Setting the file. One moment.
Subchapter 67.12
references/troubleshooting.mdMarkdown10 KBView on GitHub
Common Oracle connectivity errors and fixes. Pair with the networking.md, connection-auth.md, and compute-runtime references for deeper context.
Network can’t reach RDS.
available: aws rds describe-db-instances --db-instance-identifier <id> --query 'DBInstances[0].DBInstanceStatus'Test:
nc -zv <rds-endpoint> 1521
bash scripts/test_connectivity.sh <endpoint> 1521Wrong endpoint or port.
aws rds describe-db-instances --db-instance-identifier <id> --query 'DBInstances[0].Endpoint'*.rds.amazonaws.com endpointPort isn’t 1521Wrong SERVICE_NAME or SID.
aws rds describe-db-instances --db-instance-identifier <id> --query 'DBInstances[0].DBName'(CONNECT_DATA=(SERVICE_NAME=ORCL)) vs (CONNECT_DATA=(SID=ORCL))Using SID syntax when a Service Name is required (common for newer tools). Switch to:
(CONNECT_DATA=(SERVICE_NAME=ORCL))aws secretsmanager get-secret-value --secret-id <name> --query SecretString --output textClient driver too old.
python-oracledb 6+, ojdbc11 23.x, node-oracledb 6+, ODP.NET Core latestClient doesn’t trust RDS CA.
curl -o global-bundle.pem https://truststore.pki.rds.amazonaws.com/global/global-bundle.pemwallet_location to the directory containing the PEMupdate-ca-certificates)SSL_SERVER_DN_MATCH = FALSE (cert CN won’t match localhost)TLS version or cipher mismatch.
SQLNET.SSL_VERSION = 1.2Thick mode can’t locate Oracle Client.
oracledb.init_oracle_client(lib_dir="/usr/lib/oracle/21/client64/lib")libaio on LinuxSome operation isn’t supported in thin mode. Usually Kerberos with in-memory tickets or Advanced Queuing. Switch to thick for just that code path, or find the thin-compatible equivalent.
pip install oracledbAdd ojdbc11 dependency:
<dependency>
<groupId>com.oracle.database.jdbc</groupId>
<artifactId>ojdbc11</artifactId>
<version>23.4.0.24.05</version>
</dependency>Pool exhausted.
maxPoolSize too low for workloadmax_connections exceeded across all app instances — check CloudWatch DatabaseConnectionssecretsmanager:GetSecretValue on the correct ARN (including the random suffix)kms:Decrypt permissionEach Lambda instance has its own pool. High concurrency → many connections.
max small (1-2 per instance)DatabaseConnections CloudWatch metricsecretsmanager:GetSecretValuesecretsmanager:GetSecretValueserviceAccountName: <sa-name>max small (1-3 per pod)maxReplicas × max ≤ RDS capacity budgetDatabaseConnections, set CloudWatch alarmsSSM agent not running, or missing IAM.
aws ssm describe-instance-information --filters "Key=InstanceIds,Values=<id>" — PingStatus should be OnlineAmazonSSMManagedInstanceCoresystemctl status amazon-ssm-agentnc -zv <rds-endpoint> 1521brew install --cask session-manager-plugin--parameters '{"host":["..."],"portNumber":["1521"],"localPortNumber":["11521"]}'Then connect to localhost:11521.
klist — no ticket? Run okinit joedoe@REALMsqlnet.ora has SQLNET.AUTHENTICATION_SERVICES = (KERBEROS5PRE,KERBEROS5)SQLNET.KERBEROS5_CC_NAME points to correct cache fileOSMSFT: for in-memory; SQL Developer: use file cacheDB user is UPPERCASE and IDENTIFIED EXTERNALLY:
CREATE USER "JOEDOE@AD.MYAWS.COM" IDENTIFIED EXTERNALLY;
GRANT CREATE SESSION TO "JOEDOE@AD.MYAWS.COM";
SELECT username, authentication_type FROM dba_users WHERE username LIKE '%JOEDOE%';rds-directoryservice-kerberos-access-role exists with AmazonRDSDirectoryServiceAccess--domain "" then re-add with --domain <id>krb5.conf realm names UPPERCASEnslookup ad.myaws.comenableDnsSupport and enableDnsHostnames both enabledaws route53 list-resource-record-sets --hosted-zone-id <id> — record existsmax too low for workloadwait_timeout set so requests don’t hangDatabaseConnectionsEnable validation-on-borrow:
setValidateConnectionOnBorrow(true) + setSQLForValidateConnection("SELECT 1 FROM dual")setConnectionTestQuery("SELECT 1 FROM dual")RDS IDLE_TIME profile parameter is closing idle connections.
IDLE_TIME on the DB user profiletimeout shorter than IDLE_TIME so the pool recycles firstORACLE_HOME set correctlycman.ora exists at $ORACLE_HOME/network/admin/cman.oracmctl validatenetstat -tlnp | grep 1521cmctl show status -c CMANSource IP not in an ACCEPT rule. Add the CIDR to RULE_LIST in cman.ora.
Bundled in scripts/:
| Script | Use |
|---|---|
test_connectivity.sh <endpoint> [port] | DNS + TCP reachability |
check_rds_status.sh <instance-id> | Status, endpoint, SGs, encryption |
check_security_groups.sh <instance-id> [source] | Validate SG rules |
test_oracle_connection.py <endpoint> <port> <service> <user> | Full Python test |
check_ssl_status.sql | Verify encryption on current session |
This file