| Oracle® Database Net Services Reference Guide 10g Release 1 (10.1) Part Number B10776-01 |
|
|
View PDF |
| Oracle® Database Net Services Reference Guide 10g Release 1 (10.1) Part Number B10776-01 |
|
|
View PDF |
This chapter provides complete listing of the sqlnet.ora file configuration parameters.
This chapter contains these topics:
The sqlnet.ora file enables you to:
Specify the client domain to append to unqualified names
Prioritize naming methods
Enable logging and tracing features
Route connections through specific processes
Configure parameters for external naming
Configure Oracle Advanced Security
Use protocol-specific parameters to restrict access to the database
By default, sqlnet.ora is located in the $ORACLE_HOME/network/admin directory on UNIX operating systems and the ORACLE_HOME\network\admin directory on Windows operating systems. sqlnet.ora can also be stored in the directory specified by the TNS_ADMIN environment variable.
This section lists and describes the sqlnet.ora file parameters.
Use the parameter BEQUEATH_DETACH to turn signal handling on or off for UNIX systems.
no
yes to turn signal handling off
no to leave signal handling on
BEQUEATH_DETACH=yes
Use the parameter DEFAULT_SDU_SIZE to specify the session data unit (SDU) size, in bytes to connections.
Oracle Corporation recommends setting this parameter in both the clientside and serverside sqlnet.ora file to ensure the same SDU size is used throughout a connection. When the configured values of client and database server do not match for a session, the lower of the two values is used.
You can override this parameter for a particular client connection by specifying the SDU parameter in the connect descriptor for a client.
|
See Also: Oracle Net Services Administrator's Guide for complete SDU usage and configuration information |
2048 bytes (2 KB)
512 to 32768 bytes (32 KB)
DEFAULT_SDU_SIZE=4096
If turned off, the parameter DISABLE_OOB enables Oracle Net to send and receive "break" messages using urgent data provided by the underlying protocol.
If turned on, disables the ability to send and receive "break" messages using urgent data provided by the underlying protocol. Once enabled, this feature applies to all protocols used by this client.
|
See Also: Operating system-specific documentation to determine if the protocols you are using support urgent data requests. TCP/IP is an example of a protocol that supports this feature. |
off
DISABLE_OOB=on
Use the parameter LOG_DIRECTORY_CLIENT to specify the destination directory for the client log file.
Current directory from which the executable is started
LOG_DIRECTORY_CLIENT=/oracle/network/log
Use the parameter LOG_DIRECTORY_SERVER to specify the destination directory for the database server log file.
Current directory from which the executable is started
LOG_DIRECTORY_SERVER=/oracle/network/log
Use the parameter LOG_FILE_CLIENT to specify the name of the log file for the client.
sqlnet.log
LOG_FILE_CLIENT=client
Use the parameter LOG_FILE_SERVER to specify the name of the log file for the database server.
sqlnet.log
LOG_FILE_SERVER=svr.log
Use the parameter NAMES.DCE.PREFIX to specify the Distributed Computing Environment (DCE) cell name (prefix) to use for name lookups.
/.:/subsys/oracle/names
NAMES.DCE.PREFIX=/.:/subsys/oracle/names
Use the parameter NAMES.DEFAULT_DOMAIN to set the domain from which the client most often looks up names resolution requests. When this parameter is set, the default domain name is automatically appended to any unqualified net service name or service name.
For example, if the default domain is set to us.acme.com, the connect string CONNECT scott/tiger@sales gets searched as sales.us.acme.com. If the connect string includes the domain extension, such as CONNECT scott/tiger@sales.acme.com, the domain is not appended.
None
NAMES.DEFAULT_DOMAIN=acme.com
Use the parameter NAMES.DIRECTORY_PATH to specify the order of the naming methods used for client name resolution lookups.
