Troubleshooting Oracle Database@Azure

We recommend the removal of all Microsoft Azure locks to Oracle Database@Azure resources before terminating the resources. For example, if you're using a locked Microsoft Azure private endpoint with Oracle Database@Azure, confirm that the endpoint can be deleted, then remove the lock before deleting the Oracle Database@Azure resources. If you have a policy to prevent the deletion of locked resources, the Oracle Database@Azure work flow to delete system resources fails because Oracle Database@Azure can't delete a locked resource.

IP address requirements are different between Oracle Database@Azure and Exadata Database Service on Dedicated Infrastructure in Oracle Cloud Infrastructure (OCI). In the Requirements for IP Address Space documentation for Exadata in OCI, the following differences with the requirements of Oracle Database@Azure must be considered:

• Oracle Database@Azure only supports Exadata X9M. All other shapes are unsupported.

• Oracle Database@Azure reserves 13 IP addresses for the client subnet.

You can connect a Microsoft Azure VM to an Oracle Exadata VM cluster if both are in the same virtual network (VNet). This functionality is automatic, and requires no extra changes to network security group (NSG) rules. If you need to connect an Azure VM from a different VNet than the one used by the Exadata VM cluster, you must also configure NSG traffic rules to let the other VNet's traffic to flow to the Exadata VM cluster. For example, if you have 2 VNets ("A" and "B"), with VNet A serving the Microsoft Azure VM, and VNet B serving the Oracle Exadata VM cluster, you need to add VNet A's CIDR address to the NSG route table in OCI.

Create the policy described in this section to enable resource creation in Azure East US 2. If you try to create resources to East US 2 without the required permissions, the Azure Portal displays the "Your deployment failed" message:

Create the required policy as follows:

1. Open the navigation menu  and select Identity & Security. Under Identity, select Policies.
2. Select Create Policy.
3. Name: Enter Additional_Multicloud_Policy
4. Description: Optional. Enter a description. For example, "Policy to enable Oracle Database@Azure resource creation in the Azure East US 2 region."

5. In the Policy Builder, use the Show manual editor toggle switch to enable the manual policy editor field, then paste the following policy into the manual editor:

   define tenancy networking-dataplane2 as ocid1.tenancy.oc1..aaaaaaaailqy63b6fbqoa6jyd324iyb5xoafpji2j6evpqqx5or74vwknv5a
      endorse any-user to {DRG_ATTACHMENT_READ, DRG_ATTACH, DRG_DETACH, VCN_ATTACH, DRG_ROUTE_TABLE_ATTACH, ROUTE_TABLE_ATTACH, ROUTE_TABLE_DETACH} in tenancy networking-dataplane2 where all { request.principal.type = 'multicloudlink' }

6. Select Create to create the policy. The new policy is listed in the Policies list view page.

Create the required policy for observability (metrics) as follows:

1. Open the navigation menu  and select Identity & Security. Under Identity, select Policies.
2. Select Create Policy.
3. Name: Enter Additional_Observabilioty_Multicloud_Policy
4. Description: Optional. Enter a description. For example, "Policy to enable Oracle Database@Azure metrics for Azure East US 2 region."

5. In the Policy Builder, use the Show manual editor toggle switch to enable the manual policy editor field, then paste the following policy into the manual editor:

   define tenancy obs_tenancy_2 as ocid1.tenancy.oc1..aaaaaaaalfamrkmvchwc3mndr4c4htwtntx2ampbas3z42c6sxyqviit4gta
   define tenancy obs_cp_tenancy_2 as ocid1.tenancy.oc1..aaaaaaaa7bzfp55yuik3t2sesnqgsyohpbfr4ocl4vlq7foyhmaa34xktyja
   endorse any-user to use stream-push in tenancy obs_tenancy_2 where all { request.principal.type='multicloudlink' }
   endorse any-user to read streams in tenancy obs_tenancy_2 where all { request.principal.type='multicloudlink' }
   admit any-user of tenancy obs_tenancy_2 to use metrics in compartment id ocid1.compartment.oc1..aaaaaaaalro4yg4evjyyrtxrjedakvtg6tcqizdg4xulwbcxctwtpc3nvjdq where all {request.principal.type='serviceconnector'}
   admit any-user of tenancy obs_cp_tenancy_2 to { DATABASE_INSPECT, PLUGGABLE_DATABASE_INSPECT } in compartment id ocid1.compartment.oc1..aaaaaaaalro4yg4evjyyrtxrjedakvtg6tcqizdg4xulwbcxctwtpc3nvjdq where all { request.principal.type = 'workload', request.principal.namespace = 'obs-cp', request.principal.service_account = 'obs-cp-service-account’}
   

6. Select Create to create the policy. The new policy is listed in the Policies list view page.