Oracle AAIP warning: "ORA-28009: connection as SYS should be as SYSDBA or SYSOPER"

[massimiliano.rizzi]

==================================================
Veeam Support Case # 05280052
==================================================

Hello Community,

we are trying to obtain application-consistent backups and replicas of a handful of Windows VMs running Oracle databases inside the Guest OS.

We have been given the credentials of the SYS Oracle account for a test VM, however we are getting the error message below:

==================================================
Oracle error has occurred. ORA-28009: connection as SYS should be as SYSDBA or SYSOPER
==================================================

What bugs me is that I keep getting the error message above even if I purposely type a wrong password of the SYS Oracle account. The Oracle DBA is saying that it is the Veeam runtime process that must connect to the database "AS SYSDBA." in order to properly invoke the SYSDBA privilege.

Any suggestions and thoughts will be greatly appreciated.

Thanks and Regards,

Massimiliano

[HannesK]

Hello,
hmm, I use the "oracle" account which is in the Windows group "ORA_DBA". The "oracle" user is configured for application aware processing as the user is a member of the local administrators group. In the Oracle settings I have "use guest OS credentials". That works fine.

What exactly did you configure? In the end, it sounds like a permission issue.

Best regards,
Hannes

[massimiliano.rizzi]

Hello Hannes,

thank you for taking the time to read my post and provide me with the information. It is very much appreciated.

For application aware processing we are using a domain user which is a member of the local administrators group. For the Oracle settings we are using Oracle Database authentication:



Thanks and Regards,

Massimiliano

[PetrM]

Hi Massimiliano,

Your setup is fully supported and must work, for example the same config works perfectly in my lab. Let's wait for what our support engineer can find out.

Thanks!

[massimiliano.rizzi]

Hi there Petr,

I will update this thread with the findings from the Support Team.

Thanks!

Massimiliano

[massimiliano.rizzi]

Hello there,

a quick update here with the findings so far.

As part of doing some more testing, we temporarily added the domain account we are using on Guest Processing tab to the ORA_DBA group in order to grant this account the SYSDBA privileges needed in order to backup Oracle using guest OS credentials. That works fine.

As a result, it seems like the warning message pops up only when using Oracle Database authentication and the SYS user. As backup using SYS is not considered a best practice, as a workaround we proposed using the same domain account we are using on Guest Processing and "use guest OS credentials".

Thanks!

Massimiliano

[PetrM]

Hi Massimiliano,

Glad to hear that the workaround works but why do you think that SYS is not a best practice?

Thanks!

[massimiliano.rizzi]

Hi there Petr,

here is the quoted statement from support engineer:

As one more test we could create new oracle scheme (creds), grant sysdba rights to it and add it to Veeam Oracle processing settings. If it will also work fine, I'd advice to leave it as it, if I may, instead of fixing SYS. As in general backup using SYS isn't a best practice, it's like backing up linux using root.

Please forgive me for any inaccuracy. I am neither a DBA nor Oracle savvy, si I'm trying to learn the most out of this

Thanks!

[PetrM]

Thanks for clarifications! First of all, I must note that our current requirements for AAIP that are listed on this page of help center are still valid:

To back up Oracle databases, make sure the account specified on the Oracle tab has been granted SYSDBA privileges. You can use either the same account that was specified at the Guest Processing step if such an account is a member of the ORA_DBA group for a Windows-based VM and OSASM, OSDBA and OINSTALL groups for a Linux-based VM, or you can use, for example, the SYS Oracle account or any other Oracle account that has been granted SYSDBA privileges.

The SYSBACKUP role is recommended to perform backup and recovery operations from either RMAN or SQL*Plus, for example you can use SYSBACKUP role to launch backup or restore via Veeam Plug-in for Oracle RMAN. You can find more information here.

The conclusion provided by our support engineer is absolutely valid and I also suggest to leave the current settings intact, there is no reason to spend time on troubleshooting of "SYS" without real necessity. However, I wouldn't say that usage of "SYS" is not "a best practice" but named accounts can have some advantages from database administering perspective.

Thanks!