OCA/OCP Oracle Database 11g All-in-One Exam Guide 196 TIP Converting tablespaces to local management is quick and easy, except for the SYSTEM tablespace, where some extra steps are required. These are well documented in the System Administrator’s guide available as part of the product documentation. Segment Space Management The segment space management method is set per tablespace and applies to all segments in the tablespace. There are two techniques for managing segment space usage: manual or automatic. The difference is clear: automatic management should always be used; manual management should never be used. Manual segment space management is still supported but never recommended. Like dictionary-managed extent management, it is a holdover from previous releases. Automatic segment space management was introduced with release 9i and has become the default with release 11g. Every segment created in an automatic management tablespace has a set of bitmaps that describe how full each block is. There are five bitmaps for each segment, and each block will appear on exactly one bitmap. The bitmaps track the space used in bands or ranges: there is a bitmap for full blocks; and there are bitmaps for blocks that are 75 percent to 100 percent used; 50 percent to 75 percent used; 25 percent to 50 percent used; and 0 percent to 25 percent used. When searching for a block into which to insert a row, the session server process will look at the size of the row to determine which bitmap to search. For instance, if the block size is 4KB and the row to be inserted is 1500 bytes, an appropriate block will be found by searching the 25 percent to 50 percent bitmap. Every block on this bitmap is guaranteed to have at least 2KB of free space. As rows are inserted, deleted, or change size through updates, the bitmaps get updated accordingly. The old manual space management method used a simple list, known as the free list, which listed which blocks were available for inserts but without any information on how full they were. This method could cause excessive activity, as blocks had to be tested for space at insert time, and often resulted in a large proportion of wasted space. To verify if any tablespaces are using manual management, you can run the query: select tablespace_name,segment_space_management from dba_tablespaces; It is not possible to convert a tablespace from manual to automatic segment space management. The only solution is to create a new tablespace using automatic segment space management, move the segments into it (at which point the bitmaps will be generated), and drop the old tablespaces. Exercise 5-3: Change Tablespace Characteristics In this exercise, you will create a tablespace using the nondefault manual space management, to simulate the need to convert to automatic segment space management after an upgrade. 1. Connect to your database as user SYSTEM. 2. Create a tablespace using manual segment space management. As OMF was enabled in Exercise 5-2, there is no need for any datafile clause: create tablespace manualsegs segment space management manual; Chapter 5: Oracle Storage 197 PART I 3. Confirm that the new tablespace is indeed using the manual technique: select segment_space_management from dba_tablespaces where tablespace_name='MANUALSEGS'; 4. Create a table and an index in the tablespace: create table mantab (c1 number) tablespace manualsegs; create index mantabi on mantab(c1) tablespace manualsegs; These segments will be created with freelists, not bitmaps. 5. Create a new tablespace that will (by default) use automatic segment space management: create tablespace autosegs; 6. Move the objects into the new tablespace: alter table mantab move tablespace autosegs; alter index mantabi rebuild online tablespace autosegs; 7. Confirm that the objects are in the correct tablespace: select tablespace_name from dba_segments where segment_name like 'MANTAB%'; 8. Drop the original tablespace: drop tablespace manualsegs including contents and datafiles; 9. Rename the new tablespace to the original name. This is often necessary, because some application software checks tablespace names: alter tablespace autosegs rename to manualsegs; 10. Tidy up by dropping the tablespace, first with this command: drop tablespace manualsegs; Note the error caused by the tablespace not being empty, and fix it: drop tablespace manualsegs including contents and datafiles; Two-Minute Drill Overview of Tablespaces and Datafiles • One tablespace can be physically represented by many datafiles. • One tablespace can contain many segments. • One segment comprises one or more extents. • One extent is many consecutive blocks, in one datafile. • One Oracle block should be one or more operating system blocks. • The Oracle block is the granularity of database I/O. OCA/OCP Oracle Database 11g All-in-One Exam Guide 198 Create and Manage Tablespaces • A SMALLFILE tablespace can have many datafiles, but a BIGFILE tablespace can have only one. • Tablespaces default to local extent management, automatic segment space management, but not to a uniform extent size. • OMF datafiles are automatically named, initially 100MB, and can autoextend without limit. • A tablespace that contains segments cannot be dropped—unless an INCLUDING CONTENTS clause is specified. • Tablespaces can be online or offline, read-write or read only. • Tablespaces can store one of three types of objects: permanent objects, temporary objects, or undo segments. Space Management in Tablespaces • Local extent management tracks extent allocation with bitmaps in each datafile. • The UNIFORM SIZE clause when creating a tablespace forces all extents to be the same size. • The AUTOALLOCATE clause lets Oracle determine the next extent size, which is based on how many extents are being allocated to a segment. • Automatic segment space management