1. Oracle Database Security Assessment Tool User Guide
  2. Running the Collector

Running the Collector

The Collector queries the database to collect data that will be analyzed by the Reporter.

The Collector connects to the database. Therefore, ensure that the target database and listener are running before running the Collector.

You can run the dbsat collect command using these options and arguments:

$ dbsat collect [ -n ] [ -d ] [-r row limit number]
  • -n: Specifies no encryption for output. For security reasons, this option is not recommended.
  • -d: Shows additional diagnostics information and generates a log.
  • -r : Row limit to control maximum number of rows collected for each query, minimum allowed value is 1.
  • database_connect_string: Specifies the connection string to connect to the database. Example: /@dbsat_user
  • output_file: Specifies the location and file name for the Database Security Assessment report. Do not add an extension to the output file. Example: /home/oracle/dbsat/output_ORCLPDB

Oracle recommends that you use a secure method to run the DBSAT Collector, and avoid entering the authentication password on the command line. DBSAT now issues a warning message to encourage secure authentication

Run the Collector Using SEPS Authentication

  1. In this method, the DBSAT user credentials are stored in a secure external password store (SEPS) wallet. You run the Collector without specifying the DBSAT password on the command-line because DBSAT authenticates using the credentials stored in a SEPS wallet.
  1. Configure a SEPS wallet to store the DBSAT user credentials. Set WALLET_DIR to the directory location where you want to create and manage the SEPS wallet. For example: 
    export WALLET_DIR=$ORACLE_HOME/dbsat/wallet

    In this example, WALLET_DIR is set to the $ORACLE_HOME/dbsat/wallet location.

  2. Create the directory to store the SEPS wallet. 
    mkdir -p "$WALLET_DIR"

    In this example, you create a wallet directory in the location $ORACLE_HOME/dbsat/wallet specified by $WALLET_DIR.

  3. Set the operating system file permissions to the wallet directory so that only the owner can access or modify the SEPS wallet.

  4. Use the mkstore utility to create a wallet.

    mkstore -wrl "$WALLET_DIR" -create

    You will be prompted to specify the wallet password.

    Enter password:  password 
Enter password again: password
  5. Add the dbsat_user credentials to the SEPS wallet that you have created in the previous step. 
    mkstore -wrl "$WALLET_DIR" -createCredential ORCLPDB dbsat_user

    In this example, $WALLET_DIR specifies the path to the SEPS wallet directory that you have created. ORCLPDB is the database alias, and dbsat_user is the DBSAT user connecting to the ORCLPDB database.

  6. You will be prompted to enter the dbsat_user password and the SEPS wallet password.

    Enter your secret/Password: password  
Re-enter your secret/Password: password   
Enter wallet password: password
  7. Update the SEPS wallet location in the $TNS_ADMIN/sqlnet.ora file, as shown in this example. 
    WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
      (DIRECTORY = $ORACLE_HOME/dbsat/wallet)
    )
  )
SQLNET.WALLET_OVERRIDE = TRUE

    In this example, WALLET_LOCATION specifies the $ORACLE_HOME/dbsat/wallet directory containing the SEPS wallet that you have created.

    SQLNET.WALLET_OVERRIDE = TRUE instructs Oracle Net to use the specified SEPS wallet for authentication which allows connections without specifying the user name and password in the database connection string.

    See the Oracle Database Net Services Administrator's Guide for more information about configuring wallets.

  8. Run the Collector. 
    ./dbsat collect /@ORCLPDB  output_ORCLPDB

    In this example, ORCLPDB is the network alias of the database, output_ORCLPDB is the output file.

  9. Review the sample output.

    Database Security Assessment Tool version 4.3 (Jul 2026)

This tool is intended to assist you in securing your Oracle database
system. You are solely responsible for your system and the effect and
results of the execution of this tool (including, without limitation,
any damage or data loss). Further, the output generated by this tool may
include potentially sensitive system configuration data and information
that could be used by a skilled attacker to penetrate your system. You
are solely responsible for ensuring that the output of this tool,
including any generated reports, is handled in accordance with your
company's policies.

Connecting to the target Oracle database...


SQL*Plus: Release 23.26.2.0.0 - Production on Fri Feb 27 12:29:45 2026
Version 23.26.2.0.0

Copyright (c) 1982, 2026, Oracle.  All rights reserved.

Last Successful login time: Fri Feb 27 2026 12:29:24 +00:00

Connected to:
Oracle AI Database 26ai Enterprise Edition Release 23.26.2.0.0 - Production
Version 23.26.2.0.0

Setup complete.
SQL queries complete.
OS commands complete.
Disconnected from Oracle AI Database 26ai Enterprise Edition Release 23.26.2.0.0 - Production
Version 23.26.2.0.0
DBSAT Collector completed successfully.

