As per Oracle documentation, any user who create a user defined stored procedure and embed any SYS related stored procedure like DBMS_STATS inside it, any role which is granted to the user is skipped inside PL/SQL or procedure or trigger etc.. and throws an error ORA-20000. But individual grants work correctly.
Grant the basic privileges to new user with gather_system_statistics role to gather system statistics.
kIsH@zxd00<^>alter session set "_ORACLE_SCRIPT"=true;
Session altered.
kIsH@zxd00<^>create user test identified by password;
User created.
kIsH@zxd00<^>grant create session,connect,resource,gather_system_statistics to test;
Grant succeeded.
The new user is able to gather system stats without issues with the normal method.
kIsH@zxd00<^>conn test/password
Connected.
kIsH@zxd00<^>EXEC dbms_stats.gather_system_stats();
PL/SQL procedure successfully completed.
Now, create a stored procedure and embed DBMS_STATS command in it.
CREATE OR REPLACE procedure sysstat
AS
BEGIN
dbms_stats.gather_system_stats();
dbms_output.put_line('Executed!');
END;
/
kIsH@zxd00<^>CREATE OR REPLACE procedure sysstat
AS
BEGIN
dbms_stats.gather_system_stats();
dbms_output.put_line('Executed!');
END;
/ 2 3 4 5 6 7
Procedure created.
This does not allow the new user to gather system statistics with ORA-20000
kIsH@zxd00<^>EXEC sysstat
BEGIN sysstat; END;
*
ERROR at line 1:
ORA-20000: Unable to gather system statistics : insufficient privileges
ORA-06512: at "SYS.DBMS_STATS", line 46421
ORA-06512: at "SYS.DBMS_STATS", line 46314
ORA-06512: at "TEST.SYSSTAT", line 4
ORA-06512: at line 1
Grant individual privilege to the user on aux_stats$ and wri$_optstat_aux_history internal tables.
kIsH@zxd00<^>col TABLE_NAME for a20
kIsH@zxd00<^>col PRIVILEGE for a20
kIsH@zxd00<^>SELECT role,privilege,table_name FROM role_tab_privs WHERE role='GATHER_SYSTEM_STATISTICS';
ROLE PRIVILEGE TABLE_NAME
-------------------- -------------------- --------------------
GATHER_SYSTEM_STATIS DELETE AUX_STATS$
TICS
GATHER_SYSTEM_STATIS INSERT AUX_STATS$
TICS
GATHER_SYSTEM_STATIS SELECT AUX_STATS$
TICS
GATHER_SYSTEM_STATIS UPDATE AUX_STATS$
TICS
GATHER_SYSTEM_STATIS DELETE WRI$_OPTSTAT_AUX_HIS
TICS TORY
GATHER_SYSTEM_STATIS INSERT WRI$_OPTSTAT_AUX_HIS
TICS TORY
GATHER_SYSTEM_STATIS SELECT WRI$_OPTSTAT_AUX_HIS
TICS TORY
GATHER_SYSTEM_STATIS UPDATE WRI$_OPTSTAT_AUX_HIS
TICS TORY
8 rows selected.
kIsH@zxd00<^>grant select,insert,update,delete on aux_stats$ to test;
Grant succeeded.
kIsH@zxd00<^>grant select,insert,update,delete on wri$_optstat_aux_history to test;
Grant succeeded.
Once the individual privilege is granted, the user defined procedure executed successfully.
kIsH@zxd00<^>conn test/password
Connected.
kIsH@zxd00<^>set serveroutput on
kIsH@zxd00<^>EXEC sysstat
Executed!
PL/SQL procedure successfully completed.