Changing sysman and dbsnmp passwords – It ain’t that easy

And of course it’s not that easy!

Actually this is quite annoying.

I have 2 concerns: Having my backups working properly as well as the DB Console.

But also renew my passwords from time to time.

And here we are sys and system’s passwords are luckily easy to change.

But what about sysman and dbsnmp?

Those are not. Try to change it and you will have your backups stop working, OEM throws in tons of errors and soon you will be asking yourself why the hell you wanted to change those passwords in the first place.

The reason

Sysman user is the schema of the standalone repository of the 10g EM DB Control.

If you have change only dbsnmp password your backups will work and the DB console as well but all the cool graphics that I like to show to our customers will disappear and that’s not cool.
There are 2 procedures. 1 for each passwords

Changing sysman password

So, since it’s the schema of the standalone repository, the DB console must be shut down.

C:\emctl stop dbconsole

This should stop dbconsole and the agent.

Have a check first.

C:\emctl status dbconsole

C:\emctl status agent

On windows the agent is very often not shutdown properly… So do it using the services screen find your Oracle10Agent service and make sure it’s not started.

When this is done, open an sqlplus console and throw in the command to change password

C:\set oracle_sid= [your SID]

C:\sqlplus / as sysdba

SQL>alter user sysman identified by [New Password];

Then check the new password by connecting with sysman user. This is to make sure sysman is not locked. Because when the password is changed and you try to reach the OEM, it will locked the sysman user.

SQL>conn sysman/newpassword

connected.

Ah that’s cool

if you get

ora-28000: account is locked

Then unlock it first.

SQL> alter user sysman account unlock;

Now that you get your new password and you are sure the account is not locked, you have to modify the emoms.properties file.

It’s located at ORACLE_HOME\[HOST]_[SID]\sysman\config. Replace HOST with your computer name and SID with your SID.

There are 2 parameters to modify:

oracle.sysman.eml.mntr.emdRepPwd= [Your encrypted password]

oracle.sysman.eml.mntr.emdRepPwdEncrypted=True

Change [Your encrypted password] with your new password in the first parameter

and change True to False in the second parameter.

Wait a minute. That is not very safe! The password is not encrypted!

That’s where Oracle 10g is cool. It’s not like you have a choice here.

As soon as you restart Dbconsole and Oracle agent, it will change false to true and your password will look like a bunch of numbers and letters again (Geeks love that)

So just type in:

C:\emctl start dbconsole

C:\emctl start agent

Again, if the agent is not started, try to do it through the service window. I found it to work much better than the command line for Oracle Agent.

Changing dbsnmp password

It’s about the same thing except it’s another configuration file.

Stop Db Console and Oracle agent. Just like before.

Make sure it’s stopped just like before.

Modify your user password just like before except use alter dbsnmp instead of sysman.

Finally make sure it’s not locked.

We have to modify the file targets.xml this time and that one is located at:

ORACLE_HOME\[HOST]_[SID]\sysman\emd

Look for this line:

<Property NAME=”password” VALUE=”<[Your encrypted password]>” ENCRYPTED=”TRUE”/>

Just like before, change [Your encrypted password] to your new password and change TRUE to FALSE.

Just like before, restart your DB Console service and Oracle Agent service.

Make sure they are working.

C:\emctl status dbconsole

C:\emctl status agent

Voila! It’s all done.

The bottom line is: When you want to change a password that doesn’t look like a collegue name, find some documentation on it first. A good way is to google: Problem [user].

You’ll find a lot of them!