NAMES.DIRECTORY_PATH=(tnsnames, onames, hostname)
Table 5-1 Naming Method Values
| Naming Method Value | Description |
|---|---|
tnsnames (local naming naming method) |
Set to resolve a net service name through the tnsnames.ora file on the client.
|
ldap (directory naming naming method) |
Set to resolve a database service name, net service name, or net service alias through a directory server. |
ezconnect or hostname (easy connect naming or host naming method) |
Select to enable clients to use a TCP/IP connect identifier, consisting of a host name and optional port and service name. |
cds (CDS external naming method) |
Set to resolve an Oracle database name in a Distributed Computing Environment (DCE) environment. |
nis (Network Information Service (NIS) external naming method) |
Set to resolve service information through an existing NIS. |
NAMES.DIRECTORY_PATH=(tnsnames, onames)
Use the parameter NAMES.NIS.META_MAP to specify the map file to be used to map Network Information Service (NIS) attributes to an NIS mapname
sqlnet.maps
NAMES.NIS.META_MAP=sqlnet.maps
Use the parameter RECV_BUF_SIZE to specify the buffer space limit for receive operations of sessions. This parameter is supported by the TCP/IP, TCP/IP with SSL, and SDP protocols.
|
Note: Additional protocols might support this parameter on certain operating systems. Refer to operating-system specific documentation for information about additional protocols that support this parameter. |
|
See Also: Oracle Net Services Administrator's Guide for information about configuring this parameter |
The default value for this parameter is operating-system specific. The default for the Solaris 2.6 Operating System is 32768 bytes (32 KB).
You can override this parameter for a particular client connection by specifying the RECV_BUF_SIZE parameter in the connect descriptor for a client.
RECV_BUF_SIZE=11784
Use the parameter SEND_BUF_SIZE to specify the buffer space limit for send operations of sessions. This parameter is supported by the TCP/IP, TCP/IP with SSL, and SDP protocols.
|
Note: Additional protocols might support this parameter on certain operating systems. Refer to operating-system specific documentation for information about additional protocols that support this parameter. |
|
See Also: Oracle Net Services Administrator's Guide for information about configuring this parameter |
The default value for this parameter is operating-system specific. The default for the Solaris 2.6 Operating System is 8192 bytes (8 KB).
You can override this parameter for a particular client connection by specifying the SEND_BUF_SIZE parameter in the connect descriptor for a client.
SEND_BUF_SIZE=11784
Use the parameter SQLNET_ALLOWED_LOGON_VERSIONS to specify which authentication protocols are allowed by the client or database. If the client and database server do not have at least one matching version, then authentication fails with an error.
10 for Oracle Database 10g authentication protocols
9 for Oracle9i authentication protocols
8 for Oracle8i authentication protocols
7.3 for Oracle 7.3 authentication protocols
Any value other than 10 could expose vulnerabilities that may have existed in previous version of the authentication protocols. For complete compatibility, set the list of allowable versions for logon to include all versions of database in the system.
10, 9, 8
If both Oracle 8.1.7 and Oracle9i databases are present, then set the parameter as follows:
SQLNET_ALLOWED_LOGON_VERSIONS=(10,9,8)
Use the parameter SQLNET.AUTHENTICATION_KERBEROS5_SERVICE to define the name of the service used to obtain a Kerberos service ticket.
None
SQLNET.AUTHENTICATION_KERBEROS5_SERVICE=oracle
Use the parameter SQLNET.AUTHENTICATION_GSSAPI_SERVICE to define the CyberSAFE service principal.
Use the parameter SQLNET.AUTHENTICATION_SERVICES to enable one or more authentication services. If authentication has been installed, it is recommended that this parameter be set to either none or to one of the authentication methods.
None
none for no authentication methods. A valid username and password can be used to access the database.
all for all authentication methods
nts for Windows NT native authentication
kerberos5 for Kerberos authentication
cybersafe for Cybersafe authentication
radius for RADIUS authentication
dcegssapi for DCE GSSAPI authentication
SQLNET.AUTHENTICATION_SERVICES=(kerberos5, cybersafe)
Use the parameter SQLNET.CLIENT_REGISTRATION to set a unique identifier for this client computer. This identifier is passed to the listener with any connection request and is included in the Audit Trail. The identifier can be any alphanumeric string up to 128 characters long.
