Hi,I actually saw this really strange thing as well. It seems Oracle has repackaged the log4j-1.2.17.jar to also contain parts of a 2.x log4j.But as the strangely modified log4j-1.2.17.jar file is in the mw_home\mws\oracle_common folder it is safe. It's not used in runtime.This folder is mentioned as safe in the Verification part of the mitigation of Apps10.Scanning tools are very good, but it is difficult to interpret the result - often many "false truths". /Henrik
Hi,The web part (B2E) is sub part of IFS Application 8 (all legacy versions) which is stated in the KBA not to be affected. I had a quick look now and the actual b2e.war file has an unaffected Log4j 1.2.6 in it. Which aligns with the statement in the KBA. NOTE: Running old SW in general (App8 being one) is not advised from a security perspective... /henrik
IFS Analyzed all released code for the Log4j (CVE-2021-44228) vulnerability.A few weeks back IFS has stated that IFS Apps9 is not affected by the Log4j vulnerability - and that includes Crystal Web Service.
Apps8! I think (not at all 100% sure here) you get this error if the external loadbalancer is not configured with sicky sessions.i.e. the client is redirected to the other mws cluster node which don’t own the db session, hence think its expired.
Not sure this is the right way… the table should be rowkey enabled. Think this is done somewhere in Solution Manager. When the table is rowkey anabled all old rows will get the rowkey set and all new rowkeys will get the guid automatically by a default value function on the rowkey column.
So you mean that Oracle treats row inserts differently depending on if its done through the framework or by PLSQL? It says in the column definition that if the column is null when inserting a new row, it should set sys_guid()…. or?But this requires that kowkey in enabled on the table. This is made manually in SolutionManager in older versions if IFS Applications.
Again - Table requires that rowkey in enabled on the table. This is made manually in SolutionManager in older versions if IFS Applications.Per LU:https://docs.ifs.com/techdocs/Foundation1/040_administration/300_system_information/010_logical_units/default.htmOr in bulk:https://docs.ifs.com/techdocs/Foundation1/040_administration/300_system_information/010_logical_units/enable_and_disable_rowkey.htm
Follow the official recomendation:apply "IFS_Solution_298974.zip" as a workaround and Update15 as a permanent solution.IFS_Solution_298974.zip is a solid workaround that can be used until customer is ready for a proper Update. /H
From 21r2 there is a tool called mtctl which can dump all logs to a folder in the ifsinstaller folder.This is also the folder that should be zipped and attached whenever a support issue is raised on middle tier issues.In a ifsinstaller folder just type “mtctl dump -n <namespace>” then you can brows all logs in the created <namespace>_dump folder.Read the techdoc about mtctl.
Hi,Oracle and therefore IFS states it’s not used in runtime, so it should be ok to remove or “quarantine” it. /Henrik
You probably haven’t done this part:https://docs.ifs.com/techdocs/21r2/020_installation/010_installing_fresh_system/030_preparing_server/50_windows_managementserver/#get-the-kubeconfig-file-from-the-kubernetes-cluster-in-middle-tier-server
Hi Niklas,This is a known limitation in Apps10… Our official proposal is the DNS with different IP’s… I know RnD tested a rewrite statement in OHS many years ago, but i’m not sure if it was ever implemented.. There is a rewrite in the mod_mws_ohs.conf that looks like it changes fqdn names… but i don’t have enough knowledge to say what it really do and why.If it helps - Here is an example for rewrite of docman url’s as a custom rewrite defined in Admin Console, maybe you can figure out a more generic rewrite that can work in your scenario... Cheers, /henrik
Hi, it seems the techdoc is faulty. I will correct it. Seems you are the first ever trying to set it :)Which is good as we don’t encourage setting the entire application with basic Auth enabled… i would suggest to adopt the inbound integration to use a proper oAuth token instead… If you still really need basic Auth:The parameter is called basicAuthEnabled and not basicAuth and should be set to true or false
Doc updated on all tracks now - e.g.:http://techdocs/22r1/070_remote_deploy/010_installing_fresh_system/200_installing_ifs_cloud/035_ifs_cloud_ifsinstaller/030_installation_parameters/#parameters-for-proxy
My Advice: Try to avoid RAC… it add complexity and you might end up with performance issues that very few DBA’s can sort out. Even if IFS can run in a RAC environment it is not a good fit as we have so frequent data updates (OLTP DB).
IFSINFO get a random generated password in a fresh install.I don’t remember if it is also created as locked.If you need to change the IFSINFO password you do it through e.g. sqlplus.Any changes to the IFSINFO schema done by the installer is don by IFSAPP impersonating IFSINFO, hence the IFSINFO password don’t need to be know by the installer.
