Databases: Oracle User Management. Readers should be familiar with the following: v Windows or UNIX operating systems v Tivoli Enterprise Console software v Oracle database administration This guide contains the following sections: v Chapter 1, Overview of user management on page 1 Describes Tivoli concepts relevant to the IBM Tivoli Monitoring for Databases: Oracle User Management application, which includes policy-based management and management-by-subscription. v Chapter 2, Setting up profiles on page 3 Describes how to create profile managers, profiles, and subscribers. v Chapter 3, Setting up profile policies on page 13 Describes how to set up default and validation policies in a profile. v Chapter 4, Managing profiles on page 31 Describes how to populate, distribute, and delete profiles, and copy, move, and lock profile records. v Chapter 5, Managing users on page 51 Describes how to add, edit, and drop users in a profile. v Chapter 6, Managing roles on page 81 Describes how to add, edit, and drop roles in a profile. v Chapter 7, Managing resources on page 105 Describes how to add, edit, and drop resource profiles in a profile. v

8 Publications This section lists publications in the IBM Tivoli Monitoring for Databases: Oracle library and any other related documents. It also describes how to access Tivoli publications online, how to order Tivoli publications, and how to make comments on Tivoli publications. IBM Tivoli Monitoring for Databases: Oracle library The following documents are available in the IBM Tivoli Monitoring for Databases: Oracle library: v v IBM Tivoli Monitoring for Databases: Oracle Reference Guide, SC Provides detailed information about individual tasks and resource models. IBM Tivoli Monitoring for Databases: Oracle User s Guide, SC Describes how use IBM Tivoli Monitoring for Databases: Oracle. Related publications To be able to use the information in this book effectively, you must have some prerequisite knowledge, which you can get from the following books: v v Tivoli Management Framework User s Guide Provides detailed information about profiles and profile management. Tivoli Management Framework Planning and Installation Guide Provides detailed information about server and hardware requirements. v Tivoli Management Framework Reference Guide Provides additional information about command line commands, such as the winstall command. v Tivoli Enterprise Installation Guide, Version 3.7 Provides more detailed information about using the Tivoli Enterprise Console and using SIS to install the IBM Tivoli Monitoring for Databases: Oracle software. The following documents also provide useful information: For more information about Oracle, refer to the product documentation produced and distributed by the Oracle Corporation. The Tivoli Glossary includes definitions for many of the technical terms related to Tivoli software. The Tivoli Glossary is available, in English only, at the following Web site: Accessing softcopy publications The publications for this product are available in PDF and HTML formats through the following media: v IBM Tivoli Monitoring for Databases: Oracle, Version 5.1.0: Documentation CD, LK3T The Documentation CD contains all of the English language publications for this product, except for the Web-only Limitations and Workarounds supplements. To access the publications, use a Web browser to open the start.html file, which is located in the root directory of the CD. vi IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

9 v IBM Tivoli Monitoring for Databases: Oracle, Version 5.1.0: NLS Documentation CD, LK3T The NLS (national language support) Documentation CD contains both English and non-english language publications for this product, except for the Web-only Limitations and Workarounds supplements. To access the publications, use a Web browser to open the start.html file, which is located in the root directory of the CD. v Tivoli Information Center IBM posts publications for this and all other Tivoli products, as they become available and whenever they are updated, to the Tivoli Information Center Web site. td/td_prod_list.html Click the Tivoli Monitoring for Oracle link to access the product library. Using the guide online This document is available on the IBM Tivoli Monitoring for Databases, Version 5.1.0: Documentation CD, LK3T in PDF and HTML formats. Refer to the readme.txt file on the CD for instructions on downloading the Acrobat Reader, Version 3.0 or later, to view, save, and print the manual. Use your HTML browser to open the start.html file on the CD to access the.html documentation files. Every navigation page also includes a link at the bottom to download the Acrobat reader for viewing, saving, and printing the files. Viewing online help Online help is available in several forms: v v Desktop Access online help by clicking the Help buttons in dialog boxes. Commands You can desplay command syntax and parameter information for command line interface (CLI) commands by typing the name of the command at a command prompt and pressing the Enter key. Ordering publications You can order many Tivoli publications online at the following Web site: publications/cgibin/pbi.cgi You can also order by telephone by calling one of these numbers: v In the United States: v In Canada: See the following Web site for a list of telephone numbers in other countries: Providing feedback about publications If you have comments or suggestions about Tivoli products and documentation, complete the customer feedback survey at the following Web site: About this guide vii

10 Accessibility Accessibility features help a user who has a physical disability, such as restricted mobility or limited vision, to use software products successfully. With this product, you can use assistive technologies to hear and navigate the interface. You can also use the keyboard instead of the mouse to operate all features of the graphical user interface. For additional information, see the Accessibility Appendix in the IBM Tivoli Monitoring for Databases: Oracle User s Guide. Contacting Customer Support If you have a problem with any Tivoli product, you can contact IBM Customer Support for Tivoli products. See the Tivoli Customer Support Handbook at the following Web site: The handbook provides information about how to contact Customer Support, depending on the severity of your problem, and the following information: v Registration and eligibility v v Conventions used in this guide Telephone numbers and addresses, depending on the country in which you are located What information you should gather before contacting Customer Support This book uses several conventions for special terms and actions, operating system-dependent commands and paths, and margin graphics. Typeface conventions The following typeface conventions are used in this book: Bold Italic Monospace Names of files and directories, file and path names, lowercase and mixed-case commands, command options, and flags that appear within text appear like this, in bold type. Graphical user interface elements (except for titles of windows and dialogs) and names of keys also appear like this, in bold type. Variables, values you must provide, new terms, and words and phrases that are emphasized appear like this, in italic type. Commands, command options, and flags that appear on a separate line, code examples, output, and message text appear like this, in monospace type. Text strings you must type, when they appear within text, names of Java methods and classes, and HTML and XML tags also appear like this, inmonospace type. Operating System-dependent variables and paths This book uses the UNIX convention for specifying environment variables and for directory notation. viii IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

11 When using the Windows command line, replace $variable with %variable% for environment variables and replace each forward slash (/) with a backslash (\) in directory paths. Note: If you are using the bash shell on a Windows system, you can use the UNIX conventions. About this guide ix

12 x IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

13 Chapter 1. Overview of user management Policy-based management Management-by-subscription IBM Tivoli Monitoring for Databases, Version 5.1.0: Oracle User Management enables an administrator to manage user, role, and resource definitions across multiple databases. A user, as defined in the IBM Tivoli Monitoring for Databases, Version 5.1.0: Oracle User Management environment, is anyone defined in a Tivoli Database User Profile or Oracle database. Users can be assigned roles, which define the Oracle database privileges, and resources, which define the limitations and restrictions that apply to a user s Oracle session, such as the number of concurrent sessions the user can establish, the amount of CPU processing time that can be assigned to one session, and how long a session can be idle before it is disconnected, as well as password restrictions. The key concepts that are described in this chapter include the following: v Policy-based management v Management-by-subscription Note: The information in this document pertains only to user management. For details on registering and managing Oracle databases, refer to the IBM Tivoli Monitoring for Databases: Oracle User s Guide. Policy-based management refers to the grouping of resources (people, and equipment) based on the policies (rules) that determine how they will interact with each other. Policy-based user management is used to group Oracle database resources into entities called policy regions. Policy regions are hierarchically structured groupings that conform to the structures of an organization. For example, a department, job function, or geographic region can be grouped into a policy region. A policy region is represented on the Tivoli desktop by an icon that resembles a capitol building (dome icon). When a Tivoli management region is created, a policy region with the same name is also created. A Tivoli management region addresses the physical connectivity of resources, whereas a policy region addresses the logical organization of resources IBM Tivoli Monitoring for Databases, Version 5.1.0: Oracle User Management ships with a built-in Best Practices policy for each managed resource. These policies provide preconfigured settings that were defined by Oracle experts for monitoring database servers. Refer to the IBM Tivoli Monitoring for Databases: Oracle User s Guide for more information. Tivoli incorporates management-by-subscription to enable you to capture, define, and distribute Oracle configuration information in a series of logically organized profiles. A profile contains data that describes the significant characteristics and policies of users, roles, and resources. For example, you can group and define all of your administration personnel into one Oracle user profile called Admin. Within 1

14 this user profile, you might have hundreds of users (user records). As you add, delete, or update these records, you can then distribute this information to all Oracle databases that subscribe to the profile, thus the term management-bysubscription. Ultimately, these distributions define the data in the profile at the databases. Tivoli incorporates both default and validation policies that ensure that any changes made to Oracle users, roles, and resources conform to your current policy constraints. About the default policy You can set default and validation policies for each profile. A default policy enables you to set initial values for each attribute in a profile that will be applied automatically when new records are created in a profile. For example, you can set a default value for the user s temporary tablespace attribute, and when a new user is created, this attribute will already be set to the value that you defined as the default. About the validation policy A validation policy verifies that a profile record complies with the policies you set and prevents records with invalid values from being created. The validation policy runs when you populate a profile, add a new profile record, or explicitly request validation. You can enable or disable a validation policy within a profile. When setting validation policies for attributes, you can define them as either Script or Constant values. If the policy is set to Script, the user can only define the value as a shell script (also called the script body). If the policy is set to Constant, the only allowable values depend on the attribute and are set as string representations of the interface definition language (IDL) structure. IDL is a declarative language in the Common Object Request Broker Architecture, which defines the object interfaces. Profile distribution The profiles that you create are managed by profile managers. Profile managers are used to distribute or define profile records to the subscribing Oracle databases. When you create new profile records, you must distribute them so that they are added to your Oracle database. It is important to distinguish between the records in the IBM Tivoli Monitoring for Databases, Version 5.1.0: Oracle User Management profile and the records in an Oracle database. The changes you make to the profile managers are not reflected in the Oracle database until they have been distributed. 2 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

15 Chapter 2. Setting up profiles A profile is a container for application-specific information about a particular type of resource. This chapter describes how to set up and manage the profiles (groupings of user, role, and resource records) for each policy region that you define. Because the concepts described in this chapter apply equally to user, role, and resource profiles, only the user profile is used in the examples.table 1 provides a list of the goals you can achieve using the procedures in this chapter. The table also tells where to locate information about the procedures for each goal. Table 1. Setting up profiles procedures Goal Adding or removing resource types Refer to Adding or removing resource types on page 3 Creating profiles Creating profiles on page 5 Creating profile managers Creating profile managers on page 7 Adding subscribers Adding subscribers on page 9 Removing subscribers Removing subscribers on page 11 Adding or removing resource types Objective To add or remove a resource type so you can define the policy region. Background information Each policy region contains a list of managed resource types that you can define. Managed resource types refer to the type of resource available in a policy region. You can define the managed resource types as one of the following: v v v OracleUserManagerProfile creates Oracle database users (people who use Oracle) that are distributed to the OracleDatabaseManager endpoint. OracleRoleManagerProfile creates Oracle roles (Oracle database tasks) that are distributed to the OracleDatabaseManager endpoint. OracleResourceManagerProfile creates Oracle resources (hardware and processes) that are distributed to the OracleDatabaseManager endpoint. You can add or remove managed resource types at any time. Tivoli managed resource types are independent of each other, so they can exist together or in separate policy regions. Although Tivoli assigns the managed resource type the basic default policy of that policy region when you add a managed resource type to a policy region, you can create new instances of the managed resource in the policy region. Required authorization roles senior 3

16 Before you begin To create and manage each type of IBM Tivoli Monitoring for Databases, Version 5.1.0: Oracle User Management profile within a policy region, you must set the relevant managed resource type as a current resource in the region. When you finish After adding the types to the policy region, you must create a Profile Manager before creating the specific resource records. Refer to Creating profiles on page 5 for details. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command Line: Use the wsetpr command to add or remove the managed resource types of a policy region. Refer to the Tivoli Management Framework Reference Guide. Tivoli Desktop: 1. Double-click the policy region icon to open the Policy Region window. 2. Select Properties from the toolbar to display the Properties drop-down menu. 3. Select Managed Resources to open the Set Managed Resources dialog box. Additional Information: The Current Resources list displays current managed resource types for the policy region. The Available Resources list displays the managed resource types that you can add to the policy region. 4. Do one of the following: v Add a resource type to a policy region using the following steps: a. Select one or more resources from the Available Resources list. Additional Information: To select multiple resource types, click a resource type then press and hold the Shift key while selecting other types (press the Ctrl key to select non-contiguous entries). 4 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

17 Creating profiles b. Click the left arrow button to move the selected managed resource types to the Current Resources list. Additional InformationYou can achieve the same result by double-clicking on an entry. v Remove a resource type from a policy region using the following steps a. Select one or more managed resource types from the Current Resources list. b. Click the right arrow button to moved to the selected types to the Available Resources list. 5. Do one of the following: v Click Set to save the resource to leave the dialog box open to add other resources. v Click the Set & Close button to save the resource and close the dialog box. Objective To create a profile so you can manage application-specific information about a particular type of resource. Background information You can create multiple groupings of users, roles, and resources. Consider the following guidelines when creating profiles: Role profile Should contain all records for the tasks that can be completed in your Oracle databases. Resource profile Should contain the hardware and processes in your Oracle databases. User profile Should contain all records for persons in your Oracle databases. There is no limit to the number of profiles that you can create in each profile manager. After you create the new profile, a new icon representing the profile is displayed in the Profile Manager window. A distinct icon represents each profile type; the name of the profile is below the icon. Table 2 represent the user, role, and resource profile types: Table 2. Profile manager icons OracleUserManagerProfile Icon Chapter 2. Setting up profiles 5

18 Table 2. Profile manager icons (continued) OracleRoleManagerProfile Icon OracleResourceManagerProfile Icon Required authorization roles senior Before you begin Define a policy region and profile manager where the profiles will reside as described in Adding or removing resource types on page 3. The managed resource type that you previously added to your policy region determines the types of profiles available in the Type list. When you finish You can distribute the profiles to subscribers. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command Line: Use the wcrtprf command to create profiles in a profile manager. Refer to the Tivoli Management Framework Reference Guide for more information. Tivoli Desktop: 1. Open the Profile Manager: a. Right-click the profile manager icon to display the profile manager drop-down menu. b. Click Open to display the Profile Manager window. v Double-click the profile manager icon to open the Profile Manager window. 2. Click Create to display the Create drop-down menu. 6 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