tracks the free space in each block of an extent using bitmaps. • It is possible to convert a tablespace from dictionary extent management to local extent management, but not from freelist segment management to automatic management. Self Test 1. This illustration shows the Oracle storage model, with four entities having letters for names. Match four of the following entities to the letters A, B, C, D: DATAFILE EXTENT ORACLE BLOCK ROW SEGMENT TABLE Tablespaces A B C Operating system block D Chapter 5: Oracle Storage 199 PART I 2. Which statements are correct about extents? (Choose all correct answers.) A. An extent is a consecutive grouping of Oracle blocks. B. An extent is a random grouping of Oracle blocks. C. An extent can be distributed across one or more datafiles. D. An extent can contain blocks from one or more segments. E. An extent can be assigned to only one segment. 3. Which of these are types of segment? (Choose all correct answers.) A. Sequence B. Stored procedure C. Table D. Table partition E. View 4. If a tablespace is created with this syntax: create tablespace tbs1 datafile 'tbs1.dbf' size 10m; which of these characteristics will it have? (Choose all correct answers.) A. The datafile will autoextend, but only to double its initial size. B. The datafile will autoextend with MAXSIZE UNLIMITED. C. The extent management will be local. D. Segment space management will be with bitmaps. E. The file will be created in the DB_CREATE_FILE_DEST directory. 5. How can a tablespace be made larger? (Choose all correct answers.) A. Convert it from a SMALLFILE tablespace to a BIGFILE tablespace. B. If it is a SMALLFILE tablespace, add files. C. If it is a BIGFILE tablespace, add more files. D. Resize the existing file(s). 6. Which of these commands can be executed against a table in a read-only tablespace? (Choose the best answer.) A. DELETE B. DROP C. INSERT D. TRUNCATE E. UPDATE OCA/OCP Oracle Database 11g All-in-One Exam Guide 200 7. What operation cannot be applied to a tablespace after creation? (Choose the best answer.) A. Convert from dictionary extent management to local extent management. B. Convert from manual segment space management to automatic segment space management. C. Change the name of the tablespace. D. Reduce the size of the datafile(s) assigned to the tablespace. E. All the above operations can be applied. 8. By default, what thresholds are set for space warnings on a tablespace? (Choose the best answer.) A. 85 percent and 97 percent. B. This will depend on whether AUTOEXTEND has been enabled. C. This will depend on whether it is a SMALLFILE or a BIGFILE tablespace. D. By default, no warnings are enabled. 9. When the database is in mount mode, what views must be queried to identify the datafiles and tablespaces that make up the database? (Choose all correct answers.) A. DBA_DATA_FILES B. DBA_TABLESPACES C. DBA_TEMP_FILES D. V$DATABASE E. V$DATAFILE F. V$TABLESPACE 10. Which views could you query to find out about the temporary tablespaces and the files that make them up? (Choose all correct answers.) A. DBA_DATA_FILES B. DBA_TABLESPACES C. DBA_TEMP_TABLESPACES D. DBA_TEMP_FILES E. V$DATAFILE F. V$TABLESPACE G. V$TEMPTABLESPACE H. V$TEMPFILE Chapter 5: Oracle Storage 201 PART I Self Test Answers 1. þ A is SEGMENT; B is EXTENT; C is ORACLE BLOCK; D is DATAFILE. ý Neither ROW nor TABLE is included in the model. 2. þ A and E. One extent is several consecutive Oracle blocks, and one segment consists of one or more extents. ý B, C, and D. B, C, and D are all wrong because they misinterpret the Oracle storage model. 3. þ C and D. A table can be a type of segment, as is a table partition (in which case the partitioned table is not a segment). ý A, B, and E. A, B, and E are wrong because they exist only as objects defined within the data dictionary. The data dictionary itself is a set of segments. 4. þ C and D. With release 11g, local extent management and automatic segment space management are enabled by default. ý A and B. A and B are both wrong because by default autoextension is disabled. E is wrong because providing a filename will override the OMF mechanism. 5. þ B and D. A small file tablespace can have many files, and all datafiles can be resized upward. ý A and C. A is wrong because you cannot convert between a SMALLFILE and a BIGFILE. C is wrong because a BIGFILE tablespace can have only one file. 6. þ B. Objects can be dropped from read-only tablespaces. ý A, C, D, and E. All of these commands will fail because they require writing to the table, unlike a DROP, which only writes to the data dictionary. 7. þ B. It is not possible to change the segment space management method after creation. ý A C, D, and E. A and C are wrong because a tablespace can be converted to local extent management or renamed at any time. D is wrong because a datafile can be resized downward—though only if the space to be freed up has not already been used. E is wrong because you cannot change the segment space management method without re-creating the tablespace. 8. þ A. 85 percent and 97 percent are the database-wide defaults applied to all tablespaces. ý B, C, and D. B is wrong because AUTOEXTEND does not affect the warning mechanism (though it may make it pointless). C is wrong because the warning mechanism considers only the tablespace, not the files. D is wrong because by default the space warning is enabled. OCA/OCP Oracle Database 11g All-in-One Exam Guide 202 9. þ E and F. Joining these views will give the necessary information. ý A, B, C, and D. A and B are wrong because these views will not be available in mount mode. C is wrong because it is not relevant to datafiles (and is also not available in mount mode). D is wrong because there is no datafile or tablespace information in V$DATABASE. 