How to Upgrade from WebLogic 10.3.6.0.0 to 10.3.6.171017

The steps for this upgrade are largely the same as for this post: http://hyperipwn.blogspot.co.uk/2014/07/how-to-upgrade-from-weblogic-103600-to.html

WebLogic 10.3.6.171017 is in patch set 26519424. It is designed to address the following CVEs:
CVE-2017-3506
CVE-2015-7501
CVE-2014-0114
CVE-2017-10137
CVE-2017-10147
CVE-2017-10178
CVE-2017-10148
CVE-2017-10063
CVE-2017-10271
CVE-2017-10152
CVE-2017-10352
CVE-2017-10336
CVE-2017-10334
CVE-2014-0107

Please note that the steps are largely the same as the previous blog post, except the patch ID is different:

bsu.cmd -install -patch_download_dir=E:\Oracle\Middleware\utils\bsu\cache_dir -patchlist=FMJJ -prod_dir=E:\Oracle\Middleware\wlserver_10.3 -verbose

If you receive an OutOfMemory error when applying the patch you much edit the bsu.cmd file, to increase the memory arguments:

set MEM_ARGS=-Xms1024m -Xmx2048m

The default is 256MB and 512MB, respectively.

When you start up the services, expect to see a log line ending like the below at the top of the WebLogic log files:

Version: WebLogic Server 10.3.6.0.171017 PSU Patch for BUG26519424 TUE SEP 12 18:34:42 IST 2017

Useless CDF Information

Did you know that the Essbase CDF included with Calculation Manager 11.1.2.4.000 is almost exactly the same as the one included with 11.1.2.3.503?

Did you also that the Essbase CDF included with Calculation Manager 11.1.2.4.002 is almost exactly the same as the one included with 11.1.2.3.700?

Just some useless CDF information...

Automated EPM Pre-Requisites

In this post I wanted to put forward to all the EPM infrastructure engineers out there: do you implement all of your EPM installation pre-requisites manually? And if so: why?

There must be a way to automate all of the pre-requisites! I have made a start in Powershell in scripting out the most common ones. Please be aware that your own environment pre-requisites may differ wildly. There are numerous things to consider:

1. Disk partitioning
2. Anti-virus\firewall exceptions
3. Local security policies
4. Local group membership

These are just a few of things that the following script does not do! But what it does you may find useful so here is what I have so far:

Write-Host "setting temporary folders"

New-Item c:\epmtmp -type directory

[Environment]::SetEnvironmentVariable("TMP", "c:\epmtmp", "User")

[Environment]::SetEnvironmentVariable("TEMP", "c:\epmtmp", "User")

Write-Host "disabling IPV6 tunnels"

C:\windows\system32\cmd /c netsh interface ipv6 6to4 set state state=disabled undoonstop=disabled

C:\windows\system32\cmd /c netsh interface ipv6 isatap set state state=disabled

C:\windows\system32\cmd /c netsh interface teredo set state disabled

Write-Host "setting max TCP ports"

C:\windows\system32\cmd /c netsh int ipv4 set dynamicport tcp start=1025 num=64500

Write-Host "disabling DEP"

C:\windows\system32\cmd /c bcdedit /set nx AlwaysOff

C:\windows\system32\cmd /c bcdedit /set pae ForceEnable

Write-Host "configuring power settings to High Performance"

C:\windows\system32\cmd /c powercfg.exe -setactive 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c

Write-Host "disabling IPV6"

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\services\TCPIP6\Parameters' -Name DisabledComponents -Value 0xffffffff

Write-Host "ensuring the registry is not unloaded on log off"

Set-ItemProperty -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\System' -Name DisableForceUnload -Value 1

Write-Host "press any key to exit"

Read-Host

Have I missed anything? Let me know what else you have found you can automate and we can all becoming lazier sysadmins :)

Quick Tip: Complete DCOM Re-Configuration

I want to keep this post short so I'll dive right into the issue.

When you first configure a server with HFM components on it the first time you configure DCOM it will run a "pre-configuration" task. This involves registering some DLL files and using DISM to reconfigure the server.

Any subsequent runs of the "Configure DCOM" task in HFM will miss out this pre-configuration step. So if you find yourself needing to re-configure DCOM (perhaps due to Windows patching) it is possible that not everything required will re-register.

The way to fix this is simple, we just run the commands below (fit for your environment, obviously):

cd /d E:\Oracle\Middleware\user_projects\epmsystem1\bin
resetConfigTask.bat -product HFM -task preConfiguration

Then when you go to run the "Configure DCOM" task in the configtool it will also include this "pre-configuration" step as well.

You may have read about this resetConfigTask.bat script elsewhere online, I actually found about the command here: http://epm-errors.blogspot.co.uk/2013/01/resetconfigtaskbat.html

DRM Application Update Timing Out

Another quick post: if you find that when you try to apply updates to a DRM application the utility times out trying to connect to the database, make sure there isn't an "@" sign in the database user's password!

Encountered this strange issue recently, hope it helps someone!