19 3. Click Profile from the Create drop-down menu to display the Create Profile dialog box. Creating profile managers 4. From the Type list, click a profile type to create. Additional Information: The managed resource type that you defined in Adding or removing resource types on page 3 determine the types of profiles available in the Type list. 5. Type a name for the profile in the Name/Icon Label text box. Additional Information: Within a profile manager, each Oracle profile must have a unique name. For example, you can create a profile called South_Texas for your sales agents in southern Texas, but you cannot create a second profile called South_Texas. You can group your profiles to logically represent your organization. 6. Do one of the following: v Click the Create button to create the profile. Additional Information: You can create more profiles by repeating Steps 4 and 5. v Click Create & Close to create the profile and close the Create Profile window. Objective Tocreateaaprofile manager, a container for profiles, so you can link them to a set of resources called subscribers. Background information A profile manager controls the relationship between a profile and the subscriber. Subscribers can be managed nodes or other profile managers. Profile managers enable Tivoli administrators to group records into profiles so that they can be distributed to subscribers across a network or across a specified portion of a network. Chapter 2. Setting up profiles 7

20 Required authorization roles senior Before you begin Before creating profile managers from the desktop, you must open the policy region window. When you finish Create the following IBM Tivoli Monitoring for Databases, Version 5.1.0: Oracle User Management profile types where you will group your records: v OracleUserManagerProfile v OracleRoleManagerProfile v OracleResourceManagerProfile Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command Line: Use the wcrtprfmgr command to create a profile manager. Refer to the Tivoli Management Framework Reference Guide for more information. Tivoli Desktop: 1. Open the Policy Region window. 2. Select Create from the toolbar to display the Create drop-down menu. 3. Select ProfileManager from the Create drop-down menu to display the Create Profile Manager dialog box. 4. Type a name for the new profile manager in the Name/Icon Label text box. Additional Information: The name of a Tivoli resource such as a profile manager can include any alphanumeric character, an underscore (_), a dash (-), or a period (.). 5. Do one of the following: v Select the Dataless Endpoint Mode checkbox if the profile manager also contains Tivoli management agent endpoints. v Clear the Dataless Endpoint Mode checkbox if the profile manager does not contain Tivoli management agent endpoints or if the profile manager contains other profile managers. 8 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

21 Additional Information: IBM Tivoli Monitoring for Databases: Oracle profile endpoints (OracleDatabaseManager and OracleInstanceManager) can be subscribed to either database or dataless profile manager. 6. Do one of the following: v Click Create to create the profile manager. v Click Create & Close to create the profile manager, close the Create Profile Manager window, and view the new profile manager in the Policy Region window. Adding subscribers Objective To add a subscriber to a profile manager so you can receive profile information defined in the profile manager. Background information A subscriber is a profile endpoint, such as an OracleDatabaseManager or OracleInstanceManager resource, or a profile manager that receives profile records from a profile manager. When you add an OracleDatabaseManager or OracleInstanceManager subscriber to a profile manager, the subscriber is the recipient of profile information defined in the profile manager. To define the Oracle user, role or resource profile information to the IBM Tivoli Monitoring for Databases: Oracle profile endpoints, you must distribute the profile to the profile manager subscriber. For IBM Tivoli Monitoring for Databases: Oracle User Management, only profile managers and OracleDatabaseManager and OracleManagerAsync resources may be subscribers to the OracleUserManagerProfile, OracleRoleManagerProfile and OracleResourceManagerProfile profile distributions. Required authorization roles admin Before you begin Create a profile manager in which to add the subscribers. Chapter 2. Setting up profiles 9

22 When you finish None. Procedure You can perform this procedure from the Tivoli desktop only. 1. Open the Policy Region window. 2. Open the Profile Manager by doing one of the following: v Double-click the profile manager icon to open the Profile Manager window. v Do the following: a. Right-click the profile manager icon to display the profile manager drop-down menu. b. Click Open to display the Profile Manager window. 3. Select Profile Manager from the toolbar to display the Profile Manager drop-down menu. 4. Select Subscribers to display the Subscribers dialog box. 5. Select one or more subscribers from the Available to become Subscribers list. Note: You might need to use the Browse button to find a subscriber. Additional Information: This dialog box contains a list of all profile managers and Oracle databases that can subscribe to the current profile manager. 6. After you have selected the subscribers, click the left arrow button to move your selections from the Available to become Subscribers list to the Current Subscribers list. 7. Do one of the following: v Click Set Subscriptions to add the subscriber. v Click the Set Subscriptions & Close button to add the subscribers to the profile manager and close the Subscribers dialog box to display the new 10 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

23 subscription in the Profile Manager window. Removing subscribers Objective To remove a subscriber so that you can prevent it from receiving profile information defined in the profile manager. Background information A subscriber is a profile endpoint, such as an OracleDatabaseManager or OracleInstanceManager resource, or a profile manager that receives profile records from a profile manager. When you remove an OracleDatabaseManager or OracleInstanceManager subscriber to a profile manager, the subscriber no longer receives profile information defined in the profile manager. Required authorization roles admin Before you begin None. When you finish None. Procedure You can perform this procedure from the Tivoli desktop only. 1. Open the Policy Region window. 2. Open the Profile Manager by doing one of the following: Chapter 2. Setting up profiles 11

24 v Double-click the profile manager icon to open the Profile Manager window. v Do the following: a. Right-click the profile manager icon to display the profile manager drop-down menu. b. Click Open to display the Profile Manager window. 3. Select Profile Manager from the toolbar to display the Profile Manager drop-down menu. 4. Select Subscribers to display the Subscribers dialog box. 5. Select one or more subscribers from the Current Subscribers list. Additional information: You can use Browse to find a subscriber. 6. Click the right arrow button to move your selections from the Current Subscribers list to the Available to become Subscribers list. 7. Do one of the following: v Click Set Subscriptions to remove the subscriber. v Click Set Subscriptions & Close to remove the subscribers to the profile manager and close the Subscribers dialog box to display the subscription removal in the Profile Manager window. 12 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

25 Chapter 3. Setting up profile policies This chapter describes how to set up the profile policies that govern your user, role, and resource profiles (called, respectively, OracleUserManagerProfile, OracleRoleManagerProfile, and OracleResourceManagerProfile). A policy is made up of all the rules that control the profile. Each rule is a defined attribute that contains a specific value. This value can be a default (automatically preset) value or a validation (verifies entry complies) value. Table 3 provides a list of the goals you can achieve using the procedures in this chapter. The table also tells where to locate information about the procedures for each goal. Table 3. Setting up profile policies procedures Goal Refer to Defining the default policy Defining the default policy on page 13 Selecting the default type Selecting the default type on page 17 Defining the validation policy Defining the validation policy on page 22 and Selecting the default validation type on page 24 Validating profiles Validating profiles on page 28 Defining the default policy Note: Although these instructions can be applied to each type of profile, only the OracleUserManagerProfile profile policy is used in the step examples. Objective To set a default policy so you can define an initial set of values that are automatically set for attributes of a profile record. Background information Administrators can set a default policy to define an initial set of values that are automatically set for attributes of a profile record. Default values ensure that all new records created contain the appropriate value as defined by the administrator. The default policy affects only the profile records. It does not affect the Oracle database system catalogs. The administrator can also lock the default policy for an attribute to prevent subscribers from changing the value in their local copies of the distributed profiles. The profile policy is applied to each profile within a profile manager. Administrators might need to set a default policy to define an initial set of values that are automatically set for attributes of a profile record. Default values ensure that all new records created contain the appropriate value as defined by the administrator. It is important to note that the default policy affects only the profile records; it does not affect the Oracle database system catalogs. 13

26 To set the default policy for all profile records, you must define the policy for each type of profile (OracleUserManagerProfile, OracleRoleManagerProfile, or OracleResourceManagerProfile). Required authorization roles senior Before you begin To set the default policy for all profile records, you must define the policy for each type of profile (OracleUserManagerProfile, OracleRoleManagerProfile, or OracleResourceManagerProfile). If you do not have a profile manager or profile set up, refer to Chapter 2, Setting up profiles on page 3 for more information. When you finish Complete the steps in Selecting the default type on page 17. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command Line: Use the wlspolm command to examine default policy. Refer to the Tivoli Management Framework Reference Guide for more information. Desktop: 1. Open the Policy Region window. 14 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

27 2. Double-click the profile manager icon to display the profile manager window. 3. Display the corresponding profile window by doing one of the following: v Double-click the profile icon to display the corresponding profile window. v Do the following: a. Right-click the profile icon to display the profile icon s drop-down menu. b. Select Edit Properties to display the corresponding profile window. 4. Display the Edit Default Policies dialog box by doing the following: a. Select Edit from the profile window. b. Select Default Policies to display the Edit Default Policies dialog box. Chapter 3. Setting up profile policies 15

28 Additional Information: The Attributes list displays all available attributes for the selected profile; however, you do not have to define a default policy for each attribute. If you do not, the default of None, or no default, is applied to each new record that is created. 16 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

29 5. Select the attribute from the Attributes list for which you will set a default policy. Selecting the default type 6. Select one of the following from the Subscriber s can edit field: v No Prevents subscribers from changing the attribute. v Yes Allows subscribers to change the attribute. 7. Select the Default Type as described in Selecting the default type on page 17. Objective To select a default policy type so you can specify a profile item property. Background information The profile default record specifies the default values used when a new profile item is added. The default values are profile-specific. The default type option enables you to select the type of value that is accepted for that attribute when an entry is created. If a user attempts to define a value not defined as valid, the attribute value is not accepted. You can define a default policy type for each profile item property. The options that can be selected include the following: None No default policy is applied to that attribute and anything is accepted as a valid value. Chapter 3. Setting up profile policies 17

30 Constant Default Set as a constant only acceptable value for that attribute should equal the string value that you define as the default. Script Default Set by a script only a shell script (also called the script body) value is accepted for that attribute. Required authorization roles super or senior Before you begin Define the default policy as described in Defining the default policy on page 13. When you finish After the policy is created, you must distribute the profile to the subscribers for the policy to take effect in each subscriber s local copy of the profile. See Distributing a profile to subscribers on page 38 for more information. The default policy only affects the profile records; it does not affect the Oracle database s system catalogs. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command line: Use the wsetdfpol command to set default policy. Refer to the Tivoli Management Framework Reference Guide for more information. Desktop: 18 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

31 1. Click the Default Type down arrow to display the default type drop-down menu. 2. Select one of the following: v None v Constant Go to Step 3. v Script Go to Step Optional: Type a string value in the Value text box. Additional Information: The constant values that are allowable for each attribute are listed in Table 4: Table 4. Valid constant formats Valid constant formats for OracleUserManagerProfile, OracleRoleManagerProfile, and OracleResourceManagerProfile profiles Profile type Attribute Syntax Example OracleUser- ManagerProfile OracleUser- ManagerProfile Default Tablespace Tablespace Name USERS Temporary Tablespace Tablespace Name TEMP OracleUser- ManagerProfile OracleResource- ManagerProfile Profile Name LIMITCPU Chapter 3. Setting up profile policies 19

32 Table 4. Valid constant formats (continued) Valid constant formats for OracleUserManagerProfile, OracleRoleManagerProfile, and OracleResourceManagerProfile profiles Profile type Attribute Syntax Example OracleUser- ManagerProfile or OracleRole- ManagerProfile OracleUser- ManagerProfile or OracleRole- ManagerProfile OracleUser- ManagerProfile OracleUser- ManagerProfile OracleResource- ManagerProfile OracleResource- ManagerProfile Roles System Privileges Object Privileges Quotas Name CompositeLimit- SessionsPerUser CPUPerCall LogicalReads- PerCall IdleTime CPUPerSession LogicalReads- PerSession ConnectTime PrivateSGA {Count_of [{privilege_name is_grantable is_default_role}]...} {Count_of [{privilege_name is_grantable}]...} {Count_of [{grantee privilege_name {column_count [column]... } schema_name object is_grantable}]... } {Count_of [{tablespace_name is_limited limit_value}]... } OracleResource- ManagerProfile profile name {2 {"CONNECT" FALSE TRUE} {"RESOURCE" FALSE TRUE}} {2 {"SELECT ANY TABLE" TRUE} {"CREATE TABLE" FALSE}} {1{"ACCOUNTS" "UPDATE" {2 "SAL" "COMM"} "SCOTT" "EMP" FALSE}} {2 {"USERS" TRUE } {"TEMP" FALSE 0}} LIMIT_CPU {limit_type limit_value} {LIMITED 3000} {UNLIMITED 0} 4. The Edit Script Arguments and Edit Script Body options are displayed. To select script arguments, click Edit Script Arguments and go to Step5. To write a script for defining the arguments, select the script arguments as described in Step 5 and go to Step 6 on page Click Edit Script Arguments to display the Policy Script Arguments dialog box. 20 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

33 a. Select the attribute for which you will create an argument from the Attributes list. b. Click the right-arrow button to add the attribute to the Script Arguments list. Additional Information: These are the attributes that are valid defaults. 6. Click Edit Script Body to display the Edit Policy Script dialog box. a. Type the policy script for the selected attributes in the text window. b. Click Set & Close to save the script and close the dialog box. 7. Do one of the following: Chapter 3. Setting up profile policies 21

34 Defining the validation policy Note: You cannot reset values after clicking the Set button. You must manually enter a new value to reset it. v Click Set to save all attribute values that you have defined v Click Reset to enter new values 8. Click Close to close the Edit Default Policies window. Objective To define permissible values for profile items so that the profile entries comply with set policy so you can prevent entries that do not meet the validation policy. Background information If the validation policy is enabled, Tivoli executes validation when you populate a profile, add a new entry, or explicitly request validation. Tivoli uses the validation policy to verify that a profile entry complies with the set policy and prevents an entry that does not meet the validation policy from being created. The user who creates the invalid record receives an error message explaining why validation failed, and the record is not created. The validation you set for each attribute can be locked to prevent subscribers from changing it on their local copies. The policy you define in this procedure is applied to the profile you set up in Chapter 2, Setting up profiles on page 3. Required authorization roles senior Before you begin You must have set up a profile. For more information, refer to Chapter 2, Setting up profiles on page 3. When you finish Select the Default Type as described in the Selecting the default type on page 17 section. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command line: Use the wlspolm, wgetpolm, and wputpolm commands to examine and set validation policy from the command line. Refer to the Tivoli Management Framework Reference Guide for more information. Desktop: 1. Double-click the profile manager where you will define the policy from the Policy Region window. 2. Display the corresponding profile window by doing one of the following: v Double-click the profile icon. v Do the following: a. Right-click the profile icon. 22 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

