Database Security Assessment Tool (DBSAT)

<- Security


The Oracle Database Security Assessment Tool (DBSAT) is a command line tool that evaluates your environment and provides recommendations on how to mitigate risks. DBSAT runs from your Oracle database server itself. If Oracle security is important to your environment this is the tool to start with.

The examples here use oradb for the database name. Change this to match your environment.


  • Ensure Python Version 2.6 or later installed. python -V
  • Ensure env vars set: ORACLE_BASE, ORACLE_HOME and ORACLE_SID
  • From MOS go to Doc ID 2138254.1 to download and copy to your database server /tmp directory.


Perform if already installed and upgrading to latest version.

 su -
 mv /u01/app/dbsat /u01/app/dbsat_$(date "+%Y%m%d%H%M")

The above backup directory can be deleted after successful upgrade.


 su -
 mkdir /u01/app/dbsat
 chown oracle:oinstall /u01/app/dbsat
 chmod 765 /u01/app/dbsat

 su - oracle
 cp /tmp/ /u01/app/dbsat/
 cd /u01/app/dbsat/

Do not delete after unzipping!


Init the Collector

Format: dbsat collect <connect_string> <destination>

 su - oracle
 mkdir /u01/app/dbsat/oradb
 cd /u01/app/dbsat
 ./dbsat collect -n "/ as sysdba" /u01/app/dbsat/oradb
 Creates\updates: oradb.json

Create Report Files

Format: dbsat report [-a] [-n] [-x <section>] <pathname>

 su - oracle
 cd /u01/app/dbsat
 ./dbsat report -n /u01/app/dbsat/oradb

Output Files

Report files are created in the following formats:

  • .html
  • .json
  • .txt
  • .xlsx

Example: oradb_report.html

For more examples and a listing of all the parameters go here.

Appendix: Using Ecryption Session Example

Set Collector

 mkdir /u01/app/dbsat/oradb
 cd /u01/app/dbsat
 oracle> ./dbsat collect system/mypassword@ORADB /u01/app/dbsat/oradb

 Enter password:
 Verify password:
   adding: oradb.json (deflated 89%)
 zip completed successfully.

The the security files are encrypted. The password prompted for is required to unencrypt it.

<- Security