Troubleshooting

You can troubleshoot Oracle Database Security Assessment Tool by using diagnostics and log files.

Enabling DBSAT Diagnostics to Diagnose Oracle Database Security Assessment Tool Errors

Output diagnostics, which the DBSAT generates, capture vital information to help you debug errors.

By default, DBSAT suppresses errors that do not impact the report execution. To find details on errors that might affect your collection or report generation, please run dbsat with the -d option.

Example of a dbsat report run with -d:

$ dbsat report -n -d orcl

Database Security Assessment Tool version 4.3 (Jul 2026)

This tool is intended to assist you in securing your Oracle database
system. You are solely responsible for your system and the effect and
results of the execution of this tool (including, without limitation,
any damage or data loss). Further, the output generated by this tool may
include potentially sensitive system configuration data and information
that could be used by a skilled attacker to penetrate your system. You
are solely responsible for ensuring that the output of this tool,
including any generated reports, is handled in accordance with your
company's policies.

Traceback (most recent call last):
  File "sa", line 18953, in 
  File "sa", line 1965, in patch_checks
ValueError: could not convert string to float: '1.2.3'

Oracle AI Database 26ai replaces Oracle Database 23ai starting with RU 23.26.0 (Oct 2025), which followed RU 23.9 (Jul 2025).
DBSAT Reporter ran successfully.

Example of a standard run:

$ ./dbsat report -n -d orcl

Database Security Assessment Tool version 4.3 (Jul 2026)

This tool is intended to assist you in securing your Oracle database
system. You are solely responsible for your system and the effect and
results of the execution of this tool (including, without limitation,
any damage or data loss). Further, the output generated by this tool may
include potentially sensitive system configuration data and information
that could be used by a skilled attacker to penetrate your system. You
are solely responsible for ensuring that the output of this tool,
including any generated reports, is handled in accordance with your
company's policies.

Oracle AI Database 26ai replaces Oracle Database 23ai starting with RU 23.26.0 (Oct 2025), which followed RU 23.9 (Jul 2025).
DBSAT Reporter ran successfully.

DBSAT Reporter Fails With "No JSON object could be decoded"

If execute on package SYS.DBMS_SQL was revoked from PUBLIC you can encounter this issue.

$ ./dbsat report -a -n orcl

Database Security Assessment Tool version 4.3 (Jul 2026)

This tool is intended to assist you in securing your Oracle database
system. You are solely responsible for your system and the effect and
results of the execution of this tool (including, without limitation,
any damage or data loss). Further, the output generated by this tool may
include potentially sensitive system configuration data and information
that could be used by a skilled attacker to penetrate your system. You
are solely responsible for ensuring that the output of this tool,
including any generated reports, is handled in accordance with your
company's policies.

... Unable to process input file: orcl.json No JSON object could be decoded Error:
Unexpected error occurred while running DBSAT Reporter.

Oracle AI Database 26ai replaces Oracle Database 23ai starting with RU 23.26.0 (Oct 2025), which followed RU 23.9 (Jul 2025).
DBSAT Reporter ran successfully.

To avoid this error, grant execute privilege on DBMS_SQL to the DBSAT database user (and not use PUBLIC privilege) used in dbsat collect@

SQL> grant execute on sys.dbms_sql to  ;

Run dbsat collect again to ensure the data is collected appropriately and then run the report.

./dbsat collect @ 

./dbsat report

DBSAT Reporter Fails – Generic

Occasionally, the source of the issue affecting the DBSAT report's successful execution is present in the collector-generated file. As a troubleshooting step, you can open the file (dbsat extract ) generated by DBSAT collect and search the file for errors.

Issues Running DBSAT on IBM AIX platforms

The IBM AIX default shell is the Korn shell (ksh). DBSAT needs to run under the bash shell. You can either change it to bash or install it. DBSAT fails to run under other shells. As an example, if you do not have bash shell installed on AIX, and you try to run DBSAT, you can encounter the following:

oraprod>./dbsat

ksh: ./dbsat: not found

oraprod>pwd

/home/oraprod/dbsat400

At this point, you can install bash on AIX or run DBSAT collect remotely. You can execute DBSAT from another server with bash (e.g., a linux server), reaching the database running on AIX:

./dbsat collect @

When collecting from a remote server, DBSAT will not include Operating System-related findings.

DBSAT Taking Too Long or Not Completing

If DBSAT collect is taking too long to complete or not completing at all, you can limit the number of rows collected by using the -r option:

./dbsat collect -r  @

DBSAT Process Ends Unexpectedly

If a DBSAT process crashes unexpectedly, then restart the same DBSAT command. This refreshes the results after successful running. If you do not run the same DBSAT command again, then remove any partially collected data from the previous process crash.