35 b. Select Edit Properties 3. Select Edit to display the Edit Validation Policies dialog box. 4. Select one of the following Validation Policy options: v Disabled to turn off validation for all attributes in this profile v Enabled to set a validation policy for one or more attributes 5. Select an attribute from the Attributes list. Additional Information: The Attributes list displays all available attributes for the selected profile. If you do not define a validation policy for an attribute, the Tivoli default of None, or no validation, is applied. 6. Select one of the following options from the Subscribers can edit area: v No to prevent subscribers from modifying the validation. v Yes to allow subscribers to modify the validation. 7. Select the Default Type as described in Selecting the default validation type on page 24. Chapter 3. Setting up profile policies 23

36 Selecting the default validation type Objective To select the default validation type so you can define a default policy type for a profile item property. Background Information The default type option enables you to select the type of validation that is applied to an attribute when an entry is created. The following lists the available validation default types: None No default policy is applied to that attribute and anything is accepted as a valid value. Constant The only acceptable value for that attribute is the string value entered as the default. Script Only a shell script (also called the script body) value is accepted for that attribute. Regular Expression Only acceptable value for that attribute is the shell or Perl expression entered as the default. The validation policy affects only the profile records; it does not affect the Oracle database systems s catalogs. Required Authorization Roles super or senior Before You Begin Define the Validation policy as described in Defining the validation policy on page 22. When You Finish After setting up the validation policy, you must distribute the profile to the subscribers for the policy to take effect in each subscriber s local copy of the profile records. See Distributing a profile to subscribers on page 38 for more information. Procedure You can perform this procedure from the Tivoli desktop only. Complete the following steps from the Edit Validation Policies dialog box: 1. Click the Default Type box to display thedefault Type drop-down menu. 2. Select one of the following: v None v Constant: Go to Step 3. v Script to display the Edit Script Arguments and Edit Script Body buttons. Go to Step 4. v Regular Expression Go to Step Type a string value in the Value text box. 24 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

37 Additional Information: The constant values that are allowable for each attribute are listed in Table 4 on page Do one of the following: a. Select Edit Script Arguments to select script arguments. b. Go to Step 5. a. Select the script arguments as described in Step 5 to write a script for defining the arguments. b. Go to Step Click Edit Script Arguments to display the Policy Script Arguments dialog box and select the script arguments. Chapter 3. Setting up profile policies 25

38 a. Select the attribute for which you will set a validation policy from the Attributes list. b. Click the right-arrow button to add the attribute to the Script Arguments list. Note: These are the attributes that can be used in script arguments. If you want to manually enter body script, you must select the arguments here or they will not be recognized in the body script. 6. Select Edit Script Body to display the Edit Policy Script dialog box and manually enter the policy script. 26 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

39 a. In the text window, type the policy script for the selected attributes. b. Click Set & Close to save the script and close the dialog box. 7. Type a shell or Perl expression in the Value text box. 8. To save all attribute values that you have defined, click Set. To ignore all values and reset them to the original values, click Reset. Chapter 3. Setting up profile policies 27

40 Validating profiles Note: After a value is set, it cannot be reset using the Reset button. You must manually enter a new value to reset it. 9. Click Close to close the Edit Validation Policies window. Objective To validate the profile so you can confirm that a profile entry complies with set policy. Background information After the validation policy is defined, you can validate your profiles. Profile validation verifies that a profile entry complies with set policy and prevents an invalid entry from being created. After a policy is set for a profile, validation occurs automatically every time a new record is created, a profile is populated, or validation is requested. You might find it useful to request a validation when you modify an existing profile. Validation requests are defined in a Database (User, Role, or Resource) Profile window. Required authorization roles admin, senior, and super Before you begin Define the validation policy as described in Defining the validation policy on page 22. You must open the profile properties window before you begin. When you finish If you encounter errors during validation, the record name and resulting errors are displayed. Repair these errors immediately. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command Line: Use the wvalidate command to validate a profile against its validation policy from the command line. Refer to the Tivoli Management Framework Reference Guide for more information. Tivoli Desktop: 1. Open the profile properties window. 2. Select Profile to display the Profile drop-down menu. 3. Select Validate from the Profile drop-down menu to request the validation. Additional Information: When the validation is complete, the Results of Policy Validation dialog box displays any errors that were encountered during validation. If there are no errors, a message indicates that the profile passed 28 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

41 validation. 4. Select Close to close the dialog box. Chapter 3. Setting up profile policies 29

42 30 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

43 Chapter 4. Managing profiles This chapter describes how to manage the user, role, and resource profiles in your profile managers. The profile managers enable you to relabel, populate, distribute, and delete profiles. The information in this chapter describes how to use and manage profiles, but it does not describe how to work with the individual profile records (for that information, refer to the chapters following this one). Table 5 provides a list of the goals you can achieve using the procedures in this chapter. The table also tells where to locate information about the procedures for each goal. Table 5. Procedures for managing profiles Goal Refer to Rename a profile Renaming profiles on page 31 Populate a profile with records from an Populating profiles on page 32 Oracle database List user, role, or resource information Listing user, role, or resource information on page 35 Lock and unlocking records Locking and unlocking records on page 36 Distribute a profile to subscribers Distributing a profile to subscribers on page 38 Distribute all profiles to subscribers Distributing all profiles on page 40 Creating a new copy of a profile Creating a new copy of a profile on page 43 Set distribution defaults Setting distribution defaults on page 43 Scheduling a distribution Scheduling a distribution on page 44 Delete a profile Deleting profiles on page 49 Renaming profiles Objective To change the profile name so you can reflect changes in your organization s facilities, processes, or hierarchy. Background information Note: Rename profiles after distribution. If your profile managers are set up in a heirarchy, relabeling the profiles before distribution might cause difficulties for lower-level profiles. The new label can contain any alphanumeric character. It is recommended that you do not use spaces. Required authorization roles oracle_dba 31

44 Populating profiles Before you begin Open the profile manager that contains the user profiles for which you want to change the labels. For more information See the IBM Tivoli Monitoring for Databases: Oracle User s Guide. When you finish None. Procedure You can perform this procedure from the Tivoli desktop only. Desktop: 1. Double-click one of the following icons to display the Profile window: v Oracle User Profile v Oracle Role Profile v Oracle Resource Profile Additional Information: You can also right-click the selected icon and choose Edit Properties to display a profile window. 2. Type a new label in the Configuration Profile text box. 3. Click Set Label to replace the label name. 4. Select Profile from the menu bar to display the Profile drop-down menu. 5. Select Close to close the Profile window. Objective To copy data to a profile so you can populate the profile with the records stored in your Oracle databases. Background information When you create a profile, it is only a definition of the information that each profile item includes. You must then populate the profile items with the actual data that defines the particular system configuration. The populate command reads the data from a specified database and copies it to your Oracle user, role, or resource profiles. If more than one record exists with the same information from multiple databases from which you are populating, only the first instance of that record is added to the profile. In other words, Tivoli does not add duplicate records to your profile. Protecting predefined profiles: For each type of profile that you create, IBM Tivoli Monitoring for Databases: Oracle provides basic validation policies to protect the commonly used predefined profile records. These Tivoli-provided validation policies are as follows: v Validation Policy for User Profiles prevents the predefined user names SYS and SYSTEM from being populated during profile population v Validation Policy for Role Profiles prevents the following predefined roles from being populated during profile population: CONNECT DBA 32 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

45 v EXP_FULL_DATABASE IMP_FULL_DATABASE RESOURCE Validation Policy for Resource Profiles prevents the predefined profile DEFAULT from being populated during profile population Required authorization roles oracle_dba Before you begin Specify which endpoints from which you want to retrieve the information and whether this information should overwrite existing profile information or be appended to the profile. When you finish None. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command line: Use the wopopusers command to populate user profiles. Use the wopoproles command to populate role profiles. Use the wopopresources command to populate resource profiles. For more information, see the IBM Tivoli Monitoring for Databases: Oracle Reference Guide. Desktop: Perform the following steps to populate a user, role, or resource profile with the records from Oracle databases: 1. Double-click one of the following icons to display the profile window v Oracle User Profile v Oracle Role Profile v Oracle Resource Profile Chapter 4. Managing profiles 33

46 Additional Information: You can also right-click the icon and select Edit Properties to display a profile window. 2. Select Profile from the menu to display the Profile drop-down menu. 3. Select Populate from the Profile drop-down menu to display the Populate Oracle Profile dialog box. 34 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

47 4. Select the Oracle databases that contain the records that you will use to populate the profile from the Do not get records from these databases list. 5. Click the left-arrow button to move the databases into the Get records from these databases list. 6. Select one of the following options: Note: If you select Overwrite existing record list, all preexisting records in this profile will be deleted. v Append to existing record list to keep existing records. v Overwrite existing record list to replace the existing records. 7. Do one of the following to add the records: v Click Populate to add the records so you can select other Oracle databases from which to populate records. v Click Populate & Close to add the new records and close the dialog box. Additional Information: If validation policy is enabled, Tivoli validates all records from each Oracle database you selected. If a record fails validation policy, an error dialog box displays the names of those records. 8. Click Dismiss to close the message window. Listing user, role, or resource information Objective To list specific information about a user, role, or resource in an Oracle User profile. Background information None. Required authorization roles Before you begin None. When you finish None. Procedure You can perform this procedure from the Tivoli command line only. Command line: Use the wolsusers command to list the users in an Oracle user profile, or the wogetuser command to list specific information about a user in an Oracle User profile. Use the wolsroles command to list the roles in an Oracle role profile, or the wogetrole command to list specific information about a role in an Oracle Role profile. Use the wolsresources command to list the resources in an Oracle resource profile, or the wogetresource command to list specific information about a resource in an Oracle resource profile. Chapter 4. Managing profiles 35

48 Locking and unlocking records Objective To lock or unlock a profile record. Background information Locking a profile record causes it to be read-only when it is distributed to subscribers. See Distributing a profile to subscribers on page 38 for information on distributing. You can lock and unlock individual records in an Oracle profile. Before distributing profiles, lock those records that you do not want modified by subscribers. Required authorization roles senior Before you begin None. When you finish After you determine the records that you want to lock or unlock, you can distribute the profiles. Procedure You can perform this procedure from the Tivoli desktop only. Desktop: 1. Double-click one of the following icons to display the profile window: v Oracle User Profile v Oracle Role Profile v Oracle Resource Profile Additional Information: You can also right-click the appropriate profile icon and choose Edit Properties to open the profile window. 36 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

49 2. Do one of the following: v Lock records by doing the following: a. Highlight the record that you want to lock. b. Select Edit to display the Edit drop-down menu. c. Select Lock to lock the record. Additional Information: A symbol displays next to the record to indicate that it is locked to prevent users from modifying it. v Unlock records by doing the following: a. Highlight the records that you want to unlock. b. Select Edit. c. Select Unlock. Chapter 4. Managing profiles 37

50 Distributing a profile to subscribers Objective To distribute a profile so you can send information to the subscribers of the profile. Background information In the IBM Tivoli Monitoring for Databases: Oracle User Management environment, you can distribute profiles from a profile manager or from a database endpoint. When you distribute a profile from a profile manager, the information for the profiles is sent to the subscribers (that you preselect) of the profile manager. When you distribute a profile from a database endpoint, the information for the profiles is sent to all subscribers of that endpoint and the Oracle database system catalogs. This procedure described how to distribute a specific user, role, or resource profile. See Distributing all profiles on page 40 for information on how to distribute all profiles. Required authorization roles admin Required for distributing a profile. oracle_dba Required for updating the Oracle database system catalogs. Before you begin Determine if you should lock or unlock profile records. See Locking and unlocking records on page 36. When you finish None. 38 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

51 Procedure You can perform this procedure from the Tivoli desktop only. Tivoli Desktop: The following steps describe how to distribute a specific user, role, or resource profile. 1. Double-click one of the following icons to display the profile window: v Oracle User Profile v Oracle Role Profile v Oracle Resource Profile Additional Information: You can also right-click the appropriate profile icon, and choose Edit Properties to open the profile window. 2. Select Profile from the Database User Profile window menu to display the Profile drop-down menu. Chapter 4. Managing profiles 39

52 3. Select Distribute from the Profile drop-down menu to open the Distribute Profile dialog box. Distributing all profiles 4. Select one of the following: v Next level of subscribers from the Distribute To group box to distribute to the next level of subscribers. v All levels of subscribers from the Distribute To group box to distribute to all subscribers in the hierarchy and update the system catalogs (Oracle data dictionary) at the endpoints. 5. Select one of the following: v Preserve modifications in subscribers copies of the profile from the Distribution Will group box to preserve the modifications. v Make each subscriber s profile an EXACT COPY of this profile in the Distribution Will area to overwrite the modifications. 6. To prevent subscribers from receiving this profile: a. Select the subscribers from the Distribute to These Subscribers list. b. Click the right arrow button to add the subscribers to the Do Not Distribute to These Subscribers list. Additional Information: The left-arrow button returns the subscriber to the Distribute to These Subscribers list. 7. Click one of the following to distribute the profile: v Distribute to distribute the profile and select another profile to distribute. v Distribute & Close to distribute the profile and close the dialog box. Additional Information: You can choose to add the distribution to the scheduled job for a specific time. See Scheduling a distribution on page 44 for more information. Objective To distribute all profiles in a profile manager so you can pass information to all subscribers. 40 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

