Friday, July 21, 2017

Python - cx_Oracle - Mac OS X Sierra - Oracle client - DPI-1047 libclntsh.dylib cannot be loaded

Python - cx_Oracle - Mac OS X Sierra - Oracle drivers

Modern development life seems so easy. Just grab a few libraries or API's, run a few quick installs and everything works. Well in this case, everything didn't just work. Most of my frustration for this issue came from old documentation or just plain lack of documentation.

I've been working in enterprises for 25 years and have been in the middle of a ton of "it doesn't work" conversations. So, digging in and knowing why is pretty much my nature, and I really don't like ambiguity. Terms like "the software just sucks", "something magic happens", or "it just isn't right" doesn't sit well with me.

So here is a quick dive into a recent attempt to get connected from Python to an Oracle database on my Mac Book pro running OS X Sierra.

I just want the solution ->

To start with, this is for those of you trying to do some Python development while accessing a Oracle database and using OS X as your development platform. This may be different than your destination platform (Linux, etc...).


Ok so let's get started, what do you need? Should be three simple things:
  1. Python - a "good" version is pre-installed on MAC, so that is what I started with
  2. Oracle driver - Oracle Instant Client for MAC on Oracle Technet (I'm using 12c)
  3. cx_Oracle - Python extension for using Oracle Database (I downloaded the source and built it local.  You will need XCode installed to do this)
Ok, so again a few simple steps, install the Oracle client as outlined on Oracle TechNet.  Note I used the $HOME/instantclient_12_1 folder.  If you follow all the instructions you will also have a $HOME/lib directory with most of the same files installed.  This second directory is for non-Oracle software to find the driver, or at least that is the theory (based on a lot of other forum postings and a few blogs).

Then I built the cx_Oracle extension:
python build
sudo python install
Note: second line has to be run with sudo to allow the install to put the library (egg file) into a system folder.

Finally a simple test and we should be all set.  Right?
python -c "import cx_Oracle; print cx_Oracle.version"
Traceback (most recent call last):
  File "", line 1, in 
  File "build/bdist.macosx-10.12-intel/egg/", line 7, in 
  File "build/bdist.macosx-10.12-intel/egg/", line 6, in __bootstrap__
cx_Oracle.DatabaseError: DPI-1047: Oracle Client library cannot be loaded: dlopen(libclntsh.dylib, 1): image not found. See for help
Poof, or maybe I should say "Boom".  Well that didn't work.

Wild goose chase

Ok, so jump into google and start searching for answers.  This is where things go south pretty fast.  There are a number of references to this issue, but nobody is really pointing in the right direction, or at minimum all the answers are very dated.

The normal answer is "you need to set environment variable" to have the correct libraries to be found.  From a legacy perspective, these would-be LD_LIBRARY_PATH and DYLD_LIBRARY_PATH.  Except these no longer work on modern OS like Sierra.  Which again is not well documented.  You can spend a lot of time digging but short answer is Python is not seeing these set even if you set them.

This then leads down another rabbit hole.  Mac OS X has System Integrity Protection (SIP), which is intended to help make sure applications do not do inappropriate things.  I'm not going to get into a lot of detail, but in short applications have to be configured at creation (link) time as to what is allowed to be called or pulled in (libraries).  I couldn't find any official Apple documents on this, but in general this does back up the above comment that you can't just set an environment variable and your program will load a somewhat random binary library.

Ok, so then you get pulled into another set of solutions.  Basically, they all say that if you put your libraries under /usr/local/lib then SIP will allow them to be loaded.  There is another set of postings that will suggest $HOME/lib is a safe zone also for SIP.  Again, I couldn't find any Apple document that stated this, nor did anyone give a lot of details other than "it worked for me".  Well it didn't work for me.

Time for the next rabbit hole, which is basically a number of postings that say, "built in Python on OS X sucks".  Well isn't that interesting.  Ok, well that might be a statement of opinion, but it doesn't provide any details.  Again, just not in my nature.

You will find postings that suggest you disable SIP, I personally don't think this is a good idea.  With a lot of years of IT experience, its best to work with security, not around it.

Finding the answer

Ok, so here is the solution I found.  I'm sure this is not the only solution, but it did work well for me.

Make sure you have your Oracle instant client installed in a good location.  I really don't think the exact location matters, use what works for you as long as you're consistent.  I stuck with the Oracle directions and used $HOME/instantclient_12_1 for this case.

I then went back to the cx_Oracle source and did the build again with one minor change:
python build
install_name_tool -add_rpath $HOME/instantclient_12_1 ./build/lib.macosx-10.12-intel-2.7/
sudo python install
Ok so what did I just do?  Well I updated the header to include a new path to locate libraries during run time. You can read more about RPATH here.  This could also be done at link time, but that is inside the process, and I didn't want to dig into that.

You should now have a working cx_Oracle driver, and you can use the Apple provided Python.

Further digging / background

With these changes, when the install is run, the Python egg is created.  This second time it includes my so slightly modified library file.  I can verify this in two ways, both using the otool command.

First we can check the .so file that is created during the build process (run this while in the cx_Oracle source directory).
otool -l ./build/lib.macosx-10.12-intel-2.7/ |grep -A 4 -B 1 RPATH
It should return something like this:
Load command 12
          cmd LC_RPATH
      cmdsize 48
         path /Users/ggordham/instantclient_12_1 (offset 12)
The Load command number might be different than 12 for your install or in future or past versions.  That just means it's the 12th location in the header.