10. þ B, D, F, and H. V$TABLESPACE and DBA_TABLESPACES will list the temporary tablespaces, and V$TEMPFILE and DBA_TEMP_FILES will list their files. ý A, C, E, and G. A and E are wrong because V$DATAFILE and DBA_DATA_ FILES do not include tempfiles. C and G are wrong because there are no views with these names. CHAPTER 6 Oracle Security Exam Objectives In this chapter you will learn to • 052.7.1 Create and Manage Database User Accounts • 052.7.2 Grant and Revoke Privileges • 052.7.3 Create and Manage Roles • 052.7.4 Create and Manage Profiles • 052.11.1 Implement Database Security and Principle of Least Privilege • 052.11.2 Work with Standard Database Auditing 203 OCA/OCP Oracle Database 11g All-in-One Exam Guide 204 Security is an issue of vital concern at all sites. All organizations should have a security manual documenting rules and procedures. If your organization does not have such a manual, someone should be writing it—perhaps that someone should be you. In security, there is no right or wrong; there is only conformance or nonconformance to agreed procedures. If administrators follow the rules and advise on what those rules should be, then any breach of security is not their fault. But unfortunately, history shows that when something goes wrong in the security arena, there is a great desire to blame individuals. It is vitally important that administration staff should be able to point to a rule book that lays down the procedures they should follow, and to routines and logs that demonstrate that they did indeed follow them. This devolves the responsibility to the authors of the rule book, the security manual. If no such manual exists, then any problems are likely to be dumped on the most convenient scapegoat. This is often the database administrator. You have been warned. The Oracle product set provides many facilities for enforcing security up to and beyond the highest standards specified by any legislation. Many of the facilities (such as data encryption) are beyond the scope of the first OCP examination, where the treatment of security is limited to the use of privileges and auditing. This chapter discusses the basic security model governing user accounts and their authentication. The differences between a schema and a user (terms often used synonymously) are explored along with the use of privileges to permit access to as few items as necessary and the grouping of privileges into roles for ease of administration. Profiles used to manage passwords and resources to a limited extent are covered before delving into the powerful auditing features available. Create and Manage Database User Accounts When a user logs on to the database, they connect to a user account by specifying an account name followed by some means of authentication. The user account defines the initial access permissions and the attributes of the session. Associated with a user account is a schema. The terms “user,” “user account,” and “schema” can often be used interchangeably in the Oracle environment, but they are not the same thing. A user is a person who connects to a user account by establishing a session against the instance and logging on with the user account name. A schema is a set of objects owned by a user account, and is described in Chapter 7. The way the account was created will set up a range of attributes for the session, some of which can be changed later, while the session is in progress. A number of accounts are created at database creation time, and the DBA will usually create many more subsequently. In some applications, each user has their own database user account. This means that the database is fully aware of who is the real owner of each session. This security model works well for small applications but is often impractical for larger systems with many hundreds or thousands of users. For large systems, many users will connect to the same account. This model relies on the application to map the real end user to a database user account, and it can make session-level security and auditing more complex. This chapter assumes that every user is known to the database: they each have their own user account. Chapter 6: Oracle Security 205 PART I User Account Attributes A user account has a number of attributes defined at account creation time. These will be applied to sessions that connect to the account, though some can be modified by the session or the DBA while the session is running. These attributes are • Username • Authentication method • Default tablespace • Tablespace quotas • Temporary tablespace • User profile • Account status All of these should be specified when creating the user, though only username and authentication methods are mandatory; the others have defaults. Username The username must be unique in the database and must conform to certain rules. A username must begin with a letter, must have no more than 30 characters, and can consist of only letters, digits, and the characters dollar ($) and underscore (_). A user name may not be a reserved word. The letters are case sensitive but will be automatically converted to uppercase. All these rules (with the exception of the length) can be broken if the username is specified within double quotes, as shown on Figure 6-1. Figure 6-1 How to create users with nonstandard names . Oracle block should be one or more operating system blocks. • The Oracle block is the granularity of database I/O. OCA/ OCP Oracle Database 11g All-in-One Exam Guide 198 Create and Manage Tablespaces •. the datafiles and tablespaces that make up the database? (Choose all correct answers.) A. DBA_DATA_FILES B. DBA_TABLESPACES C. DBA_TEMP_FILES D. V $DATABASE E. V$DATAFILE F. V$TABLESPACE . and Manage Profiles • 052.11.1 Implement Database Security and Principle of Least Privilege • 052.11.2 Work with Standard Database Auditing 203 OCA/ OCP Oracle Database 11g All-in-One Exam Guide 204 Security