None
SQLNET.CLIENT_REGISTRATION=1432
Use the parameter SQLNET.CRYPTO_CHECKSUM_CLIENT to specify the checksum behavior for the client.
rejected
accepted to enable the security service if required or requested by the other side
rejected to disable the security service, even if the required by the other side
requested to enable the security service if the other side allows it
required to enable the security service and disallow the connection if the other side is not enabled for the security service
SQLNET.CRYPTO_CHECKSUM_CLIENT=accepted
Use the parameter SQLNET.CRYPTO_CHECKSUM_SERVER to specify the checksum behavior for the database server.
rejected
accepted to enable the security service if required or requested by the other side
rejected to disable the security service, even if the required by the other side
requested to enable the security service if the other side allows it
required to enable the security service and disallow the connection if the other side is not enabled for the security service
SQLNET.CRYPTO_CHECKSUM_SERVER=accepted
Use the parameter SQLNET.CRYPTO_CHECKSUM_TYPE_CLIENT to specify a list of crypto-checksum algorithms for the client to use.
md5
md5 for the RSA Data Security's MD5 algorithm
sha1 for the Secure Hash algorithm
SQLNET.CRYPTO_CHECKSUM_TYPE_CLIENT=(MD5)
Use the parameter SQLNET.CRYPTO_CHECKSUM_TYPE_SERVER to specify a list of crypto-checksum algorithms for the database server to use.
md5
md5 for the RSA Data Security's MD5 algorithm
sha1 for the Secure Hash algorithm
SQLNET.CRYPTO_CHECKSUM_TYPE_SERVER=(md5)
Use the parameter SQLNET.CRYPTO_SEED to specify the characters used when generating cryptographic keys. The more random the characters are, the stronger the keys are. The string should be 10-70 random characters. This is required for when encryption or checksumming are turned on. Encryption is turned on if the SQLNET.ENCRYPTION_CLIENT parameter is specified for the client and the SQLNET.ENCRYPTION_SERVER parameter is specified for the database server; checksumming is turned on if the SQLNET.CRYPTO_CHECKSUM_CLIENT parameter is specified for the client and the SQLNET.CRYPTO_CHECKSUM_SERVER parameter is specified for the database server.
qwertyuiopasdfghjkl;zxcvbnm,.s1
SQLNET.CRYPTO_SEED="qwertyuiopasdfghjkl;zxcvbnm,.s1"
Use the parameter SQLNET.ENCRYPTION_CLIENT to turn encryption on for the client.
rejected
accepted to enable the security service if required or requested by the other side
rejected to disable the security service, even if the required by the other side
requested to enable the security service if the other side allows it
required to enable the security service and disallow the connection if the other side is not enabled for the security service
SQLNET.ENCRYPTION_CLIENT=accepted
Use the parameter SQLNET.ENCRYPTION_SERVER to turn encryption on for the database server.
rejected
accepted to enable the security service if required or requested by the other side
rejected to disable the security service, even if the required by the other side
requested to enable the security service if the other side allows it
required to enable the security service and disallow the connection if the other side is not enabled for the security service
SQLNET.ENCRYPTION_SERVER=accepted
Use the parameter SQLNET.ENCRYPTION_TYPES_CLIENT to specify a list of encryption algorithms for the client to use.
All algorithms are used if none are specified.
One or more of the following:
3des112 for triple DES with a two-key (112 bit) option
3des168 for triple DES with a three-key (168 bit) option
des for standard 56 bit key size
des40 for 40 bit key size
rc4_40 for 40 bit key size
rc4_56 for 56 bit key size
rc4_128 for 128 bit key size
rc4_256 for 256 bit key size
SQLNET.ENCRYPTION_TYPES_CLIENT=(rc4_56)
Use the parameter SQLNET.ENCRYPTION_TYPES_SERVER to specify a list of encryption algorithms for the database server to use.
All algorithms are used if none are specified.
One or more of the following:
3des112 for triple DES with a two-key (112 bit) option
3des168 for triple DES with a three-key (168 bit) option
des for standard 56 bit key size
des40 for 40 bit key size
rc4_40 for 40 bit key size
rc4_56 for 56 bit key size
rc4_128 for 128 bit key size
rc4_256 for 256 bit key size
SQLNET.ENCRYPTION_TYPES_SERVER=(rc4_56, des, ...)
Use parameter SQLNET.EXPIRE_TIME to specify a the time interval, in minutes, to send a probe to verify that client/server connections are active. Setting a value greater than 0 ensures that connections are not left open indefinitely, due to an abnormal client termination. If the probe finds a terminated connection, or a connection that is no longer in use, it returns an error, causing the server process to exit. This parameter is primarily intended for the database server, which typically handles multiple connections at any one time.