Encrypting output_file.json...

Enter an encryption key:
Re-enter the encryption key:
Encryption completed successfully.
  1. Configure a SEPS wallet to store the DBSAT user credentials. Set WALLET_DIR to the directory location where you want to create and manage the SEPS wallet. For example: 
    set WALLET_DIR= %ORACLE_HOME%\dbsat\wallet

    In this example, WALLET_DIR is set to the %ORACLE_HOME%\dbsat\wallet location.

  2. Create the directory to store the SEPS wallet. 
    mkdir  %WALLET_DIR%

    In this example, you create a wallet directory in the location %ORACLE_HOME%\dbsat\wallet specified by %WALLET_DIR%.

  3. Set the operating system file permissions to the wallet directory so that only the owner can access or modify the SEPS wallet.

  4. Use the mkstore utility to create a wallet.

    mkstore -wrl %WALLET_DIR% -create

    You will be prompted to specify the wallet password.

    Enter password:  password 
Enter password again: password
  5. Add the DBSAT user (dbsat_user) credentials to the SEPS wallet that you have created in the previous step. 
    mkstore -wrl %WALLET_DIR% -createCredential ORCLPDB dbsat_user

    In this example, %WALLET_DIR% specifies the path to the wallet directory that you have created. ORCLPDB is the database alias, and dbsat_user is the DBSAT user name connecting to the ORCLPDB database.

  6. You will be prompted to enter the dbsat_user password and the SEPS wallet password.

    Enter your secret/Password: password  
Re-enter your secret/Password: password   
Enter wallet password: password
  7. Update the SEPS wallet location in the %TNS_ADMIN%/sqlnet.ora file, as shown in this example. 
    WALLET_LOCATION =
  (SOURCE =
    (METHOD = FILE)
    (METHOD_DATA =
      (DIRECTORY = %ORACLE_HOME%\dbsat\wallet)
    )
  )
SQLNET.WALLET_OVERRIDE = TRUE

    In this example, WALLET_LOCATION specifies the %ORACLE_HOME%\dbsat\wallet directory containing the SEPS wallet that you have created.

    SQLNET.WALLET_OVERRIDE = TRUE instructs Oracle Net to use the specified SEPS wallet for authentication which allows connections without specifying the user name and password in the database connection string.

    See the Oracle Database Net Services Administrator's Guide for more information about configuring wallets.

  8. Run the Collector. 
    dbsat.bat collect /@ORCLPDB  output_ORCLPDB

    In this example, ORCLPDB is the network alias of the database, output_ORCLPDB is the output file.

  9. Review the sample output.

    Database Security Assessment Tool version 4.3 (Jul 2026)

This tool is intended to assist you in securing your Oracle database
system. You are solely responsible for your system and the effect and
results of the execution of this tool (including, without limitation,
any damage or data loss). Further, the output generated by this tool may
include potentially sensitive system configuration data and information
that could be used by a skilled attacker to penetrate your system. You
are solely responsible for ensuring that the output of this tool,
including any generated reports, is handled in accordance with your
company's policies.

Connecting to the target Oracle database...


SQL*Plus: Release 23.26.2.0.0 - Development on Fri Feb 27 04:21:57 2026
Version 23.26.2.0.0

Copyright (c) 1982, 2026, Oracle.  All rights reserved.

Last Successful login time: Fri Feb 27 2026 04:20:32 -08:00

Connected to:
Oracle AI Database 26ai Enterprise Edition Release 23.26.2.0.0 - Development
Version 23.26.2.0.0

Setup complete.
SQL queries complete.
OS Commands Skipped.
BEGIN
*
ERROR at line 1:
ORA-20002: Complete without OS Commands.


Disconnected from Oracle AI Database 26ai Enterprise Edition Release 23.26.2.0.0 - Development
Version 23.26.2.0.0
DBSAT Collector completed successfully.

Encrypting output_file.json...

Enter an encryption key:
Re-enter the encryption key:
Encryption completed successfully.

Run the Collector Using Interactive Prompt-based Authentication

In this method, you run the Collector by providing the DBSAT user credentials.

In this example, you run the Collector on a Linux operating system.

$ ./dbsat collect dbsat_user@ORCLPDB output_ORCLPDB

ORCLPDB is the database alias, and dbsat_user is the DBSAT user name for connecting to the ORCLPDB database. output_ORCLPDB is the output file.

