Running the Reporter

The Reporter analyzes the data collected by the Collector and makes recommendations to improve the security of the database.

You can invoke the Reporter with dbsat report.

To run the Reporter, do the following:

1. Check that Oracle Java Runtime Environment (Oracle JRE) 17 (Oracle JDK 17) or later or Oracle JDK 21 or later (recommended) is installed.

   $ java -version

   A similar output is displayed:

   java version "21.0.7" 2025-04-15 LTS

2. Specify the arguments to run the Reporter.

   $ dbsat report [-a] [-n] [-d] [-g] [-x

   Where the argument input_file stands for the full or relative path to the data file output_ORCL produced by the DBSAT Collector. If this file was encrypted during data collection, you will need to supply the encryption password when prompted by the Reporter.

   The Reporter supports the following command-line options:

   • -a

     Runs the report for all the database accounts including locked or schema only accounts that are Oracle-supplied.

   • -n

     Specifies no encryption for output.

     Note:

     For security reasons, Oracle does not recommended this.

   • -d

     Shows additional diagnostics information and generates a log.

   • -f

     Generate only one report file in the specified format.

     The valid formats are:

     • html
     • txt
     • xlsx
     • json
   • -g

     Shows all grants including common grants in a pluggable database.

   • -u

     Specify users to exclude from report.

     To exclude multiple users use a comma-separated list, for example: -u SCOTT,DEBRA

   • -x

     Excludes a section from the report.

     Valid sections are:

     • USER: User Accounts
     • PRIV: Privileges and Roles
     • AUTHZ: Authorization Control
     • ENCRYPT: Encryption
     • ACCESS: Fine-Grained Access Control
     • AUDIT: Auditing
     • CONF: Database Configuration
     • NET: Network Configuration
     • OS: Operating System

     To exclude multiple sections, use a comma-separated list, for example:

     -x USER,PRIV

     Or:

     -x USER -x PRIV

     Omitting this option will include all sections of the report.

   The same path name is used to generate the report files produced by the Reporter in HTML, Excel, JSON, and Text formats with the appropriate file extensions.

   3. Run the Reporter.

   $ ./dbsat report output_ORCLPDB

   The following output is displayed:

   Enter an encryption key: 
   Extracted: output_ORCLPDB/output_ORCLPDB.json 
   Decompression complete. 
   DBSAT Reporter ran successfully. 
   Encrypting the generated reports... 
   Enter an encryption key: 
   Re-enter the encryption key: 
   Encryption completed successfully.

   Note:

   When prompted for an encryption key, the Reporter will require the original key used to encrypt the Collector output file. Ensure you have this key readily available to proceed. Additionally, be cautious when running a DBSAT command with an existing output file name, as pre-existing reports will be overwritten. If you specify a file name that already exists, the dbsat report command will replace the existing report.

4. Specify a password to encrypt the output report .dbsat encrypted file. The .dbsat encrypted file is created.

5. Extract the contents of the .dbsat file to access the Oracle Database Security Assessment Report.

$ ./dbsat extract output_ORCL_report

6. When prompted, enter the password to decrypt the .dbsat file specified in Step 4.

The contents of the .dbsat file are extracted.

7. Use the appropriate tools to read the recommendations from the report files. Example:

• Use vi on Linux to read the .txt files.
• Use a browser to display the .html files.