Creating Database Control Administrative Users

When you log in to Oracle Enterprise Manager Database Control (Database Control) using the SYS, SYSTEM, or SYSMAN user accounts, you are logging in as the Database Control super user. These are the only accounts that are automatically granted the roles and privileges required to administer Database Control itself. Examples of Database Control administration tasks include the following:

• Creating other Database Control administrators

• Configuring e-mail and other notification methods

  See "Setting Up Direct Alert Notification".

• Setting alert thresholds for database metrics, such as tablespace space usage percentage exceeded or SQL response time exceeded

  See "Managing Alerts".

• Selecting database policies to apply, so that Database Control can show alerts if a policy is violated. (An example policy is "A nonsystem user cannot use the SYSTEM or SYSAUX tablespace as its default tablespace.")

• Defining blackouts, which are time periods in which database monitoring is suspended so that maintenance operations do not skew monitoring data or generate needless alerts.

  See "Defining Blackout Periods".

You can create Database Control administrative users who have enough privileges to administer Database Control itself, but lack the high-level database administration privileges of the SYS and SYSTEM users. This practice enables you to assign the minimum privileges required for other Database Control administrators to do their jobs, which is a best practice for database security. You can also create a Database Control administrative account for yourself, thus avoiding logging in as SYS or SYSTEM until you must perform database administration tasks.

Using the following procedure, you can assign Database Control administrative privileges to an existing database user or create a new Database Control administrative user. When you create a new Database Control administrative user, a user account is created for that user for the database. You must then decide which system privileges, object privileges, or roles to grant the user, if any, to perform database administration tasks.

To create a Database Control administrative user:

1. On any Database Control page, at the top of the page, click Setup.

   The Enterprise Manager Configuration page appears, showing the Overview of Setup page.

2. In the left navigation bar, click Administrators.

   The Administrators page appears.

3. Click Create.

   The Create Administrator: Properties page appears.

4. In the Name field, enter the name of an existing database user, or click the flashlight icon next to the field and select an existing database user.

5. Enter one or more e-mail addresses for this administrator only if you plan to set up e-mail notifications for the database.

   See "Setting Up Direct Alert Notification" for more information.

6. Click Review to view a page that summarizes the information that you entered.

7. Click Finish to configure the database user as a Database Control administrative user.

   The Administrators page appears, showing the new administrator in the list.