New: Non-DBSNMP Monitoring Credentials

This blog assumes the user is familiar with Enterprise Manager and Database Monitoring concepts.

Administrators can now use DBSNMP or non-DBSNMP database monitoring credentials for monitoring Oracle databases when using Oracle Enterprise Manager (EM) 13c Release 5 Update 4 (13.5.0.4) or later.

New Enterprise Manager capability to specify a non-DBSNMP user

In previous releases, monitoring the status and performance of your Oracle Database targets required the use of DBSNMP, a built-in database user used by EM. When you first added an Oracle Database target in EM, by default EM used the DBSNMP database user account and password as the monitoring credential.

EM 13.5.0.4 has added the ability for you to specify a non-DBSNMP user as a monitoring credential. The database user that you specify will first need to be created separately and should contain the same set of roles and privileges as the DBSNMP user.  For convenience, a script has been provided to help create this user. This script can be accessed through the MOS note 2847191.1.

While having a built-in user as a monitoring credential is convenient, the DBSNMP user is well-known, and some customers prefer using their database user for security compliance purposes.   Hence, supporting other non-DBSNMP user accounts as monitoring credentials allow them to comply with their security requirements.

Specifying monitoring credentials for new databases using the EM console or EM CLI

Once a new monitoring user has been created, the new user credential can be specified when adding a database using the EM console or EM CLI.

Adding a target database using the EM Console

You can add a database as an EM target, either through the Add Target Manually, Guided Process, or Auto-Discovery option. The default DBSNMP user credential can be modified with the new monitoring user that you created:

Adding a target database using EM CLI

When adding a new database, explicitly or through discovery, you can specify non-DBSNMP monitoring credentials for the database:

1. add_target

emcli add_target

-name="database"

-type="oracle_database"

-host="myhost.example.com"

-credentials="UserName:monuser;password:password1;Role:Normal"

-properties="SID:semcli;Port:15091;OracleHome:/oracle; MachineName:smpamp.example.com"
 

1. discover_db

emcli discover_db -input_file=db_discovery_file:db_discovery_file.txt

The example file, db_discover_file.txt, may have contents like below:

host_name=myhost.example.com

db_creds=db1:monuser,password1,NORMAL

target_type=oracle_database

Use of the non-DBSNMP monitoring credential for an existing database 

For databases that are already monitored in EM, the default DBSNMP credential can be changed to a non-DBSNMP credential. This change can be done using the EM Console or through EM CLI.

Changing database monitoring credentials using the EM Console

You can change the default DBSNMP monitoring credential through the target’s Monitoring Configuration page:

Changing database monitoring credentials using EM CLI

The following command can be run to set non-DBSNMP monitoring credentials for the database:

1. set_monitoring_credential

emcli set_monitoring_credential

-target_name=testdb.example.com

-target_type=oracle_database

-set_name=DBCredsMonitoring

-cred_type=DBCreds

-attributes="DBUserName:monuser;DBPassword:password1;DBRole:normal"

Additional Information on Monitoring Credentials in Enterprise Manager

For further information see the following:

1. Additional Documentation: Specifying New Target Monitoring Credentials in Enterprise Manager
2. For details and a script to create the database monitoring user, refer to this MOS note: EM 13c: Creating the Oracle Database Monitoring Credentials for Oracle Enterprise Manager 13.5 RU4 (and later) Doc ID 2847191.1
3. For further context on the EM CLI verbs, refer to:
   1. add_target
   2. discover_db
   3. set_monitoring_credential