Limitations on using this terminated connection detection feature are:
It is not allowed on bequeathed connections.
Though very small, a probe packet generates additional traffic that may downgrade network performance.
Depending on which operating system is in use, the server may need to perform additional processing to distinguish the connection probing event from other events that occur. This can also result in degraded network performance.
0
0
10
SQLNET.EXPIRE_TIME=10
Use the SQLNET.INBOUND_CONNECT_TIMEOUT parameter to specify the time, in seconds, for a client to connect with the database server and provide the necessary authentication information.
If the client fails to establish a connection and complete authentication in the time specified, then the database server terminates the connection. In addition, the database server logs the IP address of the client and an ORA-12170: TNS:Connect timeout occurred error message to the sqlnet.log file. The client receives either an ORA-12547: TNS:lost contact or an ORA-12637: Packet receive failed error message.
Without this parameter, a client connection to the database server can stay open indefinitely without authentication. Connections without authentication can introduce possible denial-of-service attacks, whereby malicious clients attempt to flood database servers with connect requests that consume resources.
To protect both the database server and the listener, Oracle Corporation recommends setting this parameter in combination with the INBOUND_CONNECT_TIMEOUT_listener_name parameter in the listener.ora file. When specifying values for these parameters, consider the following recommendations:
Set both parameters to an initial low value.
Set the value of the INBOUND_CONNECT_TIMEOUT_listener_name parameter to a lower value than the SQLNET.INBOUND_CONNECT_TIMEOUT parameter.
For example, you can set INBOUND_CONNECT_TIMEOUT_listener_name to 2 seconds and INBOUND_CONNECT_TIMEOUT parameter to 3 seconds. If clients are unable to complete connections within the specified time due to system or network delays that are normal for the particular environment, then increment the time as needed.
|
See Also: Oracle Net Services Administrator's Guide for information about configuring these parameters |
None
SQLNET.INBOUND_CONNECT_TIMEOUT=3
Use the parameter SQLNET.KERBEROS5_CC_NAME to specify the complete path name to the Kerberos credentials cache file.
/usr/tmp/krbcache on UNIX operating systems and c:\tmp\krbcache on Windows operating systems
SQLNET.KERBEROS5_CC_NAME=/usr/tmp/krbcache
Use the parameter SQLNET.KERBEROS5_CLOCKSKEW to specify how many seconds can pass before a Kerberos credential is considered out of date.
300
SQLNET.KERBEROS5_CLOCKSKEW=1200
Use the parameter SQLNET.KERBEROS5_CONF to specify the complete path name to the Kerberos configuration file, which contains the realm for the default Key Distribution Center (KDC) and maps realms to KDC hosts. The KDC maintains a list of user principals and is contacted through the kinit program for the user's initial ticket.
/krb5/krb.conf on UNIX operating systems and c:\krb5\krb.conf on Windows operating systems
SQLNET.KERBEROS5_CONF=/krb5/krb.conf
Use the parameter SQLNET.KERBEROS5_KEYTAB to specify the complete path name to the Kerberos principal/secret key mapping file, which is used to extract keys and decrypt incoming authentication information.
/etc/v5srvtab on UNIX operating systems and c:\krb5\v5srvtab on Windows operating systems
SQLNET.KERBEROS5_KEYTAB=/etc/v5srvtab
Use the parameter SQLNET.KERBEROS5_REALMS to specify the complete path name to the Kerberos realm translation file, which provides a mapping from a host name or domain name to a realm.
/krb5/krb.realms on UNIX operating systems and c:\krb5\krb.realms on Windows operating systems
SQLNET.KERBEROS5_REALMS=/krb5/krb.realms
Use the parameter SQLNET.RADIUS_ALTERNATE to specify an alternate RADIUS server to use in case the primary server is unavailable. The value can be either the IP address or host name of the server.
None
SQLNET.RADIUS_ALTERNATE=radius2
Use the parameter SQLNET.RADIUS_ALTERNATE_PORT to specify the listening port of the alternate RADIUS server.
1645
SQLNET.RADIUS_ALTERNATE_PORT=1667
Use the parameter SQLNET.RADIUS_ALTERNATE_RETRIES to specify the number of times the database server should resend messages to the alternate RADIUS server.