53 Background information In the IBM Tivoli Monitoring for Databases, Version 5.1.0: Oracle User Management environment, you can distribute profiles from a profile manager or from a database endpoint. When you distribute a profile from a profile manager, the information for the profiles is sent to the subscribers (that you preselect) of the profile manager. When you distribute a profile from a database endpoint, the information for the profiles is sent to all subscribers of that endpoint and the Oracle database system catalogs. This procedure describes how to distribute all profiles. See Distributing a profile to subscribers on page 38 for information on how to distribute to a specific profile. When you perform this procedure from the Tivoli desktop, you can use one of two shortcut methods or the non-shortcut method. You can use the shortcut methods to distribute one or more profiles to one or more subscribers from the Tivoli desktop. All desktop methods use the distribution defaults for the profile. For more information on distribution defaults for the profile, refer to the Tivoli Management Framework User s Guide. Required authorization roles admin Required for distributing a profile. oracle_dba Required for updating the Oracle database system catalogs. Before you begin v Open the policy region that contains the profiles you want to distribute. Refer to the Tivoli Management Framework Reference Guide for more information on policy regions. v Determine if you should lock or unlock profile records. See Locking and unlocking records on page 36. When you finish None. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command line: Use the wdistrib command to distribute profiles from a profile manager. Refer to the Tivoli Management Framework Reference Guide for more information. Desktop: Use one of the following methods to distribute all profiles in a profile manager to all subscribers: v Non-shortcut Method 1. Right-click the profile manager icon to display the profile manager drop-down menu. Chapter 4. Managing profiles 41

54 2. Select Distribute to display the Distribute Profiles dialog box. v v 3. Do one of the following to distribute all profiles in the profile manager: Click Distribute Now Click Schedule to display the Add Scheduled Jobs dialog box and set a schedule to distribute the profiles. Additional Information: See Distributing a profile to subscribers on page 38 for more information. When you set the schedule, the distribution occurs at the allocated time. Drag and Drop Shortcut method From the profile manager window, drag a selected profile icon and drop it on the appropriate subscriber. The distribution begins immediately. Icon Selection Shortcut method 1. From the Profile Manager window, select the profile and subscriber icons (press the Ctrl key while selecting to select multiple subscribers). 2. Select Profile Manager Distribute to display the Distribute Profiles dialog box. 3. Click the Distribute Now button to distribute all profiles in the profile manager. Click the Schedule button to display the Add Scheduled Jobs dialog box. See Distributing a profile to subscribers on page 38 for more information. When the schedule is set, distribution occurs at the allocated time. 42 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

55 Creating a new copy of a profile Objective To create a new copy of the profile from the distributing profile manager so you can update the subscribing profile manager records. Background information When you copy a profile from a profile manager, an exact copy of the original profile contained in the profile manager is created. Required authorization roles senior Before you begin None. When you finish None. Setting distribution defaults Procedure You can perform this procedure from the Tivoli desktop only. 1. Open the subscribing profile manager. 2. Click one or more of the subscriber s profiles that you want to update with a new copy. 3. Select Profile Manager Get New Copy. 4. Do one of the following: v Select Get Now to get the new copies of the selected profiles. v Select Schedule to display Add Scheduled Job dialog box and schedule a time to copy the profiles. Additional Information: See Distributing a profile to subscribers on page 38 for more information. Objective To set distribution default values for a profile so you can maintain control over your distributions and ensure consistent distribution. Background information The software automatically uses the default profile distribution values that you set on subsequent profile distributions. Required authorization roles admin Before you begin None. When you finish None. Procedure You can perform this procedure from the Tivoli desktop only. Chapter 4. Managing profiles 43

56 1. From a profile manager window, double-click the appropriate profile to display the database profile window. 2. Click Profile to display the Profile drop-down menu. 3. Select Distribute Defaults to display the Set Distribution Defaults dialog. Scheduling a distribution 4. Select the default values for the Distribute To and Distribution Will properties. 5. Set the distribution defaults by doing one of the following: v Click Set to save the values. v Click Set & Close to save the values and close the dialog box. Objective To schedule when a profile is distributed so you can ensure that the distribution occurs automatically. 44 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

57 Background information IBM Tivoli Monitoring for Databases: Oracle utilizes the Scheduler to schedule jobs. For more information about scheduling, see the IBM Tivoli Monitoring for Databases: Oracle User s Guide or the Tivoli Management Framework User s Guide. Required authorization roles admin Before you begin Make sure the profile is ready to be distributed. See Distributing a profile to subscribers on page 38 for information on how to distribute a profile. When you finish None. Procedure You can perform this procedure from the Tivoli desktop only. 1. From a profile manager window, double-click the appropriate profile to display the database profile window. Click Profile to display the Profile drop-down menu. 2. Select Distribute from the Profile drop-down menu. Chapter 4. Managing profiles 45

58 3. Click Schedule to open the Add Scheduled Job dialog box. 4. Specify the date and time in the Schedule Job For group box by doing the following: a. Fill in the following fields: v Month v Day 46 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

59 v Year v Hour v Minute b. Select one of the following: v AM v PM 5. Select one of the following from the Repeat the Job group box to set: v Repeat the job indefinitely to repeat the distribution indefinitely and at specified intervals: a. Type a number in the The job should start every text box. b. Click the list to select the appropriate interval (minutes, hours, weeks, months, days, or years). v Repeat the job to repeat the distribution a specific number of times: a. Type the number of times to repeat it. b. Type a number in the The job should start every text box. c. Click the list to select the appropriate interval (minutes, hours, weeks, months, days, or years). 6. Select one or more of the following in the When Job Completes group box to determine the type of notification you want to receive when the distribution completes: v Post Tivoli Notice option to select a specified notice group. v Post Status dialog box on Desktop option to send it to the Administrator s desktop. v Send to option and type an address. v Log to file option to save the data to a managed node s log file. 7. Name the job by doing one of the following: v Type a name for the job in the Job Label. v Leave it blank to have it default to the Job Name. 8. Do one of the following: v Click Schedule Job & Close to close the Add Scheduled Job dialog box and start the distribution when specified. Note: The procedure is complete. Do not proceed to Step 9 on page 47. v Go to Step 9 on page 47 to set the retry, cancel, and restrictions options. Additional Information: If the scheduler cannot run the job at the scheduled time, the job will not run. However, it will run during the next scheduled time. 9. From the Add Scheduled Job dialog box (see Distributing a profile to subscribers on page 38 for more information), use the following steps to set the retry, cancel, and restrictions options: Chapter 4. Managing profiles 47

60 a. Select Set Retry/Cancel/Restrictions to display the Set Retry/Cancel/Restrictions dialog box. b. Use the following steps to set the cancellation option: 1) Select the Cancel job if it does not start within. 2) Type a time interval in the text box. c. Use the following steps to set the retry options: 1) Select one of the following options: v Retry the job until success v Retry the job v The job should retry every option 2) Type the appropriate retry successions. d. You can set restrictions. Use the following steps to set a restriction on specific times that the distribution should not run: 1) Select one of the following v During the day v At night v During the week 48 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

61 v On weekends 2) Type the appropriate days or times that are restricted. e. Select one of the following to set the selected options: v Set to set the selected options. v Cancel to cancel the changes. Deleting profiles Objective To delete a profile so you can remove it from the profile manager and all subscriber s copies. Background information When you delete a profile, it is removed from the profile manager and all subscriber s copies; however, its objects are not removed from the Oracle database system catalogs. If you move or delete a profile item that corresponds to current information in a profile endpoint s files or databases, a warning is displayed so that you can confirm or the deletion. If you delete an entire profile, no warning is displayed for profile items that correspond to current information in a profile endpoint s files or databases. Thus, you should move or delete all the profile items from the profile before deleting it. When the deletion is complete, the profile icon is removed from the profile manager. Note: Deleting an IBM Tivoli Monitoring for Databases: Oracle database object from the GUI or with the wdel CLI command might result in an intermittent deletion error. When this error occurs, the database object is not deleted. If you receive this error, repeat the database object deletion procedure. Required authorization roles admin Before you begin Move or delete all the profile items from the profile. You need to open the profile manager that contains the profiles you want to delete. For more information, see Creating profiles on page 5 When you finish None. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command line: Use the wdel command to delete profiles from a profile manager. Refer to the Tivoli Management Framework Reference Guide for more information. Desktop: Chapter 4. Managing profiles 49

62 1. Select the profile icons from the profile manager that you want to delete. Additional Information: To select multiple profiles, press and hold the Ctrl key while selecting. 2. Select Edit to display the Edit Profile Manager drop-down menu. 3. Select Profiles to display the Edit Profiles drop-down menu. 4. Select Delete to display the Delete Profiles dialog box. 5. Click Delete to permanently remove the profiles. 50 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

63 Chapter 5. Managing users An Oracle User Profile can help manage your Oracle database users. The Oracle User Profile s managed resource name is OracleUserManagerProfile. User records are contained within user profiles. Each user record is an account specific to that user. User records can save detailed parameters that assist in defining only those resources necessary for that user. This can help limit which and how many users have access to certain resources. The user record contains the following attributes: v User Authentication (OS Authentication, User Password, or Tivoli Controlled Password) v Resource Profiles v Default and Temporary Tablespace v Roles v System Privileges v Object Privileges v Quotas Table 6 shows the guidelines for managing users. You can perform these procedures in any order. The table lists the suggested order. Table 6. Managing users topics Goal Refer to Accessing and understanding the Database User Profile window. Accessing and understanding the Database User Profile window on page 52 Adding a user record. Adding a user record on page 54 Setting the tablespace list. Setting the tablespace list on page 56 Setting tablespace quotas. Setting tablespace quotas on page 57 Setting the default and temporary tablespace. Setting and clearing default values. Setting the default and temporary tablespace on page 59 Setting and clearing default values on page 60 Granting roles to users. Granting roles to users on page 61 Granting system privileges to users. Granting system privileges to users on page 63 Setting object privileges. Setting object privileges on page 65 Viewing object privileges. Viewing object privileges on page 69 Editing a user record. Editing a user record on page 70 Editing multiple user records. Editing multiple user records on page 71 Copying user records. Copying user records on page 75 Moving user records. Moving user records on page 77 Deleting user records. Deleting user records on page 78 51

64 Accessing and understanding the Database User Profile window Objective To view and understand information displayed on the Database User Profile window so you can manage user records. Background information All of your activities for managing users takes place from the Database User Profile window. Required authorization roles admin Before you begin None. When you finish None. Procedure You can perform this procedure from the Tivoli desktop only. 1. Open the Tivoli desktop. 2. Double-click the Policy Region icon to display the Policy Region window. Additional Information: There might be more than one Policy Region icon on your desktop. Choose the appropriate Policy Region in which to add a user record. 3. Open the Profile Manager window by doing one of the following: v Double-click the Profile Manager icon. v Use the Profile Manager drop-down menu by doing the following: a. Right-click the Profile Manager icon to display the Profile Manager drop-down menu. b. Choose Open. 52 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

65 4. Do one of the following to display the Oracle Database User Profile window: v Double-click the Oracle User profile icon in the Profiles group box. v Use the Oracle User profile drop-down menu by doing the following: a. Right-click the Oracle User profile icon to display the Oracle User profile drop-down menu. b. Choose Edit Properties from the Oracle User profile drop-down menu. Chapter 5. Managing users 53

66 Adding a user record Objective To create a record in an Oracle User profile so a user can manage resources. Background information There are two ways to create records in an Oracle User profile: v Add new users. v Populate the profile with existing users. The populate procedure is described in Chapter 4, Managing profiles on page 31. Required authorization roles admin Before you begin When adding a new user, you must define the name, password, and resource profile for that user. When you finish Changes made in the profile are independent of the database. There are no changes made to the Oracle database unless a distribution occurs. To update the database with the changes, you must distribute the profile to the target database. For instructions, see Distributing a profile to subscribers on page 38. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command Line: Use the wocrtuser command to add Oracle users to a profile from the command line. For a description, syntax, example, and other command information, see the IBM Tivoli Monitoring for Databases: Oracle Reference Guide. Desktop: 1. Open the Database User Profile window as described in Accessing and understanding the Database User Profile window on page Display the Add Database User dialog box by doing one of the following: v Click Add. v User the Edit drop-down menu by doing the following: a. Select Edit from the toolbar to display the Edit drop-down menu. b. Select Add from the Edit drop-down menu. 54 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

67 Additional Information: The values defined by the default policies (See Defining the default policy on page 13) determine how Tivoli displays the Add Database User dialog box. Entry fields with default values are disabled. 3. Type the name of the new user in the Name text box. Additional Information: This should be the name that the user enters to log in to the Oracle database. 4. Select one of the following security settings to authenticate the user: OS Authentication Allows Oracle to verify the user s access through the operating system. Additional Information: Tivoli creates an OPS$ account (the actual prefix depends on the value of the INIT.ORA parameter OS_AUTHENT_PREFIX). The OPS$ account verifies if the user accessed the operating system and then grants access to the user profile instead of prompting for a password. Password Allows the user to log in to the Oracle database with a predefined password. Type the password that the user uses to log in to the Oracle database in the Password text box. Additional Information: The characters you type are masked by asterisks for security purposes. 5. Choose one of the following password options: v v Select the User Controls Password check box to allow the user to set the password in the profile. Additional Information: This option allows the user s profile password to be different from the Oracle database password. Clear the User Controls Password check box to allow Tivoli to reset the password for the user. Chapter 5. Managing users 55

68 Setting the tablespace list Additional Information: This option ensures consistency between the password in the profile and the password in the Oracle database. 6. Select a profile: a. Click the Resource Profile drop-down menu. b. Select the resource for the user. Additional Information: The Resource Profile enables you to select the hardware profile to which this user has access. 7. Do one of the following to add the record: v v Click Add to add user to the profile so you can define other user parameters, such as tablespaces, default values, roles, system privileges, and quotas. Follow the appropriate steps as outlined in this chapter. Click Add & Close to add the new user to the profile and close the Add Database User dialog box. Objective To set the tablespace list so you can define appropriate tablespaces for a specific user profile. Background information IBM Tivoli Monitoring for Databases, Version 5.1.0: Oracle User Management maintains a list of tablespaces for each Oracle User profile. This is the list that displays when you select the Default and Temporary Tablespace lists in the Add Database User dialog box or Edit Database User dialog box. Use the Set Tablespaces dialog box to maintain this list. Each IBM Tivoli Monitoring for Databases, Version 5.1.0: Oracle User Management profile maintains a separate list. The list is internal to IBM Tivoli Monitoring for Databases, Version 5.1.0: Oracle User Management, and is not updated in any Oracle data dictionary tables. Required authorization roles senior Before you begin None. When you finish None. Procedure You can perform this procedure from the Tivoli desktop only. 1. Open the Database User Profile window as described in Accessing and understanding the Database User Profile window on page Select Edit from the top left menu. 56 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