DRM Admin Password Expiry Fix

I realise I haven't done a blog post in a while, unfortunately work has been super busy recently, so I decided to drop a quick tip here.

I have had issues with the DRM admin password expiring. This is obviously not a situation anyone wants and it seems that DRM ignores the "no password expiry" option as well. The only fix I have found is running the SQL script below:

UPDATE [DRM].[dbo].[RM_User]
      SET [d_password_expire_date] = '2035-01-01 01:01:01.00'
      ,[b_exclude_from_timeout] = 1
      ,[b_no_password_expiration] = 1
      ,[b_exclude_from_lockout] = 1
 WHERE c_user_name = 'ADMIN'
GO

Obviously altering the name of the DRM database for your own.

The Real SQL Server Pre-Requisites for EPM

Oracle have published some pre-requisites for SQL Server databases to be used by EPM. You will typically see these mentioned:

ALTER DATABASE DB_XXX SET SINGLE_USER WITH ROLLBACK IMMEDIATE ;
ALTER DATABASE DB_XXX SET READ_COMMITTED_SNAPSHOT ON;
ALTER DATABASE DB_XXX SET ALLOW_SNAPSHOT_ISOLATION ON;
ALTER DATABASE DB_XXX SET MULTI_USER ;


However that really doesn't tell the whole story! I had to go through an Oracle Support Request to find this out but there are actually much more than that. 

The script below will run the full pre-requisites on all databases prefixed with "EPM_". I like to use prefixes on the databases as it keeps things neat, and it also means we can perform operations on more than 1 database at a time without worrying about screwing up anyone else's databases! We also assume the EPMA database ends with "EPMA" and the FDMEE database ends with "FDMEE". The SQL user is assumed to be called "hyperion".

DECLARE @command varchar(1000)
SELECT @command = 'IF ''?'' LIKE ''EPM_%''
BEGIN
USE ?
SELECT DB_NAME() As DatabaseName
ALTER DATABASE ? SET SINGLE_USER WITH ROLLBACK IMMEDIATE;
ALTER DATABASE ? SET READ_COMMITTED_SNAPSHOT OFF;
ALTER DATABASE ? SET ALLOW_SNAPSHOT_ISOLATION OFF;
ALTER DATABASE ? SET MULTI_USER WITH NO_WAIT;
ALTER DATABASE ? SET ANSI_NULL_DEFAULT OFF;
ALTER DATABASE ? SET ANSI_NULLS OFF;
ALTER DATABASE ? SET ANSI_PADDING OFF;
ALTER DATABASE ? SET ANSI_WARNINGS OFF;
ALTER DATABASE ? SET ARITHABORT OFF;
ALTER DATABASE ? SET CONCAT_NULL_YIELDS_NULL OFF;
ALTER DATABASE ? SET QUOTED_IDENTIFIER OFF;
ALTER DATABASE ? SET RECURSIVE_TRIGGERS OFF;
ALTER DATABASE ? COLLATE SQL_Latin1_General_CP1_CI_AS;
END'
EXEC sp_MSforeachdb @command

DECLARE @command varchar(1000)
SELECT @command = 'IF ''?'' LIKE ''%EPMA''
BEGIN
USE ?
SELECT DB_NAME() As DatabaseName
ALTER DATABASE ? SET SINGLE_USER WITH ROLLBACK IMMEDIATE;
ALTER DATABASE ? SET READ_COMMITTED_SNAPSHOT ON;
ALTER DATABASE ? SET ALLOW_SNAPSHOT_ISOLATION ON;
ALTER DATABASE ? SET MULTI_USER WITH NO_WAIT ;
END'
EXEC sp_MSforeachdb @command

DECLARE @command varchar(1000)
SELECT @command = 'IF ''?'' LIKE ''%FDMEE''
BEGIN
USE ?
SELECT DB_NAME() As DatabaseName
ALTER DATABASE ? SET SINGLE_USER WITH ROLLBACK IMMEDIATE;
ALTER DATABASE ? SET READ_COMMITTED_SNAPSHOT ON;
ALTER DATABASE ? SET ALLOW_SNAPSHOT_ISOLATION ON;
ALTER DATABASE ? SET MULTI_USER WITH NO_WAIT ;
END'
EXEC sp_MSforeachdb @command

ALTER LOGIN hyperion WITH DEFAULT_LANGUAGE = us_english

It is also worth mentioning that EPM requires the languages on all users and databases to be "us_english". Again, had to go through an SR to find that one out as well!

Based on feedback in the comments and some tuning guides for FDMEE and HFM the default is now for READ_COMMITTED_SNAPSHOT to be off for all databases except EPMA and FDMEE.

This does contradict the recommendations here, though, which say to turn on READ_COMMITTED_SNAPSHOT and ALLOW_SNAPSHOT_ISOLATION for all databases except HFM:
https://docs.oracle.com/cd/E57185_01/EPMIS/ch03s04s02s01.html

Edit: the collation previously mentioned was case sensitive. This is against Oracle recommendations and has been amended.