3
SQLNET.RADIUS_ALTERNATE_RETRIES=4
Use the parameter SQLNET.RADIUS_AUTHENTICATION to specify the location of the primary RADIUS server, either by its host name or IP address.
Local host
SQLNET.RADIUS_AUTHENETICATION=officeacct
Use the parameter SQLNET.RADIUS_AUTHENTICATION_INTERFACE to specify the class containing the user interface used to interact with the user.
DefaultRadiusInterface
SQLNET.RADIUS_AUTHENTICATION_INTERFACE=DefaultRadiusInterface
Use the parameter SQLNET.RADIUS_AUTHENTICATION_PORT to specify the listening port of the primary RADIUS server.
1645
SQLNET.RADIUS_AUTHENTICATION_PORT= 1667
Use the parameter SQLNET.RADIUS_AUTHENTICATION_RETRIES to specify the number of times the database server should resend messages to the primary RADIUS server.
3
SQLNET.RADIUS_AUTHENTICATION_RETRIES=4
Use the parameter SQLNET.RADIUS_AUTHENTICATION_TIMEOUT to specify the time, in seconds, that the database server should wait for a response from the primary RADIUS server.
5
SQLNET.RADIUS_AUTHENTICATION_TIMEOUT=10
Use the parameter SQLNET.RADIUS_CHALLENGE_RESPONSE to turn challenge response on or off.
off
on | off
SQLNET.RADIUS_CHALLENGE_RESPONSE=on
Use the parameter SQLNET.RADIUS_SECRET to specify the location of the RADIUS secret key.
The $ORACLE_HOME/network/security/radius.key file on UNIX operating systems and the ORACLE_HOME\network\security\radius.key file on Windows
SQLNET.RADIUS_SECRET=oracle/bin/admin/radiuskey
Use the parameter SQLNET.RADIUS_SEND_ACCOUNTING to turn accounting on and off. If enabled, packets are sent to the active RADIUS server at listening port plus one. The default port is 1646.
off
on | off
SQLNET.RADIUS_SEND_ACCOUNTING=on
Use the parameter SQLNET.RECV_TIMEOUT to specify the time, in seconds, for a database server to wait for client data after connection establishment. A client must send some data within the time interval.
For environments in which clients shut down on occasion or abnormally, setting this parameter is recommended. If a client does not send any data in time specified, then the database server logs an ORA-12535: TNS:operation timed out and ORA-12609: TNS: Receive timeout occurred to the sqlnet.log file. Without this parameter, the database server may continue to wait for data from clients that may be down or are experiencing difficulties.
You can also set this parameter on the clientside to specify the time, in seconds, for a client to wait for response data from the database server after connection establishment. Without this parameter, the client may wait for a long period of time for a response from a database server saturated with requests.
Set the value for this parameter to an initial low value and adjust according to system and network capacity. If necessary, use this parameter in conjunction with the SQLNET.SEND_TIMEOUT parameter.
|
See Also: Oracle Net Services Administrator's Guide for information about configuring these parameters |
None
SQLNET.RECV_TIMEOUT=3
Use to specify the time, in seconds, for a database server to complete a send operation to clients after connection establishment.
For environments in which clients shut down on occasion or abnormally, setting this parameter is recommended. If the database server is unable to complete a send operation in the time specified, then it logs an ORA-12535: TNS:operation timed out and ORA-12608: TNS: Send timeout occurred to the sqlnet.log file. Without this parameter, the database server may continue to send responses to clients that are unable to receive data due to a downed computer or a busy state.
You can also set this parameter on the clientside to specify the time, in seconds, for a client to complete send operations to the database server after connection establishment. Without this parameter, the client may continue to send requests to a database server already saturated with requests.
Set the value for this parameter to an initial low value and adjust according to system and network capacity. If necessary, use this parameter in conjunction with the SQLNET.RECV_TIMEOUT parameter.
|
See Also: Oracle Net Services Administrator's Guide for information about configuring these parameters |
None
SQLNET.SEND_TIMEOUT=3
Use the SSL_CRT_REVOCATION parameter to configure a revocation check for a certificate.
none
none to turn off certificate revocation checking
requested to perform certificate revocation in case a Certificate Revocation List (CRL) is available. Reject SSL connection if the certificate is revoked. If no appropriate CRL is found to determine the revocation status of the certificate and the certificate is not revoked, then accept the SSL connection
required to perform certificate revocation when a certificate is available. If a certificate is revoked and no appropriate CRL is found, then reject the SSL connection If no appropriate CRL is found to ascertain the revocation status of the certificate and the certificate is not revoked. then accept the SSL connection.