69 3. Select Tablespaces to display the Set Tablespaces dialog box. Setting tablespace quotas 4. Type the name of the new tablespace in the Add Tablespace text box. 5. Press the Return or Enter key on your keyboard to add the new tablespace to the Current Tablespaces list. Additional Information: To remove a tablespace from the list, select the tablespace, and click Remove Tablespace. 6. Choose one of the following to set the tablespace list: v Click Set to save (or remove) the tablespace and continue making changes. v Click Set & Close to save (or remove) the tablespace and close the dialog box. Objective To add quotas to tablespaces so you can determine the amount of disk space allocated for each tablespace. Background information None. Required authorization roles admin Before you begin None. When you finish None. Procedure You can perform this procedure from the Tivoli desktop only. 1. Open the Database User Profile window as described in Accessing and understanding the Database User Profile window on page Choose one of the following to display the Add Database User dialog box: v Click Add. v Use the Edit drop-down menu by doing the following: Chapter 5. Managing users 57

70 a. Select Edit from the toolbar to display the Edit drop-down menu. b. Select Add from the Edit drop-down menu. 3. Click the Collapse/Expand arrow button to display the Quotas group box. Additional Information: To revoke or change a tablespace quota, select the quota and click Remove Quota. 4. Click Add Quota to display the Add Tablespace Quota dialog box. 5. Highlight the tablespace where you define a quota in the Tablespace group box. 6. Select the Limit Tablesize check box to enter the quota value and unit of measure. 7. Type a numeric value in the Size text box. 58 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

71 Additional Information: If you do not enter a value, the quota is not set. 8. Select a unit of measure (Bytes, Kb, Mb, orgb) for the value from the Unit list. 9. Choose one of the following to set the tablespace quota: v Click Add to add the quota for the tablespace and continue defining other quotas. v Click Add & Close to add the quota and close the dialog. Additional Information: To cancel the procedure without saving the quota, click Close. Setting the default and temporary tablespace Objective To set the default and temporary tablespaces so you can define where the user s default and temporary objects are stored. Background information If the appropriate tablespace is not in the drop-down list, you can set up a tablespace as described in Setting the tablespace list on page 56. Note: Tivoli recommends that you do not use the SYSTEM tablespace for user objects. Required authorization roles admin Before you begin None. When you finish Changes made in the profile are independent of the database. There are no changes made to the Oracle database unless a distribution occurs. To update the database with the changes, you must distribute the profile to the target database. For instructions, see Distributing a profile to subscribers on page 38. Procedure You can perform this procedure from the Tivoli desktop only. 1. Open the Database User Profile window as described in Accessing and understanding the Database User Profile window on page Choose one of the following to display the Add Database User dialog box: v Click Add. v Use the Edit drop-down menu by doing the following: a. Select Edit from the toolbar to display the Edit drop-down menu. b. Select Add from the Edit drop-down menu. Chapter 5. Managing users 59

72 3. Click the Default Tablespace drop-down menu. 4. Select the appropriate default tablespace. 5. Click the Temporary Tablespace drop-down menu. 6. Select the appropriate temporary tablespace. Setting and clearing default values Objective To set or clear default values so you can use or reset default values. Background information When you set a default value for a new user record, the attributes that have a predefined default value are automatically set to reflect that default value. In other words, the default values are added to the appropriate fields on the screen automatically. This saves time when you define the attributes for each new user record. When you clear the default values, the attributes that have defaults assigned are cleared. You can then enter new values for the user. Required authorization roles admin Before you begin None. When you finish None. Procedure You can perform this procedure from the Tivoli desktop only. 1. Open the Database User Profile window as described in Accessing and understanding the Database User Profile window on page Choose one of the following to display the Add Database User dialog box: v Click Add. 60 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

73 v Use the Edit drop-down menu by doing the following: a. Select Edit from the toolbar to display the Edit drop-down menu. b. Select Add from the Edit drop-down menu. 3. Choose one of the following to either set or clear defaults settings: v Click Set Defaults. Additional Information: The default policy is displayed for each applicable field on the screen. v Click Clear Defaults. Additional Information: Use Reset to return the screen to the values that were present when the screen was originally displayed; however, if you click Add before Reset, any new values that you entered are saved to the profile and remains displayed. Granting roles to users Objective To grant roles in a user record so you can determine the group of related Oracle privileges granted to that user. Background information Roles determine the group of related Oracle privileges that are granted to users. Refer to Chapter 6, Managing roles on page 81 for more information. Required authorization roles admin Before you begin None. Chapter 5. Managing users 61

74 When you finish None. Procedure You can perform this procedure from the Tivoli desktop only. 1. Open the Database User Profile window as described in Accessing and understanding the Database User Profile window on page Select one of the following to display the Add Database User dialog box: v Click Add. v Use the Edit drop-down menu by doing the following: a. Select Edit from the toolbar to display the Edit drop-down menu. b. Select Add from the Edit drop-down menu. 3. Click the Collapse/Expand arrow button to display the Roles group box. 4. Click Add Role. Additional Information: To revoke or change a role, select the role, and click Remove Role. 5. In the Database Roles group box, highlight the role to be granted. Additional Information: The roles listed are standard Oracle roles and any roles defined in the Oracle Role profiles of the current profile manager. Refer to the 62 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

75 Oracle User s Guide for a comprehensive list of available roles. 6. Do one of the following: v Select the Grant Role to Others check box to allow the user to grant the role to other users. v Deselect the Grant Role to Others check box to deny the user from granting the role to other users. 7. Do one of the following: v Select the Default Role check box to make the selected role be a default role. v Deselect the Default Role check box if you do not want the selected role to be the default role. 8. Choose one of the following to grant the role to the user: v Click Add to grant the role and continue adding other roles for the user. v Click Add & Close to grant the role and close the dialog. Additional Information: To cancel the operation without saving the role, click Cancel. Granting system privileges to users Objective To grant Oracle system privileges to users so you can determine the specific Oracle database operation or class of operations that the user can perform. Background information None. Required authorization roles admin Before you begin None. When you finish Changes made in the profile are independent of the database. There are no changes made to the admin database unless a distribution occurs. To update the database Chapter 5. Managing users 63

76 with the changes, you must distribute the profile to the target database. For instructions, see Distributing a profile to subscribers on page 38. Procedure You can perform this procedure from the Tivoli desktop only. 1. Open the Database User Profile window as described in Accessing and understanding the Database User Profile window on page Choose one of the following to display the Add Database User dialog box: v Click Add. v Use the Edit drop-down menu by doing the following: a. Select Edit from the toolbar to display the Edit drop-down menu. b. Select Add from the Edit drop-down menu. 3. Click the Collapse/Expand arrow button to display the System Privileges group box. Additional Information: To revoke or change a system privilege, select the privilege, and click Remove Privilege. 4. Click Add Privilege to display the Add System Privilege dialog. 64 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

77 5. Highlight the system privilege to be granted from the System Privileges group box. Setting object privileges 6. Do one of the following: v Select the Grant Privilege To Others check box to allow the user to grant the system privilege to other users. v Deselect the Grant Privilege to Others check box to deny the user from granting the system privilege to other users. 7. Choose one of the following to grant the privilege: v Click Add to grant the privilege and continue granting other privileges for the user. v Click Add & Close to grant the privilege and close the dialog box. Additional Information: Click Cancel to cancel the procedure without saving the privilege. Objective To grant object privileges so users can execute a command or function on a specific object. Background information Available functions for the user include: v ALTER v DELETE v EXECUTE v INDEX v INSERT v REFERENCES v SELECT v UPDATE Specify the object by defining the schema and object name. In some instances you can update specific columns of an object. Chapter 5. Managing users 65

78 Setting up object privileges for a user is a two-step process. You must first access a Grantor s user profile to complete the second step of defining the Grantee and the object privilege. Tivoli connects to Oracle as the Grantor to grant the privilege to the Grantee. The Grantor must own the object being granted or have object privileges with the GRANT OPTION on the object. In other words, if you are the Grantor, you cannot grant object privileges to a user if you do not own the object yourself or you don t have the ability to grant the object. Note: Tivoli connects as the grantor to issue the GRANT command; therefore, the grantor s password must be set to either OS Authentication or Password with the User Controls Password option cleared. For detailed information about defining a password, see step 4 on page 55. For certain types of privileges, you can specify which data columns receive the granted privilege. For example, you can grant a user the ability to update an employee salary object, but you can limit that update to only those columns that pertain to the employee s address and job title. Only the Update, Insert, and References privileges allow you to select specific columns to receive the privilege. When you select either the Update, Insert, or Reference privilege, three areas become enabled automatically: the Columns scrolling list, the Column Name text box, and the Remove Column button. Required authorization roles admin Before you begin None. When you finish Changes made in the profile are independent of the database. There are no changes made to the Oracle database unless a distribution occurs. To update the database with the changes, you must distribute the profile to the target database. For instructions, see Distributing a profile to subscribers on page 38. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command Line: Use the wosetuser command to set user object privileges from the command line. For a description, syntax, example, and other command information, see the IBM Tivoli Monitoring for Databases: Oracle Reference Guide. Desktop: 1. Open the Database User Profile window as described in Accessing and understanding the Database User Profile window on page Select the user who grants the privileges to another user. 3. Choose one of the following to display the Edit Database User window: v Click Edit. v Use the Edit drop-down menu by doing the following: a. Select Edit from the toolbar to display the Edit drop-down menu. b. Select Edit from the Edit drop-down menu. 66 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

79 4. Click Object Privileges to display the Object Privileges dialog box. Additional Information: The Object Privileges dialog box displays a list of the current privileges owned by the user. 5. Click Add Privilege to display the Add Object Privilege dialog box. Additional Information: To remove an object privilege, select the privilege, and click on Remove Privilege. Chapter 5. Managing users 67

80 6. Type the name of the user receiving the privilege in the Grantee text box. 7. Select the object privilege to be granted from the Object Privileges list. Additional Information: Select the All Privileges option to grant all privileges. Note: If you choose Update, Insert, or References, follow Steps 8 9. Otherwise, skip to Step Type the name of the column in the Column Name text box. 9. Press Return or Enter on your keyboard to add the column name to the Columns text box. Note: If you do not select a specific column, the privilege is granted on all columns. Additional Information: To remove a column from the list, highlight it and click Remove Column. 10. Optional: Select the Privilege Grantable check box if you want the user to be able to grant the privilege to other users. 11. Type the schema name for the database object to be granted in the Schema Name text box. 12. Type the name of the object to be granted in the Object Name text box. 13. Choose one of the following to grant the privilege: v v Click Add to grant the privilege and continue adding others. To return to the Object Privileges dialog box, click Add & Close. Click Add & Close to grant the privilege, close the dialog box and return to the Object Privileges dialog box. 68 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

81 Viewing object privileges Objective To view object privileges so you can confirm what privileges have been granted to a user. Background information The Object Privileges dialog box displays the schema, columns, and grantable option properties for the user. Required authorization roles admin Before you begin None. When you finish None. Procedure You can perform this procedure from the Tivoli desktop only. Desktop: 1. Open the Database User Profile window as described in Accessing and understanding the Database User Profile window on page Select the user record. 3. Select View from the toolbar to display the View drop-down menu. Chapter 5. Managing users 69

82 4. Select Granted Privileges to display the Object Privileges dialog box. Editing a user record Objective To access a single user record in a profile so you can modify the user s parameters. Background information You can modify single or multiple user records in a profile. To edit multiple user records, see Editing multiple user records on page 71. Required authorization roles admin Before you begin None. When you finish Changes made in the profile are independent of the database. There are no changes made to the Oracle database unless a distribution occurs. To update the database with the changes, you must distribute the profile to the target database. For instructions, see Distributing a profile to subscribers on page 38. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command line: Use the wosetuser command to edit a user record in a profile from the command line. For a description, syntax, example, and other command information, see the IBM Tivoli Monitoring for Databases: Oracle Reference Guide. Desktop: 1. Open the Database User Profile window as described in Accessing and understanding the Database User Profile window on page Select the user record that you want to modify. 3. Choose one of the following to display the Edit Database User dialog box: v Click Edit. v Use the Edit drop-down menu by doing the following: a. Select Edit from the toolbar to display the Edit drop-down menu. b. Select Edit from the Edit drop-down menu. 70 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

83 4. Type or select new values in the appropriate fields to change parameters for the user. Additional Information: See Adding a user record on page 54 for details on the fields of this screen. 5. Choose one of the following to accept the new parameters: Editing multiple user records v v Click Change to accept the new parameters and continue other modifications. Click Change & Close to accept the new parameters and return to the Database User Profile dialog box. Objective To access multiple user records in a profile so you can modify the users parameters. Background information You can modify single or multiple user records in a profile. To edit a single user record, see Editing a user record on page 70. You can search the user records by setting the criteria for a specific attribute. Tivoli displays and selects all records that meet the criteria then enables you to edit all of the selected records simultaneously. You can also sort the records by users or attributes, so that you can select the records you want to edit. Required authorization roles admin Before you begin None. When you finish Changes made in the profile are independent of the database. There are no changes made to the Oracle database unless a distribution occurs. To update the database Chapter 5. Managing users 71

84 with the changes, you must distribute the profile to the target database. For instructions, see Distributing a profile to subscribers on page 38. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command Line: Use the wosetusers command to edit multiple user records in a profile from the command line. For a description, syntax, example, and other command information, see the IBM Tivoli Monitoring for Databases: Oracle Reference Guide. Desktop: 1. Open the Database User Profile window as described in Accessing and understanding the Database User Profile window on page Choose one of the following options to locate the user records to modify: v Search the User Database a. Select View from the toolbar to display the View drop-down menu. b. Select Find to display the Find Records dialog box. c. Select the attribute to modify in the Attributes group box. d. Set the type of search that Tivoli performs by doing the following: 1) Click the comparison operator list. 2) Select one of the following: v Exact Match for records that equal a certain value. v Contains for records that contain a certain value. v Greater than for records whose value is greater than a certain value. v Less than for records whose value is less than a certain value. 72 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