You probably have a too new k8s cluster - You need to download a older Remote version and install it.… but that is crazy… you should apply the latest SU in 21r2 SU13.
The application monitoring entry are mainly intended to be consumed by an external monitoring solution (like Prometheus) - in your case managed by IFS Cloud Service. I think they should act on new invalids in test and prod environments. In Build Place its more up to the developers to make sure all packages are compiled using e.g. plsql/developer connected to the dev DB.
This issue is identified as a bug correction in Oracle RU 19.14 where a grant to sys."_BASE_USER" was lowered from SELECT to READ privileges.This in turn makes the IFS SEARCH_DOMAIN_ERRORS view fail with a grant error.The failing grant is given to IFSSYS, but the SEARCH_DOMAIN_ERRORS view is not used by any client code, so even if the grant fails, then application will still work without any issues.RnD is aiming to correct this in Apps10 UPD20 Workaround until then is as mention above:grant select on sys."_BASE_USER" to ctxsys with grant option;
FYI - In-Memory is not currently on the agenda at RnD.Not at all sure if this is related:In some production environments there is a big performance improvement on many SQL’s when disabling Oracle parallel execution - seems the Oracle parallel execution find it hard to sync the query jobs as IFS has complex SQL’s and underlying data is moving a lot (OLTP DB). Parallel execution probably works better in a Data Warehouse DB. parallel_min_servers=0parallel_max_servers=0
As an optional configuration solution you can extend your primary MT cluster to also have two active servers in the secondary site. Then configure your jdbc connection strings with failover. It will then connect automatically to the secondary DB if the primary is down. The you don’t have to think of the manual failover step of MT. You will need a external loadbalancer configured with HA as well.jdbc:oracle:thin:@(DESCRIPTION=(ADDRESS_LIST=(LOAD_BALANCE=OFF)(FAILOVER=ON)(ADDRESS=(PROTOCOL=TCP)(HOST=ifsapp-db1)(PORT=1521))(ADDRESS=(PROTOCOL=TCP)(HOST=ifsapp-db2)(PORT=1521)))(CONNECT_DATA=(SERVER=DEDICATED)(SERVICE_NAME=ifspdb)))
or why not run IFS Cloud on kubernetes 😀..Apps10 is a “dead” support track… Don’t spend time trying to squeeze Apps10 onto containers… we (RnD) did this 4 yeas ago. We got al lot running with a fair amount of tweaking. If you can’t modify the framework - don’t even try.
FYI - Google is spelled with two ‘o’ 😎JDBC is very generic - you can have different service names if you need. e.g."jdbc:oracle:thin:@" + "(DESCRIPTION_LIST=" + "(LOAD_BALANCE=off)" + "(FAILOVER=on)" + "(DESCRIPTION=" + "(CONNECT_TIMEOUT=3)(RETRY_COUNT=3)" + "(ADDRESS_LIST=" + "(LOAD_BALANCE=on)" + "(ADDRESS=(PROTOCOL=TCP)(HOST=prmy-scan)(PORT=1521)))" + "(CONNECT_DATA=(SERVICE_NAME=oltpworkload.x.y)))" + "(DESCRIPTION=" + "(ADDRESS_LIST=" + "(LOAD_BALANCE=on)" + "(ADDRESS=(PROTOCOL=TCP)(HOST= stby-scan)(PORT=1521)))" + "(CONNECT_DATA=(SERVICE_NAME=oltpworkload.x.z))))";The jdbc strings are take out of context, please verify (google) the correctness of them yourself. e.g. the latter has and timeouts/retries and loadbalnce = on - which i thing might be wrong.Maybe OCI support might give you the jdbc url to use for their DG solution?
Hi,No, they should not be scheduled by default as there is a danger that they might start at the wrong time. If a customer has a professional DBA, they probably prefer to do the analyze and rebuild using their own tools or scripts.But index should be rebuild if needed (in fact it is hard to say when that is… the validate index BG job will probably be more aggressive than necessary)- the frequency depends a bit on transaction rates in the DB or rather the update and delete rate as it often updates and deletes that skews indexes.Important to consider is that both analyze and rebuild will partly lock the indexes when analyzing and rebuilding them. Therefor the BG jobs preferable should run then there is very low load on the system. /Henrik
Hi,I have a faint memory (This was > 10 years ago...) that we found a load job that will “unload” or truncate the EXT_FILE_TRANS_TAB that is scheduled as any other file load jobs. /H
Already have an account? Login
No account yet? Create an account
Enter your username or e-mail address. We'll send you an e-mail with instructions to reset your password.
Sorry, we're still checking this file's contents to make sure it's safe to download. Please try again in a few minutes.
Sorry, our virus scanner detected that this file isn't safe to download.