SSL_CERT_REVOCATION=required
Use the parameter SSL_CRL_FILE to specify the name of the file where you can assemble the CRL of CAs for client authentication.
This file contains the PEM-encoded CRL files, in order of preference. You can use this file alternatively or in additional to the SSL_CERT_PATH parameter. This parameter is only valid if SSL_CERT_REVOCATION is set to either requested or required.
None
Use the parameter SSL_CRL_PATH to specify the destination directory of the CRL of CA. The files in this directory are hashed symbolic links created by Oracle Wallet Manager. This parameter is only valid if SSL_CERT_REVOCATION is set to either requested or required.
None
None
SQLNET.SEND_TIMEOUT=3
Use the parameter SSL_CIPHER_SUITES to control what combination of encryption and data integrity is used by the Secure Sockets Layer (SSL).
None
|
See Also: Oracle Advanced Security Administrator's Guide for further information about cipher suite values |
SSL_CIPHER_SUITE=(ssl_rsa_with_rc4_138_md5)
Use the parameter SSL_CLIENT_AUTHENTICATION to specify whether or not a client—in addition to the database server—is authenticated using SSL.
true
true | false
SSL_CLIENT_AUTHENTICATION=true
Use the parameter SSL_SERVER_DN_MATCH to enforce that the distinguished name (DN) for the database server matches its service name. If you enforce the match verifications, then SSL ensures that the certificate is from the server. If you select to not enforce the match verification, then SSL performs the check but allows the connection, regardless if there is a match. Not enforcing the match allows the server to potentially fake its identify.
no
yes | on | true to specify to enforce a match. If the DN matches the service name, then the connection succeeds. If the DN does not match the service name, then the connection fails.
no | off | false to specify to not enforce a match. If does not match the service name, then the connection is successful, but an error is logged to the sqlnet.log file.
In addition to the sqlnet.ora file, configure the tnsnames.ora parameter SSL_SERVER_CERT_DN to enable server DN matching.
SSL_SERVER_DN_MATCH=yes
Use the parameter SSL_VERSION to force the version of the SSL connection.
Clients and database servers must use a compatible version.
undetermined
undetermined | 2.0 | 3.0
SSL_VERSION=2.0
Use the parameter TCP.EXCLUDED_NODES to specify which clients are denied access to the database.
TCP.EXCLUDED_NODES=(hostname | ip_address, hostname | ip_address, ...)
TCP.EXCLUDED_NODES=(finance.us.acme.com, mktg.us.acme.com, 144.25.5.25)
Use the parameter TCP.INVITED_NODES to specify which clients are allowed access to the database. This list takes precedence over the TCP.EXCLUDED_NODES parameter if both lists are present.
TCP.INVITED_NODES=(hostname | ip_address, hostname | ip_address, ...)
TCP.INVITED_NODES=(sales.us.acme.com, hr.us.acme.com, 144.185.5.73)
Use the parameter TCP.VALIDNODE_CHECKING to check for the TCP.INVITED_NODES and TCP.EXCLUDED_NODES to determine which clients to allow or deny access.
no
yes | no
TCP.VALIDNODE_CHECKING=yes
Use the parameter TCP.NODELAY to preempt delays in buffer flushing within the TCP/IP protocol stack.
yes
yes | no
TCP.NODELAY=yes
Use the parameter TNSPING.TRACE_DIRECTORY to specify the destination directory for the TNSPING utility trace file, tnsping.trc.
The $ORACLE_HOME/network/trace directory on UNIX operating systems and the %ORACLE_HOME%\network\trace directory on Windows operating systems
TNSPING.TRACE_DIRECTORY=/oracle/traces
Use the parameter TNSPING.TRACE_LEVEL to turn TNSPING utility tracing on, at a specific level, or off.
off
off for no trace output
user for user trace information
admin for administration trace information
support for Oracle Support Services trace information
TNSPING.TRACE_LEVEL=admin
Use the parameter TRACE_DIRECTORY_CLIENT to specify the destination directory for the client trace file.