85 e. Type the value for the search criteria in the text box next to the comparison operator list. Additional Information: This box is case sensitive, so you must type the criteria as it is displayed in the database. f. Choose one of the following search options: v Click Find All to find all records that match the criteria. v Click Find First to find the first occurrence of a record that matches the criteria. v Click Find Next to find the next occurrence of a record that matches the criteria. g. Refer to the Database User Profile window to verify the appropriate records were found when the search is complete. Additional Information: Notice that the records found in the Database User Profile window are automatically selected. h. Optional: Click Show Selected if you want to display only the records that matched the search. v Sort by User a. Select View from the toolbar to display the View drop-down menu. b. Select Sort from the View drop-down menu to display the Sort drop-down menu. c. Select Users from the Sort drop-down menu to display the Sort Records dialog box. Chapter 5. Managing users 73

86 Additional Information: The Username record label field is selected as shown in the Sort Records example. d. Choose one of the following sort order options: v Select Ascending Sort. v Select Descending Sort. e. Click Sort & Close. The newly sorted records are displayed in the Database User Profile. v Sort by Attribute a. Select View from the toolbar to display the View drop-down menu. b. Select Sort from the View drop-down menu to display the Sort drop-down menu. c. Select Attributes from the Sort drop-down menu to display the Display Attributes dialog box. d. Click the left or right arrow button to move the attributes to one of the following lists: v Attributes in the Attributes Displayed list are sorted. v Attributes in the Attributes Not Displayed list are not sorted. e. Click Sort & Close to sort the records and close the dialog box. The newly sorted records are displayed in the Database User Profile window. 3. Choose one of the following: v Click Edit to edit multiple attributes from the Select Attributes to Edit dialog box. 74 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

87 v Click the specific attribute button such as User Controlled to edit a single attribute. Copying user records Additional Information: The specific attribute buttons are the column headers for the database records in the Database User Profile window. Tivoli displays the Edit Multiple Database Users dialog box. Only those attributes that you selected are enabled for modification. 4. Modify the text or selection of the attribute. 5. Choose one of the following to save profile changes: v Click Change to save profile changes and continue making modifications. v Click Change & Close to save profile changes and close the Edit Multiple Database User dialog box. Additional Information: Tivoli displays the modified records in the Database User Profile window. Additional Information: You can click Cancel to cancel any unsaved changes and close the dialog box. Objective To copy user records from one profile to another profile. Background information One of the most useful features of IBM Tivoli Monitoring for Databases, Version 5.1.0: Oracle is that of copying user profile information from one Oracle profile to another and distributing this profile to create new users in a different Oracle database. When copying records from one profile to another, an exact copy of the source profile s records is created in the target profile. The Copy Profile Records dialog enables you to select the profiles to copy from a list of profile managers. The Target Profiles scrolling list contains the profiles to which the records is copied. Note that the target profile cannot be in the same profile manager as the source profile. You can copy user records from one profile to another profile. However, the user records cannot be located in the same profile manager. Required authorization roles admin Chapter 5. Managing users 75

88 Before you begin When copying user profiles, it is important to note the default tablespace to which these users belong. If the database to which these users are being imported does not have this tablespace available, an SQL error occurs on user creation. When you finish Changes made in the profile are independent of the database. There are no changes made to the Oracle database unless you distribute the profile. To update the database with the changes, you must distribute the profile to the target database. For instructions, see Distributing a profile to subscribers on page 38. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command Line: Use the wocpuser command to copy user records between profiles from the command line. For a description, syntax, example, and other command information, see the IBM Tivoli Monitoring for Databases: Oracle Reference Guide. Desktop: 1. Open the Database User Profile window as described in Accessing and understanding the Database User Profile window on page Select the database user record that you want to copy to another profile. Additional Information: To highlight separate rows, hold the control key on selection. To highlight a block of users, hold the shift key. 3. Select Edit from the toolbar to display the Edit drop-down menu. 4. Select Copy from the Edit drop-down menu to display the Copy Profile Records dialog box. 76 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

89 Moving user records 5. Select the profile manager that the user record is to be copied to from the Available Profile Managers list. 6. Select the profile that the user record is being copied to from the Available Profiles list. 7. Click the right arrow button to add the selection to the Target Profiles list. 8. Choose one of the following to copy the profile: v Click Copy to copy the profile and continue copying other profiles. v Click Copy & Close to copy the profiles and close the dialog box. Objective To move records from one user profile to another. Background information Moving records from one profile deletes specified records from the source profile and adds them to the target profile. The target profile must be in the same profile manager as the source profile. Required authorization roles admin Before you begin None. When you finish Changes made in the profile are independent of the database. To update the database with the changes, you must distribute the profile to the target database. For instructions, see Distributing a profile to subscribers on page 38. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command Line: Use the womvuser command to move user records from one profile to another from the command line. For a description, syntax, example, and other command information, see the IBM Tivoli Monitoring for Databases: Oracle Reference Guide. Desktop: Chapter 5. Managing users 77

90 1. Open the Database User Profile window as described in Accessing and understanding the Database User Profile window on page Select the record you want to move. 3. Select Edit from the toolbar to display the Edit drop-down menu. 4. Select Move from the Edit drop-down menu to display the Move Records dialog box. Deleting user records 5. Select the profile manager that contains the profile where the record is moved from the Available Profile Managers list. 6. Select the profile where the record is moved from the Available Profiles list. 7. Choose one of the following to move the user record: v Click Close to cancel the user record move. v Click Move & Close to move the record and close the dialog box. Objective To delete a user record so you remove it from access to the Oracle database. Background information When you delete a user record, you must remove the record from the profile and then distribute the profile to the Oracle database. After it is distributed, it is removed from the Oracle database. When you choose to delete a record, you can select to delete the user s owned objects as well. 78 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

91 Required authorization roles admin Before you begin None. When you finish Changes made in the profile are independent of the database. There are no changes made to the Oracle database unless a distribution occurs. To update the database with the changes, you must distribute the profile to the target database. For instructions, see Distributing a profile to subscribers on page 38. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command Line: Use the wodeluser command to drop users from a profile using the command line. For a description, syntax, example, and other command information, see the IBM Tivoli Monitoring for Databases: Oracle Reference Guide. Desktop: 1. Open the Database User Profile window as described in Accessing and understanding the Database User Profile window on page Select the user that you want to remove. 3. Choose one of the following to display the Delete Database User(s) dialog box: v Click Delete. v Use the Edit drop-down menu by doing the following: a. Select Edit from the toolbar to display the Edit drop-down menu. b. Select Delete from the Edit drop-down menu. 4. Choose one of the following: v Click Delete With Cascade to delete the user record and their owned objects. v Click Delete Without Cascade to delete the user record without deleting the user s owned object. Note: If you delete with cascade, the user and all its associated objects are deleted. If you delete without cascade, only the user is deleted. There are some objects (typically those objects exclusively owned by the user) that must be deleted before Tivoli enables the record to be deleted. Additional Information: You can click Cancel to cancel the deletion. Chapter 5. Managing users 79

92 80 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

93 Chapter 6. Managing roles You can manage Oracle database roles from IBM Tivoli Monitoring for Databases, Version 5.1.0: Oracle User Management. A role defines the access rights that a user has on a set of resources. Roles represent the privileges that determine the tasks and processes that users can execute in Oracle databases. Role records are created inside of role profiles. By grouping role records into profiles, you can assign the tasks and processes to user groups. You can set up your role profiles in groups of similar tasks. Be aware that adding and granting roles allows groups varying degrees of security and organizational parameters. You can set default policies for each role profile. A default policy enables you to set initial values for each attribute in a profile that is applied automatically when new records are created in a profile. For example, you can set a default value for the role profile s system privileges, and when a new role record is created, this attribute is already set to the value that you defined as the default. Table 7 shows the guidelines for managing roles. Note: You can perform these role procedures in any order. The table lists the procedures in the suggested order. Table 7. Guidelines for managing roles Goal Refer to Accessing and understanding the Database Role Profile window. Accessing and understanding the Database Role Profile window on page 81 Adding role records. Adding role records on page 84 Setting and clearing default values. Setting and clearing default values on page 86 Searching and sorting role records. Searching and sorting the role database on page 87 Granting role records to role profiles. Granting role records to role profiles on page 91 Granting system privileges. Granting system privileges on page 92 Editing a role record. Editing a role record on page 94 Editing multiple role records. Editing multiple role records on page 95 Copying role records. Copying role records on page 99 Moving role records. Moving role records on page 101 Deleting role records. Deleting role records on page 102 Accessing and understanding the Database Role Profile window Objective To view and understand information displayed on the Database Role Profile window so you can manage role records. 81

94 Background information All of your activities for managing roles takes place from the Database Role Profile window. Required authorization roles admin Before you begin None. When you finish None. Procedure You can perform this procedure from the Tivoli desktop only. Desktop: 1. Open the Tivoli desktop. 2. Double-click the Policy Region icon to display the Policy Region window. Additional Information: There might be more than one Policy Region icon on your desktop. Choose the appropriate Policy Region icon in which to add a user record. 3. Do one of the following to open the Profile Manager window: v Double-click the Profile Manager icon. v Use the Profile Manager drop-down menu by doing the following: a. Right-click the Profile Manager icon to display the Profile Manager drop-down menu. b. Choose Open from the Profile Manager drop-down menu. 82 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

95 4. Do one of the following to display the Database Role Profile window: v Double-click the Oracle Role profile icon in the Profiles group box. v Use the Oracle Role profile drop-down menu by doing the following: a. Right-click the Oracle Role profile icon to display the Oracle Role profile drop-down menu. b. Choose Edit Properties from the Oracle Role profile drop-down menu. 5. Optional: Do the following to read a description for the options in this window: a. Select Help from the toolbar to display the Help drop-down menu. b. Select Database Role Profile from the Help drop-down menu. Chapter 6. Managing roles 83

96 Adding role records c. Click Dismiss to close the help window. Objective To add a role record so you can associate the role to users. Background information When you add a database role to the Tivoli environment, you can then associate the role to multiple users. The roles that you add should be representative of the database tasks and processes that are common to your information technology (IT) environment. Required authorization roles admin Before you begin None. When you finish Changes made in the profile do not automatically update the database. For these changes to be effective to the Oracle database, you need to perform a distribution. For instructions, see Distributing a profile to subscribers on page 38. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command Line: Use the wocrtrole command to add a role to a profile from the command line. For a description, syntax, example, and other command information, see the IBM Tivoli Monitoring for Databases: Oracle Reference Guide. Desktop: 1. Open the Database Role Profile window as described in Accessing and understanding the Database Role Profile window on page Display the Add Database Role dialog box by doing the following: v Click Add. v Use the Edit drop-down menu by doing the following: a. Select Edit from the toolbar to display the Edit drop-down menu. b. Select Add from the Edit drop-down menu. 84 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

97 Additional Information: The values displayed in the Add Database Role dialog box are defined by default policies (see Defining the default policy on page 13). Entry fields with default values are disabled. 3. Type the name of the new role in the Name text box. 4. Select one of the following Authentication options to authenticate the user before they are allowed to enable the role: PASSWORD Requires the user to enter a predefined password that you define in Step 5. OS Requires the operating system to verify the user. If you choose this option, go to Step 6. NONE Requires no password for user verification. If you choose this option, go to Step Optional: If you selected PASSWORD for the authentication, type the required password in the Password text box. The characters you type are masked with asterisks for security purposes. 6. Optional: Grant role records to this role profile as described in Granting role records to role profiles on page Optional: Grant system privileges to this role as described in Granting system privileges on page 92. Chapter 6. Managing roles 85

98 8. Optional: Set default values as described in Setting and clearing default values on page Do one of the following: v Click Add to add the new role to the profile. Setting and clearing default values v Click Add & Close to add the new role to the profile and close the dialog box. Objective To set or clear the default values so you can use or reset default values in the Database Role Profile role records. Background information When you set default values for role records, the default values are added to the appropriate fields on the screen automatically. This saves time when you define the attributes for each new role record. When you clear the default values, the attributes that have defaults assigned are cleared. You can then enter new values for the role. Required authorization roles admin Before you begin None. When you finish None. Procedure You can perform this procedure from the Tivoli desktop only. 1. Open the Database Role Profile window as described in Accessing and understanding the Database Role Profile window on page Do one of the following to display the Add Database Role dialog box: v Click Add. v Use the Edit drop-down menu by doing the following: a. Select Edit from the toolbar to display the Edit drop-down menu. b. Select Add from the Edit drop-down menu. 86 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

99 3. Do one of the following: v Click Set Defaults to display the default policy for each applicable field on the screen. v Click Clear Defaults to remove all predefined default values. Note: Use Reset to return the screen to the values that were present when the screen was originally displayed; however, if you click Add before Reset, any new values that you entered are saved to the profile and remain displayed. Searching and sorting the role database Objective To search and sort the role database for a specific record or records so you can locate and order specific role records, especially for editing purposes. Background information You can search the role database for a specific record or records. Tivoli displays and selects all records that meet your chosen criteria. Tivoli also enables you to edit all of the selected records simultaneously. You can also sort the records by roles or attributes to quickly find specific records. When you sort by attributes, the roles are displayed with the selected attributes prominently displayed. Records can also be sorted in ascending or descending alphabetic order. Required authorization roles admin Before you begin None. Chapter 6. Managing roles 87

100 When you finish None. Procedure You can perform this procedure from the Tivoli desktop only. 1. Open the Database Role Profile window as described in Accessing and understanding the Database Role Profile window on page Select View from the toolbar to display the View drop-down menu. 3. Select Find from the View drop-down menu to display the Find Records dialog box. 4. Select the attribute that you want to modify from the Attributes list. 5. Click the comparison operator list to display the comparison operator drop-down menu. 6. Select one of the following to set the type of search that Tivoli performs: v Exact Match for records that equal a certain value. v Contains for records that contain a certain value. v Greater than for records whose value is greater than a certain value. v Less than for records whose value is less than a certain value. 7. Type the value for the search criteria in the text box next to the comparison operator list. Note: This box is case-sensitive, so you must type the criteria as they appear in the database. 8. Do one of the following to search records: v Click Find All to find all records that match the criteria. 88 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