This is a sample output:

Database Security Assessment Tool version 4.3 (Jul 2026)

This tool is intended to assist you in securing your Oracle database
system. You are solely responsible for your system and the effect and
results of the execution of this tool (including, without limitation,
any damage or data loss). Further, the output generated by this tool may
include potentially sensitive system configuration data and information
that could be used by a skilled attacker to penetrate your system. You
are solely responsible for ensuring that the output of this tool,
including any generated reports, is handled in accordance with your
company's policies.

Connecting to the target Oracle database...

SQL*Plus: Release 23.26.2.0.0 - Production on Fri Feb 27 11:59:50 2026
Version 23.26.2.0.0

Copyright (c) 1982, 2026, Oracle.  All rights reserved.

Enter password: 
Last Successful login time: Fri Feb 27 2026 11:59:28 +00:00

Connected to:
Oracle AI Database 26ai Enterprise Edition Release 23.26.2.0.0 - Production
Version 23.26.2.0.0

Setup complete.
SQL queries complete.
OS commands complete.
Disconnected from Oracle AI Database 26ai Enterprise Edition Release 23.26.2.0.0 - Production
Version 23.26.2.0.0
DBSAT Collector completed successfully.

Encrypting output_file.json...

Enter an encryption key:
Re-enter the encryption key:
Encryption completed successfully.

In this example, you run the Collector on a Windows operating system:

c:\\\> dbsat.bat collect "dbsat_user@ORCLPDB" output_ORCLPDB

ORCLPDB is the database alias, and dbsat_user is the DBSAT user name for connecting to the ORCLPDB database. output_ORCLPDB is the output file.

This is a sample output:

Database Security Assessment Tool version 4.3 (Jul 2026)

This tool is intended to assist you in securing your Oracle database
system. You are solely responsible for your system and the effect and
results of the execution of this tool (including, without limitation,
any damage or data loss). Further, the output generated by this tool may
include potentially sensitive system configuration data and information
that could be used by a skilled attacker to penetrate your system. You
are solely responsible for ensuring that the output of this tool,
including any generated reports, is handled in accordance with your
company's policies.

Connecting to the target Oracle database...

SQL*Plus: Release 23.26.2.0.0 - Development on Fri Feb 27 04:07:23 2026
Version 23.26.2.0.0

Copyright (c) 1982, 2026, Oracle.  All rights reserved.

Enter password:
Last Successful login time: Fri Feb 27 2026 04:05:13 -08:00

Connected to:
Oracle AI Database 26ai Enterprise Edition Release 23.26.2.0.0 - Development
Version 23.26.2.0.0

Setup complete.
SQL queries complete.
OS Commands Skipped.
BEGIN
*
ERROR at line 1:
ORA-20002: Complete without OS Commands.

Disconnected from Oracle AI Database 26ai Enterprise Edition Release 23.26.2.0.0 - Development
Version 23.26.2.0.0
DBSAT Collector completed successfully.

Encrypting output_ORLC.json...

Enter an encryption key:
Re-enter the encryption key:
Encryption completed successfully.

The command-line password based authentication method is now deprecated and will be desupported in a future release. DBSAT issues a warning message if you enter the user authentication password in the command-line, as shown in this example:

./dbsat collect user/admin@ORCLPDB output_ORCLPDB

Database Security Assessment Tool version 4.3 (Jul 2026)

This tool is intended to assist you in securing your Oracle database
system. You are solely responsible for your system and the effect and
results of the execution of this tool (including, without limitation,
any damage or data loss). Further, the output generated by this tool may
include potentially sensitive system configuration data and information
that could be used by a skilled attacker to penetrate your system. You
are solely responsible for ensuring that the output of this tool,
including any generated reports, is handled in accordance with your
company's policies.

Warning: Including passwords in connection strings is deprecated and will be desuported in future releases.
Refer to the Oracle Database Security Assessment Tool User Guide for secure ways to run the Collector.

Connecting to the target Oracle database...

SQL*Plus: Release 26.1.0.24.0 - Development on Tue Mar 3 04:39:04 2026
Version 26.1.0.24.0

Copyright (c) 1982, 2026, Oracle.  All rights reserved.

Note:

  • DBSAT may display warnings that some checks were skipped. You can safely ignore these warnings and proceed. Some reasons to skip checks include wrong permissions, and errors such as missing .ora files and not applicable to that target type.
  • Running the Collector in the root container in a multitenant container database collects data specific to the root container and not from its pluggable
    databases. If you need to access specific pluggable databases, you must run the Collector for these pluggable databases separately.
  • If you do not want to encrypt the file, then invoke the dbsat collect script with the -n option. This is not recommended.
  • If you run DBSAT Collector remotely or on a Windows platform, then DBSAT skips the operating system checks and raises the error: ORA-20002: Complete without OS Commands.