The $ORACLE_HOME/network/trace directory on UNIX operating systems and the ORACLE_HOME\network\trace directory on Windows operating systems
TRACE_DIRECTORY_CLIENT=/oracle/traces
Use the parameter TRACE_DIRECTORY_SERVER to specify the destination directory for the database server trace file.
The $ORACLE_HOME/network/trace directory on UNIX operating systems and the %ORACLE_HOME%\network\trace directory on Windows
TRACE_DIRECTORY_SERVER=/oracle/traces
Use the parameter TRACE_FILE_CLIENT to specify the name of the client trace file.
sqlnet.trc
TRACE_FILE_CLIENT=clientsqlnet.trc
Use the parameter TRACE_FILE_SERVER to specify the name of the database server trace file
svr_pid.trc
TRACE_FILE_SERVER=svrsqlnet.trc
Use the parameter TRACE_FILELEN_CLIENT to specify the size of the client trace files in kilobytes (KB). When the size is met, the trace information is written to the next file. The number of files is specified with the TRACE_FILENO_CLIENT parameter.
TRACE_FILELEN_CLIENT=100
Use the parameter TRACE_FILELEN_SERVER to specify the size of the database server trace files in kilobytes (KB). When the size is met, the trace information is written to the next file. The number of files is specified with the TRACE_FILENO_SERVER parameter.
TRACE_FILELEN_SERVER=100
Use the parameter TRACE_FILENO_CLIENT to specify the number of trace files for client tracing. When this parameter is set along with the TRACE_FILELEN_CLIENT parameter, trace files are used in a cyclical fashion. The first file is filled first, then the second file, and so on. When the last file has been filled, the first file is re-used, and so on.
The trace file names are distinguished from one another by their sequence number. For example, if the default trace file of sqlnet.trc is used, and this parameter is set to 3, the trace files would be named sqlnet1.trc, sqlnet2.trc and sqlnet3.trc.
In addition, trace events in the trace files are preceded by the sequence number of the file.
None
TRACE_FILENO_CLIENT=3
Use the parameter TRACE_FILENO_SERVER to specify the number of trace files for database server tracing. When this parameter is set along with the TRACE_FILELEN_SERVER parameter, trace files are used in a cyclical fashion. The first file is filled first, then the second file, and so on. When the last file has been filled, the first file is re-used, and so on.
The trace file names are distinguished from one another by their sequence number. For example, if the default trace file of svr_pid.trc is used, and this parameter is set to 3, the trace files would be named svr1_pid.trc, svr2_pid.trc and svr3_pid.trc.
In addition, trace events in the trace files are preceded by the sequence number of the file.
None
TRACE_FILENO_SERVER=3
Use the parameter TRACE_LEVEL_CLIENT to turn client tracing on, at a specific level, or off.
off
off for no trace output
user for user trace information
admin for administration trace information
support for Oracle Support Services trace information
TRACE_LEVEL_CLIENT=user
Use the parameter TRACE_LEVEL_SERVER to turn server tracing on, at a specific level, or off.
off
off for no trace output
user for user trace information
admin for administration trace information
support for Oracle Support Services trace information
TRACE_LEVEL_SERVER=admin
Use the parameter TRACE_TIMESTAMP_CLIENT to add a time stamp in the form of dd-mon-yyyy hh:mi:ss:mil to every trace event in the client trace file, which has a default name of sqlnet.trc.
on
on or true | off or false
TRACE_TIMESTAMP_SERVER=true
Use the parameter TRACE_TIMESTAMP_SERVER to add a time stamp in form of dd-mon-yyyy hh:mi:ss:mil to every trace event in the database server trace file, which has a default name of svr_pid.trc.
off
on or true | off or false
TRACE_TIMESTAMP_SERVER=true
Use the parameter TRACE_UNIQUE_CLIENT to specify whether or not a unique trace file is created for each client trace session. When the value is set to on, a process identifier is appended to the name of each trace file, enabling several files to coexist. For example, trace files named sqlnetpid.trc are created if default trace file name sqlnet.trc is used. When the value is set to off, data from a new client trace session overwrites the existing file.
on
on or off
TRACE_UNIQUE_CLIENT=on
If set to true, the parameter USE_CMAN routes the client to a protocol address for an Oracle Connection Manager.