101 v Click Find First to find the first occurrence of a record that matches the criteria. v Click Find Next to find the next occurrence of a record that matches the criteria. 9. Click Close to close the Find Records dialog box. 10. Refer to the Database Role Profile window to verify that the appropriate records were found. 11. Optional: Do the following to display and select only those records that match the criteria: a. Click Show Selected to display only those records that match the search criteria. b. Click Select All to highlight those records. 12. Optional: Do one of the following to sort the found records: v Sort by Role a. Select View from the toolbar to display the View drop-down menu. b. Select Sort from the View drop-down menu to display the Sort drop-down menu. c. Select Roles from the Sort drop-down menu to display the Sort Records dialog box. Additional Information: The Sort Records dialog box is displayed with the Name attribute preselected in the Record Label Field list. This list displays all attributes for the role and you can sort the records by Name or select a different attribute. d. Select one of the following to sort the records: v Select Ascending Sort to sort in alphabetic order. Chapter 6. Managing roles 89

102 v Select Descending Sort to sort in reverse alphabetic order. e. Do one of the following: v Click Sort to sort the records. v Click Sort & Close to sort the records and close the dialog box. f. Refer to the Database Role Profile window to verify that the records were sorted. v Sort by Attribute a. Select View from the toolbar to display the View drop-down menu. b. Select Sort from the View drop-down menu to display the Sort drop-down menu. c. Select Attributes from the Sort drop-down menu to display the Display Attributes dialog box. d. Click the left or right arrow button to move the attributes to one of the following lists: v Attributes in the Attributes Displayed list are sorted. v Attributes in the Attributes Not Displayed list are not sorted. e. Optional: Choose the order in which the records are displayed by doing the following: 1) Select an attribute from the Attributes Displayed list. 90 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

103 2) Use the up or down arrow to move it to the appropriate position in the scroll list. 3) Repeat until the attributes are listed in your preferred order. f. Do one of the following: v Click Sort to sort the records. v Click Sort & Close to sort the records and close the dialog box. Granting role records to role profiles Objective To grant other roles to the role record so you can specify the group of related Oracle privileges that are granted to users. Background information Roles determine the group of related Oracle privileges that are granted to users. The granted roles determine the additional database tasks that the role can execute. Required authorization roles admin Before you begin None. When you finish Changes made in the profile are independent of the database. There are no changes made to the Oracle database unless a distribution occurs. To update the database with the changes, you must distribute the profile to the target database. For instructions, see Distributing a profile to subscribers on page 38. Procedure You can perform this procedure from the Tivoli desktop only. 1. Open the Database Role Profile window as described in Accessing and understanding the Database Role Profile window on page Select the role profile to which you want to add a role record. 3. Click Edit to display the Edit Database Role dialog box. 4. Click Collapse/Expand to display the Roles group box. 5. Click Add Role to display the Add Role dialog box. Chapter 6. Managing roles 91

104 Additional Information: To revoke or change a role, select the role and click Remove Role. Granting system privileges 6. Select the role to be granted from the Database Roles list. Additional Information: The Database Roles list contains the standard, predefined Oracle roles, plus any roles defined in the Oracle role profiles in the current profile manager. 7. Choose one of the following: v Select the Grant Role to Others check box to allow the user to grant the role to other users. v Deselect the Grant Role to Others check box to deny the user from granting the role to other users. 8. Do one of the following: v Click Add to grant the role. v Click Add & Close to grant the role and close the dialog box. Additional Information: Click Cancel to cancel the operation. 9. Do one of the following: v Click Close to grant the role. v Click Change & Close to grant the role and close the dialog box. Objective To grant Oracle system privileges to users so you can determine the specific Oracle database operation or class of operations that the user can perform. Background information Tivoli enables you to grant Oracle system privileges on roles. System privileges determine the specific Oracle database operation or class of operations that can be performed. This option determines whether or not a user that is granted a role can perform a database operation. Required authorization roles admin 92 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

105 Before you begin None. When you finish None. Procedure You can perform this procedure from the Tivoli desktop only. 1. Open the Database Role Profile window as described in Accessing and understanding the Database Role Profile window on page Select the role profile to which you want to grant system privileges. 3. Click Edit to display the Edit Database Role dialog box. 4. Click Collapse/Expand to display the System Privileges group box. 5. Click Add Privilege to display the Add System Privilege dialog box. Additional Information: To revoke or change a system privilege, select the privilege and click Remove Privilege. 6. Select the system privilege to be granted from the System Privileges list. 7. Do one of the following: Chapter 6. Managing roles 93

106 v Editing a role record Select the Grant Privilege To Others check box to enable the role to grant the system privilege to other roles. v Deselect the Grant Privilege To Others check box to deny the role from granting the system privilege to other roles. 8. Do one of the following: v Click Add to grant the privilege and continue granting other privileges. v Click Add & Close to grant the privilege and close the dialog box. Additional Information: You can click Cancel to cancel the operation. 9. Do one of the following: v Click Close to grant the privileges. v Click Change & Close to grant the privileges and close the dialog box. Objective To edit a role record in a profile so you can modify the parameters defined in the role. Background information Changes made in the profile are independent of the database. There are no changes made to the Oracle database unless a distribution occurs. To update the database with the changes, you must distribute the profile to the target database. For instructions, see Distributing a profile to subscribers on page 38. Required authorization roles admin Before you begin None. When you finish After you edit the records, you must distribute the profile to update the database. For instructions, see Distributing a profile to subscribers on page 38. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command Line: Use the wosetrole command to edit a role in a profile from the command line. For a description, syntax, example, and other command information, see the IBM Tivoli Monitoring for Databases: Oracle Reference Guide. Desktop: 1. Open the Database Role Profile window as described in Accessing and understanding the Database Role Profile window on page Do one of the following to display the Edit Database Role dialog box: a. Select the role record that you want to modify. b. Click Edit. 94 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

107 a. Select the role record that you want to modify. b. Select Edit from the toolbar to display the Edit drop-down menu. c. Select Edit from the Edit drop-down menu. Editing multiple role records 3. Type or select the new value in the appropriate fields to change any of the parameters for the role. Additional Information: See Adding role records on page 84 for details on the various fields of this screen. 4. Do one of the following: v Click Close to accept the new parameters. v Click Change & Close to accept the new parameters and close the dialog box. Objective To edit multiple role records in a profile so you can simultaneously modify the parameters defined in the roles. Background information Changes made in the profile are independent of the database. There are no changes made to the Oracle database unless a distribution occurs. To update the database with the changes, you must distribute the profile to the target database. For instructions, see Distributing a profile to subscribers on page 38. Required authorization roles admin Before you begin None. When you finish After you edit the records, you must distribute the profile to update the database. For instructions, see Distributing a profile to subscribers on page 38. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Chapter 6. Managing roles 95

108 Command Line: Use the wosetroles command to edit multiple roles in a profile from the command line. For a description, syntax, example, and other command information, see the IBM Tivoli Monitoring for Databases: Oracle Reference Guide. Desktop: 1. Open the Database Role Profile window as described in Accessing and understanding the Database Role Profile window on page Choose one of the following options to locate the role records to modify: v Search the Role Database a. Select View from the toolbar to display the View drop-down menu. b. Select Find from the View drop-down menu to display the Find Records dialog box. c. Select the attribute to modify in the Attributes group box. d. Set the type of search that Tivoli performs by doing the following: 1) Click the comparison operator list. 2) Select one of the following: v Exact Match for records that equal a certain value. v Contains for records that contain a certain value. v Greater than for records whose value is greater than a certain value. v Less than for records whose value is less than a certain value. e. Type the value for the search criteria in the text box next to the comparison operator list. Additional Information: This box is case sensitive, so you must type the criteria as it is displayed in the database. f. Choose one of the following search options: 96 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

109 v v Click Find All to find all records that match the criteria. Click Find First to find the first occurrence of a record that matches the criteria. v Click Find Next to find the next occurrence of a record that matches the criteria. g. Refer to the Database Role Profile window to verify the appropriate records were found when the search is complete. Additional Information: The records found in the Database Role Profile window are automatically selected. h. Optional: Click Show Selected if you want to display only the records that matched the search. i. Do one of the following: v Click Sort to sort the records. v Click Sort & Close to sort the records and close the dialog box. Additional Information: The newly sorted records are displayed in the Database Role Profile window. v Sort by Roles a. Select View from the toolbar to display the View drop-down menu. b. Select Sort from the View drop-down menu to display the Sort drop-down menu. Chapter 6. Managing roles 97

110 c. Select Roles from the Sort drop-down menu to display the Sort Records dialog box. d. Select a field by which to sort from the Sort By list. e. Choose one of the following sort order options: v Select Ascending Sort to sort the matching records in alphabetic order. v Select Descending Sort to sort the matching records in reverse alphabetic order. f. Select an attribute label from the Record Label Field scrolling list. Additional Information: The attribute label is displayed in the left-hand column of the Properties dialog. g. Do one of the following: v Click Sort to sort the records. v Click Sort & Close to sort the records and close the dialog box. Additional Information: The newly sorted records are displayed in the Database Role Profile window. v Sort by Attribute a. Select View from the toolbar to display the View drop-down menu. b. Select Sort from the View drop-down menu to display the Sort drop-down menu. c. Select Attributes from the Sort drop-down menu to display the Display Attributes dialog box. 98 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

111 Copying role records d. Click the left or right arrow button to move the attributes to one of the following lists: v Attributes in the Attributes Displayed list are sorted. v Attributes in the Attributes Not Displayed list are not sorted. e. Do one of the following: v Click Sort to sort the records. v Click Sort & Close to sort the records and close the dialog box. The newly sorted records are displayed in the Database Role Profile window. 3. Click Edit to edit multiple attributes from the Select Attributes to Edit dialog box. 4. Click on the specific attribute button such as User Controlled to edit a single attribute. Additional Information: The specific attribute buttons are the column headers for the database records in the Database Role Profile window. Note: Tivoli displays the Edit Multiple Database Roles dialog box. Only those attributes that you selected are enabled for modification. 5. Modify the text or selection of the attribute. 6. Do one of the following: v Click Change to save profile changes. v Click Change & Close to save profile changes and close the Edit Multiple Database Roles dialog box. Additional Information: Tivoli displays the modified records in the Database Role Profile window. Additional Information: You can click Cancel to cancel any unsaved changes and close the dialog box. Objective To copy role records to another profile so you can perform the same Oracle tasks in a different profile. Background information You can copy role records to another profile; however, the role records cannot be located in the same profile manager. Required authorization roles admin Before you begin None. When you finish None. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Chapter 6. Managing roles 99

112 Command Line: Use the wocprole command to copy role records between profiles from the command line. For a description, syntax, example, and other command information, see the IBM Tivoli Monitoring for Databases: Oracle Reference Guide. Desktop: 1. Open the Database Role Profile window as described in Accessing and understanding the Database Role Profile window on page Select the database role record that you want to copy to another profile. 3. Select Edit from the toolbar to display the Edit drop-down menu. 4. Select Copy from the Edit drop-down menu to display the Copy Profile Records dialog box. 5. Select the profile manager from the Available Profile Managers list. Additional Information: The Available Profile Managers list contains the role profile to which the role record will be copied. 6. Select the profile to which the role record will be copied from the Available Profiles list. 7. Click the right arrow button to add the selection to the Target Profiles list. 8. Do one of the following: v Click Copy to copy the role record to the selected profile. 100 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

113 v Moving role records Click Copy & Close to copy the role record to the selected profile and close the dialog box. Objective To move a role record from one role profile to another so you can perform the same Oracle tasks in a different profile. Background information None. Required authorization roles admin Before you begin None. When you finish None. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command Line: Use the womvrole command to move role records from one profile to another from the command line. For a description, syntax, example, and other command information, see the IBM Tivoli Monitoring for Databases: Oracle Reference Guide. Desktop: 1. Open the Database Role Profile window as described in Accessing and understanding the Database Role Profile window on page Select the record you want to move. 3. Select Edit from the toolbar to display the Edit drop-down menu. Chapter 6. Managing roles 101

114 4. Select Move from the Edit drop-down menu to display the Move Records dialog box. Deleting role records 5. Select the profile manager that contains the profile to where the record will be moved from the Available Profile Managers list. Additional Information: The Available Profiles list displays all available profiles for each selected profile manager. 6. Select the profile to where the record will be moved from the Available Profiles list. 7. Click Move & Close to move the record and close the dialog box. Objective To delete a role record so the role is no longer available to the user. Background information None. Required authorization roles admin Before you begin Make certain that you want to delete the roles. Tivoli does not prompt for confirmation of the operation. When you finish Changes made in the profile are independent of the database. There are no changes made to the Oracle database unless a distribution occurs. To update the database with the changes, you must distribute the profile to the target database. For instructions, see Distributing a profile to subscribers on page 38. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command Line: Use the wodelrole command to drop roles from a profile using the command line. For a description, syntax, example, and other command information, see the IBM Tivoli Monitoring for Databases: Oracle Reference Guide. Desktop: 1. Open the Database Role Profile window as described in Accessing and understanding the Database Role Profile window on page Select the role that you want to remove from the profile. 102 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

115 3. Do one of the following: v Click Delete. v Use the Edit drop-down menu by doing the following: a. Select Edit from the toolbar to display the Edit drop-down menu. b. Select Delete from the Edit drop-down menu. Additional Information: If you attempt to delete a role that has been granted to another role, a Role Deletion window is displayed that informs you that the deletion has affected another role. Chapter 6. Managing roles 103

116 104 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

117 Chapter 7. Managing resources An Oracle Resource Profile can help manage your Oracle database resources. Resources are hardware components or processes of your computing system. Examples of these are main storage, input/output devices, central processing unit (CPU), data sets, and control or processing programs. Resource records are contained within resource profiles. When a resource record is added, you can assign the resource to a user or role. Setting parameters within a resource record assists in the functionality of resources by ensuring they don t become overloaded. Table 8 shows the guidelines for managing resources. You can perform these procedures in any order. The table lists the procedures in the suggested order. Table 8. Managing resources topics Goal Accessing and understanding the Database Resource Profile window. Setting and clearing default values. Refer to Accessing and understanding the database resource profile window on page 105 Setting and clearing default values on page 107 Adding resource records. Adding resource records on page 108 Editing a resource record. Editing a resource record on page 110 Editing multiple resource records. Editing multiple resource records on page 112 Copying resource record. Copying resource records on page 115 Moving resource records. Moving resource records on page 117 Deleting resource records. Deleting resource records on page 118 Accessing and understanding the database resource profile window Objective To view and understand information displayed on the Database Resource Profile window so you can manage resource records. Background information All of your activities for managing resources take place from the Database Resource Profile window. Required authorization roles admin Before you begin None. When you finish None. 105

