jumpserver/jumpserver · warning

Unable to collect Oracle system privileges: %s

Error message

Unable to collect Oracle system privileges: %s

What it means

Companion warning to 657: the query for system privileges (DBA_TAB_PRIVS/DBA_SYS_PRIVS-style query joined to DBA_USERS) errored, so the module sets privileges = [] and continues without system privilege data for users. Same root causes as the role-membership warning — almost always a privileges problem on the DBA dictionary views.

Source

Thrown at apps/libs/ansible/modules/oracle_info.py:245

        if roles_error:
            self.module.warn(
                'Unable to collect Oracle role memberships: %s'
                % roles_error
            )
            roles = []
        if isinstance(roles, dict):
            roles = [roles]

        privileges_sql = """
            SELECT SP.GRANTEE, SP.PRIVILEGE
            FROM DBA_SYS_PRIVS SP
            JOIN DBA_USERS U ON U.USERNAME = SP.GRANTEE
        """
        privileges, privileges_error = self.oracle_client.execute(
            privileges_sql
        )
        if privileges_error:
            self.module.warn(
                'Unable to collect Oracle system privileges: %s'
                % privileges_error
            )
            privileges = []
        if isinstance(privileges, dict):
            privileges = [privileges]

        roles_by_user = {}
        for role in roles or []:
            roles_by_user.setdefault(role['grantee'], []).append(
                role['granted_role']
            )
        privileges_by_user = {}
        for privilege in privileges or []:
            privileges_by_user.setdefault(
                privilege['grantee'], []
            ).append(privilege['privilege'])

View on GitHub (pinned to 6ec464fabd)

Solutions

1. Grant SELECT on the relevant DBA privilege views (DBA_SYS_PRIVS, DBA_USERS) to the module's connect user
2. Connect with a user holding the DBA role or SELECT_CATALOG_ROLE
3. Treat the absence of privileges data as acceptable if not required for your use case

Example fix

-- before
-- module user: app_monitor (no dictionary grants) -> warning, privileges=[]

-- after
GRANT SELECT_CATALOG_ROLE TO app_monitor;

# preflight: verify access to system-privilege dictionary views
cur.execute('SELECT COUNT(*) FROM DBA_SYS_PRIVS')

result = oracle_info(module_args={'filter': ['users']})
if not result['users'][0].get('sys_privs'):
    warn('privilege collection failed; check dictionary grants')

When it happens

Trigger: Running oracle_info with a connection that cannot SELECT the system-privilege dictionary views (e.g. DBA_SYS_PRIVS) joined to DBA_USERS; execute() returns a truthy error.

Common situations: Non-DBA monitoring accounts, hardened databases where PUBLIC lacks dictionary access (O7_DICTIONARY_ACCESSIBILITY=FALSE), multitenant confusion over which container holds the views.

Related errors

• Unable to collect Oracle role memberships: %s
• Password is required for 'password' authentication type
• Unsupported authentication type: {auth_type}
• filter element: %s is not allowable, ignored
• Cannot connect to database

AI-assisted analysis of jumpserver/jumpserver@6ec464fabd (2026-08-28). Data as JSON: /api/errors/d5640aa6f3c4d95f. Report an issue: GitHub.