Return
-
Title
Why did the Foglight user require the "CREATE ANY DIRECTORY" or "WITH GRANT OPTION" privilege in older Foglight cartridges? -
Description
In pre-5.6.10 Foglight cartridges for Oracle, the "Create User" script, which is running when a user adds a monitored database to Foglight, requires that the Foglight database user has the "CREATE ANY DIRECTORY" privilege. Why is this required?
The Foglight Oracle Agent grants itself excessive permissions upon creation of each database agent. One such permission is privileges on the alert log directory using the “WITH GRANT OPTION” modifier:GRANT EXECUTE, READ, WRITE ON DIRECTORY Q_ALERT_LOG_{dbsid}_LOC TO FOGMON WITH GRANT OPTION;Is this still necessary? -
Cause
The older alert.log collections created an Oracle directory that pointed to background_dump_dest OS directory in order to read Oracle alert.log. To achieve that goal, "GRANT CREATE ANY DIRECTORY TO &USER_NAME" permission was used by alert.log collection. In general it could be revoked, but if the directory will change/become invalid/etc, the agent would not be able to recreate it automatically and the collection will fail. -
Resolution
Drop the user and then recreate the user and objects using the latest grant script that comes with the Oracle cartridge or run the script in the background from the Foglight UI.