118 Procedure You can perform this procedure from the Tivoli desktop only. 1. Open the Tivoli desktop. 2. Double-click the Policy Region icon to display the Policy Region window. Additional Information: There might be more than one Policy Region icon on your desktop. Choose the appropriate Policy Region icon in which to add a user record. 3. Do one of the following to open the Profile Manager window: v Double-click the Profile Manager icon. v Use the Profile Manager drop-down menu by doing the following: a. Right-click the Profile Manager icon to display the Profile Manager drop-down menu. b. Choose Open from the Profile Manager drop-down menu. 4. Do one of the following to display the Database Resource Profile window: v Double-click the Oracle Resource profile icon in the Profiles group box. v Use the Oracle Resource profile drop-down menu by doing the following: a. Right-click the Oracle Resource profile icon to display the Oracle Resource profile drop-down menu. b. Choose Edit Properties from the Oracle Resource profile drop-down menu. 106 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

119 5. Optional: Do the following to read a description for the options in this window: a. Select Help from the toolbar to display the Help drop-down menu. b. Select Database Resource Profile from the Help drop-down menu. Setting and clearing default values Objective To set or clear the default values so you can use or reset default values in the Database Resource Profile. Background information When you set a default value for a new resource record, the attributes that have predefined default values are automatically set to reflect those default values. In other words, the default values are added to the appropriate fields on the screen. This enables you to quickly define the attributes for each new resource record. When you clear the default values, the attributes that have defaults assigned are cleared. You can then enter new values for the resource. Required authorization roles admin Before you begin None. When you finish None. Procedure You can perform this procedure from the Tivoli desktop only. Desktop: 1. Open the Database Resource Profile window as described in Accessing and understanding the database resource profile window on page Do one of the following to display the Add Database Resource dialog box: v Click Add to add new resources to the profile. v Use the Edit drop-down menu by doing the following: a. Select Edit from the toolbar to display the Edit drop-down menu. Chapter 7. Managing resources 107

120 b. Select Add from the Edit drop-down menu. Adding resource records 3. Do one of the following: v Click Set Defaults to display the default policy for each applicable field on the screen. v Click Clear Defaults to remove all predefined default values. Note: Click Reset to return the screen to the values that were present when the screen was originally displayed; however, if you click Add before you click Reset, any new values that you entered are saved to the profile and cannot be reset. Objective To add a resource record so you can manage how each resource is used. Background information None. Required authorization roles admin Before you begin None. When you finish Changes made in the profile are independent of the database. There are no changes made to the Oracle database unless a distribution occurs. To update the database with the changes, you must distribute the profile to the target database. For instructions, see Distributing a profile to subscribers on page IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

121 Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command Line: Use the wocrtresource command to add a resource profile to a profile. For a description, syntax, example, and other command information, see the IBM Tivoli Monitoring for Databases: Oracle Reference Guide. Desktop: 1. Open the Database Resource Profile window as described in Accessing and understanding the database resource profile window on page Do one of the following to display the Add Database Resource dialog box: v Click Add to add new resources to the profile. v Use the Edit drop-down menu by doing the following: a. Select Edit from the toolbar to display the Edit drop-down menu. b. Select Add from the Edit drop-down menu. Additional Information: The values defined by the default policies (see Defining the default policy on page 13) determine how the Add Database Resource dialog box is displayed. Entry fields with default values are disabled. 3. Type the name of the new resource in the Name text box. 4. Use the following steps to define limits on attributes: a. Select one of the following attributes to define: v v Composite Limit: Limits the total resource cost for a session. See the relevant version of the Oracle Server SQL Language Reference Manual for details of how this cost is calculated. Sessions Per User: Limits the number of concurrent sessions for a user. This is useful if you have limited resources and can only run a certain number of sessions. It can be also used to control licensing. Chapter 7. Managing resources 109

122 Editing a resource record v CPU Per Call: Limits the CPU time for a parse, execute, or fetch operation. Expressed in hundredths of a second. v Logical Reads Per Call: Limits the number of data blocks read for a parse, execute, or fetch operation. Expressed as a number of blocks. v Idle Time: Limits the continuous inactive time for a session. Expressed in minutes. v CPU Per Session: Limits the CPU time for a session. Expressed in hundredths of a second. v Logical Reads Per Session: Limits the number of data blocks read (from disk and memory) in a session. Expressed as a number of blocks. v Connect Time: Limits the elapsed time of a session. Expressed in minutes. v Private SGA: Limits the amount of private space a session can allocate in the shared pool. Expressed as a number of bytes. b. Click on the attribute list to display the attribute limit drop-down menu. c. Choose one of the following options: v Default to use the limit specified in the Oracle DEFAULT resource profile. v Limited to enable users to enter a value for this resource in the Value text box. v Unlimited to allow an unlimited amount of this resource. d. Optional: If you chose Limited in the previous step, type a value in the Value text box. Additional Information: Click Reset to return the screen to the values that were present when the screen was originally displayed; however, if you click Add before you click Reset, any new values that you entered are saved to the profile and cannot be reset. 5. Do one of the following: v Click Add to add the resource. You can add other resources as needed. v Click Add & Close to add the resource and close the dialog box. Objective To edit a resource record in a profile so you can modify the parameters defined in the role. Background information You can modify single or multiple resource records in a profile. To edit multiple resource records, see Editing multiple resource records on page 112. Required authorization roles admin Before you begin None. When you finish Changes made in the profile are independent of the database. There are no changes made to the Oracle database unless a distribution occurs. To update the database with the changes, you must distribute the profile to the target database. For instructions, see Distributing a profile to subscribers on page IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

123 Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command Line: Use the wosetresource command to edit information for a resource profile from the command line. For a description, syntax, example, and other command information, see the IBM Tivoli Monitoring for Databases: Oracle Reference Guide. Desktop: 1. Open the Database Resource Profile window as described in Accessing and understanding the database resource profile window on page Select the resource record that you want to modify. 3. Do one of the following to display the Edit Database Resource dialog box: v Click Edit. v Use the Edit drop-down menu by doing the following: a. Select Edit from the toolbar to display the Edit drop-down menu. b. Select Edit from the Edit drop-down menu. 4. Modify the appropriate values (see Adding resource records on page 108 for details). 5. Do one of the following: v Click Change to save the changes. v Click Change & Close to accept your modifications and close the dialog box. Chapter 7. Managing resources 111

124 Editing multiple resource records Objective To edit multiple resource records in a profile so you can simultaneously modify the parameters defined in the roles. Background information You can edit single or multiple resources in a profile. To edit a single resource record, see Editing a resource record on page 110. To simplify resource record maintenance, IBM Tivoli Monitoring for Databases: Oracle provides resource search or sort functionality by specific attribute. You can search the resource records by setting the criteria for a specific attribute. IBM Tivoli Monitoring for Databases: Oracle displays and selects all records that meet those criteria and enables you to edit all of the selected records simultaneously. You can also sort the records by resource or attributes, so that you can select the records you want to edit. Required authorization roles admin Before you begin None. When you finish Changes made in the profile are independent of the database. There are no changes made to the Oracle database unless a distribution occurs. To update the database with the changes, you must distribute the profile to the target database. For instructions, see Distributing a profile to subscribers on page 38. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command Line: Use the wosetresources command to edit information for multiple resource profiles from the command line. For a description, syntax, example, and other command information, see the IBM Tivoli Monitoring for Databases: Oracle Reference Guide. Desktop: 1. Open the Database Resource Profile window as described in Accessing and understanding the database resource profile window on page Choose one of the following options to locate the resource records to modify: v Search the Resource Database a. Select View from the toolbar to display the View drop-down menu. 112 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

125 b. Select Find from the View drop-down menu to display the Find Records dialog box. c. Select the attribute to modify in the Attributes group box. d. Set the type of search that Tivoli performs by doing the following: 1) Click the comparison operator list. 2) Select one of the following: v Exact Match for records that equal a certain value. v Contains for records that contain a certain value. v Greater than for records whose value is greater than a certain value. v Less than for records whose value is less than a certain value. e. Type the value for the search criteria in the text box next to the comparison operator list. Additional Information: This box is case sensitive, so you must type the criteria as it is displayed in the database. f. Choose one of the following search options: v Click Find All to find all records that match the criteria. Chapter 7. Managing resources 113

126 v Click Find First to find the first occurrence of a record that matches the criteria. v Click Find Next to find the next occurrence of a record that matches the criteria. g. Refer to the Database Resource Profile window to verify the appropriate records were found when the search is complete. Additional Information: The records found in the Database Resource Profile window are automatically selected. h. Optional: Click Show Selected if you want to display only the records that matched the search. i. Do one of the following: v Click Sort to sort the records. v Click Sort & Close to sort the records and close the dialog box. Additional Information: The newly sorted records are displayed in the Database Resource Profile window. v Sort by Resource a. Select View from the toolbar to display the View drop-down menu. b. Select Sort from the View drop-down menu to display the Sort drop-down menu. c. Select Resource from the Sort drop-down menu to display the Sort Records dialog box. d. Select a field by which to sort from the Sort By list. e. Choose one of the following sort order options: v Select Ascending Sort to sort the matching records in alphabetic order. v Select Descending Sort to sort the matching records in reverse alphabetic order. f. Select an attribute label from the Record Label Field scrolling list. Additional Information: The attribute label is displayed in the left-hand column of the Properties dialog. g. Do one of the following: v Click Sort to sort the records. v Click Sort & Close to sort the records and close the dialog box. Additional Information: The newly sorted records are displayed in the Database Resource Profile window. v Sort by Attribute a. Select View from the toolbar to display the View drop-down menu. b. Select Sort from the View drop-down menu to display the Sort drop-down menu. c. Select Attributes from the Sort drop-down menu to display the Display Attributes dialog box. d. Click the left or right arrow button to move the attributes to one of the following lists: v Attributes in the Attributes Displayed list are sorted. v Attributes in the Attributes Not Displayed list are not sorted. 114 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

127 Copying resource records e. Do one of the following: v Click Sort to sort the records. v Click Sort & Close to sort the records and close the dialog box. The newly sorted records are displayed in the Database Resource Profile window. 3. Click Edit to edit multiple attributes from the Select Attributes to Edit dialog box. 4. Click on the specific attribute button such as User Controlled to edit a single attribute. Additional Information: The specific attribute buttons are the column headers for the database records in the Database Resource Profile window. Note: Tivoli displays the Edit Multiple Database Resources dialog box. Only those attributes that you selected are enabled for modification. 5. Modify the text or selection of the attribute. 6. Do one of the following: v Click Change to save profile changes. v Click Change & Close to save profile changes and close the Edit Multiple Database Resources dialog box. Additional Information: Tivoli displays the modified records in the Database Resource Profile window. Additional Information: You can click Cancel to cancel any unsaved changes and close the dialog box. Objective To copy resource records to another profile so you can add resource records to another profile. Background information You can only copy user records from one profile manager to another and the records cannot be located in the same profile manager. Required authorization roles admin Before you begin None. When you finish Changes made in the profile are independent of the database. There are no changes made to the Oracle database unless a distribution occurs. To update the database with the changes, you must distribute the profile to the target database. For instructions, see Distributing a profile to subscribers on page 38. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Chapter 7. Managing resources 115

128 Command Line: Use the wocpresource command to copy resource records between profiles from the command line. For a description, syntax, example, and other command information, see the IBM Tivoli Monitoring for Databases: Oracle Reference Guide. Desktop: 1. Open the Database Resource Profile window as described in Accessing and understanding the database resource profile window on page Select the database resource record that you want to copy to another profile. 3. Select Edit to display the Edit drop-down menu. 4. Select Copy from the Edit drop-down menu to display the Copy Profile Records dialog box. 116 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide

129 Moving resource records 5. Select the profile manager that contains the resource profile to which the records will be copied from the Available Profile Managers list. 6. Select the profile to which the records will be copied from the Available Profiles list. 7. Click the right arrow button to add the selection to the Target Profiles list. 8. Do one of the following: v Click Copy to copy the resource record to the selected profile. v Click Copy & Close to copy the resource record to the selected profile and close the dialog box. Objective To move a resource record to another profile so you can manage the same resources in another profile. Background information None. Required authorization roles admin Before you begin None. When you finish Changes made in the profile are independent of the database. There are no changes made to the Oracle database unless a distribution occurs. To update the database with the changes, you must distribute the profile to the target database. For instructions, see Distributing a profile to subscribers on page 38. Procedure You can perform this procedure from either the Tivoli command line or the desktop. Command Line: Use the womvresource command to move resource records from one profile to another from the command line. For a description, syntax, example, and other command information, see the IBM Tivoli Monitoring for Databases: Oracle Reference Guide. Desktop: 1. Open the Database Resource Profile window as described in Accessing and understanding the database resource profile window on page 105. Chapter 7. Managing resources 117

130 2. Select the record you want to move. 3. Select Edit from the toolbar to display the Edit drop-down menu. 4. Select Move from the Edit drop-down menu to display the Move Records dialog box. Deleting resource records 5. Select the profile manager that contains the profile to which the record will be moved from the Available Profile Managers list. Additional Information: All available profiles for that profile manager appear in the Available Profiles list. 6. Select the specific profile to which the record will be moved from the Available Profiles list. 7. Do one of the following: v Click Close to cancel the resource record move. v Click Move & Close to move the resource record and close the dialog box. Objective To delete a resource record so the resource is no longer available to the user. Background information When you delete a resource record, you must remove the record from the profile and then distribute the profile to the Oracle database. After it is distributed, it is removed from the Oracle database. 118 IBM Tivoli Monitoring for Databases: Oracle: User Management Guide