The following example shows two address lists. While the first address list routes the client to an Oracle Connection Manager, the second address list routes the client directly to a listener.
sales=
(DESCRIPTION=
(LOAD_BALANCE=on)
(FAILOVER=on)
(ADDRESS_LIST=
(SOURCE_ROUTE=yes)
(ADDRESS=(PROTOCOL=tcp)(HOST=host1)(PORT=1630))
(ADDRESS=(PROTOCOL=tcp)(HOST=host2)(PORT=1521)))
(ADDRESS_LIST=
(ADDRESS=(PROTOCOL=tcp)(HOST=host3)(PORT=1521)))
(CONNECT_DATA=(SERVICE_NAME=sales.us.acme.com)))
Without USE_CMAN=true, the client picks one of the address lists at random and fails over to the other address list if the chosen ADDRESS_LIST fails. With USE_CMAN=true, the client always uses the first address list.
If no Oracle Connection Manager addresses are available, connections are routed through any available listener address.
false
true | false
USE_CMAN=true
If set to on, the parameter USE_DEDICATED_SERVER automatically appends (SERVER=dedicated) to the connect data for a connect descriptor. This way connections from this client use a dedicated server process, even if shared server is configured.
This parameter adds (SERVER=dedicated) to the CONNECT_DATA section of the connect descriptor used by the client. It overrides the current value of the SERVER parameter in the tnsnames.ora file.
off
on to append (SERVER=dedicated)
off to hand off requests to existing server processes
USE_DEDICATED_SERVER=on
Use the parameter WALLET_LOCATION to specify the location of wallets. Wallets are certificates, keys, and trustpoints processed by SSL.
Oracle wallets on the file system:
WALLET_LOCATION=
(SOURCE=
(METHOD=file)
(METHOD_DATA=
(DIRECTORY=directory)
[(PKCS11=TRUE/FALSE)]))
Microsoft certificate store:
WALLET_LOCATION=
(SOURCE=
(METHOD=mcs))
Oracle wallets in the Windows registry:
WALLET_LOCATION=
(SOURCE=
(METHOD=reg)
(METHOD_DATA=
(KEY=registry_key)))
Entrust wallets:
WALLET_LOCATION=
(SOURCE=
(METHOD=entr)
(METHOD_DATA=
(PROFILE=file.epf)
(INIFILE=file.ini)))
WALLET_LOCATION supports the following subparameters:
SOURCE: Specify the type of storage for wallets and storage location.
METHOD: Specify the type of storage.
METHOD_DATA: Specify the storage location.
DIRECTORY: Specify the location of Oracle wallets on file system.
KEY: Specify the wallet type and location in the Windows registry.
PROFILE: Specify the Entrust profile file (.epf).
INIFILE: Specify the Entrust initialization file (.ini).
None
The key/value pair for Microsoft's certificate store (MCS) omits the METHOD_DATA parameter because MCS does not use wallets. Instead, Oracle PKI (public key infrastructure) applications obtain certificates, trustpoints and private keys directly from the user's profile.
If an Oracle wallet is stored in the Windows registry and the wallet's key (KEY) is SALESAPP, the storage location of the encrypted wallet is HKEY_CURRENT_USER\SOFTWARE\ORACLE\WALLETS\SALESAPP\EWALLET.P12. The storage location of the decrypted wallet is HKEY_CURRENT_USER\SOFTWARE\ORACLE\WALLETS\SALESAPP\CWALLET.SSO.
Oracle wallets on file system:
WALLET_LOCATION=
(SOURCE=
(METHOD=file)
(METHOD_DATA=
(DIRECTORY=/etc/oracle/wallets/databases)))
Microsoft certificate store:
WALLET_LOCATION=
(SOURCE=
(METHOD=mcs))
Oracle Wallets in the Windows registry:
WALLET_LOCATION=
(SOURCE=
(METHOD=REG)
(METHOD_DATA=
(KEY=SALESAPP)))
Entrust Wallets:
WALLET_LOCATION=
(SOURCE=
(METHOD=entr)
(METHOD_DATA=
(PROFILE=/etc/oracle/wallets/test.epf)
(INIFILE=/etc/oracle/wallets/test.ini)))
