Re: Question on group privilege

I think you will need below privilege for the performance group to be able to run tuning advisor and create profile/baseline etc.

ADVISOR :- For tuning advisor
ADMINISTER SQL TUNING SET :- For able to create and modify sql tuning set created by self
ADMINISTER ANY SQL TUNING SET :- For able to modify sql tuning set of any user

CREATE ANY SQL PROFILE :- For creating Sql profile ALTER ANY SQL PROFILE :- For enabling/disabling Sql profile DROP ANY SQL PROFILE :- For dropping Sql profile

ADMINISTER SQL MANAGEMENT OBJECT :- Above three profile specific roles are now deprecated and replaced with this new role.

In addition to above you may need - EXECUTE ON DBMS_SQLTUNE.

On Sun, Nov 14, 2021 at 12:10 AM Pap <oracle.developer35_at_gmail.com> wrote:

> Hi, We have a team which is going to mainly look into database performance
> issues and will not do any administrative work(say e.g. script
> deployment,backup recovery, upgrade, migration, replication etc). And we
> want to make sure to have required privileges to the performance group but
> no elevated privilege should be given.
>
> What I can think of is, mainly to investigate the historical and current
> performance issues in the production database, we should have a "select
> catalogue role" so that all the dba_* views can be read/queried along with
> application tables. And also they should be able to run the sql tuning
> advisor , create profile/baselines/patch etc. I think 11.2 was creating a
> profile role specifically. But 19C has something to replace that and a
> superior one called 'ADMINISTER SQL MANAGEMENT OBJECT'. So I want to
> understand, is this ADMINISTER SQL MANAGEMENT OBJECT privilege is safe
> without any elevated privilege underlying within? And/Or if any additional
> privilege is required for this group?
>

--
http://www.freelists.org/webpage/oracle-l