The second way to check is after you run python with the cx_Oracle.  When you do that the egg file is opened and the .so file is copied to a temporary directory in your home directory.
So, let's do a quick test on cx_Oracle first (Note, be sure to change out of the source directory for cx_Oracle before trying this):
python -c "import cx_Oracle; print cx_Oracle.version"
Now we a temporary copy of the .so file here:
So, we can do the same test on the "run time" version of the library
otool -l $HOME/.python-eggs/cx_Oracle-6.0rc1-py2.7-macosx-10.12-intel.egg-tmp/ | grep -A 4 -B 1 RPATH

That's it, hope this helps.  I've already let the cx_Oracle developers know of this information.  Not sure if it will end up changing anything.  At a minimum, the documents should show what works and what doesn't.


Wednesday, March 15, 2017

Oracle Database - inside looking out #C17LV

It's March of 2017 and the years continue to click by at an increasing rate.
Oracle just made available the second major release of it's 12c database product.  Yes it was available in the Oracle cloud last fall, but with 420,000 customers I'm sure there are still a few of us waiting for the "run it on your own hardware" release.

This is all very timely, learning new Oracle technology has been a life long journey for myself.  My first Oracle database was version 6 which required me sitting with a consultant for a few weeks to learn the details of how to manage it and how to find what you needed in the dozen or so printed manuals.

Well it's 26 years latter, and things sure do change, but they also stay the same.  With google, My Oracle support, and countless blogs; we still search for truth.  Most of the time this means talking to a trusted, and hopefully knowledgable expert.  That discussion might be virtual, but boy is a lot lost.  I believe the statistic thrown around is something like 93% of communication is non-verbal.

For the second year in a row I'm the conference chair for IOUG at COLLABORATE 17.  This is the number one technical conference for people in the Oracle technology business, and has been for the past 17 years (having changed names just a little).  The IOUG again brings a lot of DBA centric sessions and unique opportunities:

  • Sunday pre-conference workshops on Oracle 12c new features, Cloud DBA, and SQL tuning.
  • Cloud workshop during the week with Oracle - learn how to get your Oracle system in the cloud
  • OakTable world - a mini conference in a conference put on by OakTable Oracle scientists 
  • Hands on labs throughout the week - Oracle 12c database upgrade, Apache Hadoop, Oracle Database 12c in-memory, Oracle Database 12c multitenant
  • In person networking opportunities - meet fellow professionals working on the same technical challenges
  • 220+ technical sessions, quick tips, and hands on labs about Oracle Database, Development, Engineered Systems, OEM, and more.
This year I'll be presenting four times.
  • Session 333 - Oracle and NLS - a detailed look at how data is stored in Oracle databases, and why you should always be using international character sets correctly.
    Add to your schedule: Thursday, Apr 06, 2017 (09:45 AM - 10:45 AM) Palm D 
  • Session 352- DBA 201: Database Listener registration - a quick tip detailing how the Oracle Listener becomes aware of databases, especially important for multiple networked systems like Exadata.
    Add to your schedule: Monday, Apr 03, 2017 (12:00 PM - 12:30 PM) Palm C
  • Session 196 - Cloud DBA transformation, futuristic TomorrowLand, or desolate wasteland - I'm co-presenting with another great speaker, Jim Czuprynski where we will be musing on the future of DBA's in the cloud based on 50+ years of combined experience.  Be sure to check his blog out.
    Add to your schedule: Tuesday, Apr 04, 2017 (04:15 PM - 05:15 PM) Banyan C
  • Session 10183 - Essential Skills for the EBS DBA: past and present, the future is Cloudy - Again I'm co-presenting, this time with Jeffrey Weiss about what skills will make you a better E-Business Suite Applications DBA, along with the OAUG group.  This type of cross over could only happen at COLLABORATE.
    Add to your schedule: Tuesday, Apr 4, 2017 11:00:00 AM PDT Breakers I

Note: all times are PDT local to Las Vegas.
For those that can't make it out to Las Vegas to be in person, IOUG offers a virtual conference pass. This allows remote attendees to participate in over 30 of the technical sessions. 

Jim and I will be having some special buttons for those that find us at the conference.

The future is in your hands, make sure you have the tools, and network of people to help you get there.  That's my view, from the inside of the database looking out.

If you see me in Vegas, say HI! #C17LV
Keep in touch through twitter @ggordham, blogging, or LinkedIn


Friday, September 9, 2016

Oracle OpenWorld 2016 - IOUG COLLABORATE 2017

Yes it's that time of year again, Oracle OpenWorld 2016 is upon us.  Hopefully you have your plans ready and have chosen from the 1,800+ sessions going on.  Sunday the 18th, as usual will be the annual user group mini-conference.  In Moscone West almost all the sessions will be presented exclusively by users from user groups including IOUG, OAUG, Quest and more.

As a member and volunteer of IOUG, I would be remiss if I didn't point out a great article by IOUG president Maria Anderson, outlining some of the great IOUG happenings at OOW16
"From Database 12c to PaaS – Watch for IOUG at Oracle OpenWorld 2016"

For those in the know, and if you don't know, now you do.  There is a hidden conference inside of (well next to) OpenWorld put on by the great people of the OakTable.  These sessions tend to be a little more artistic in direction, and research focused, but contain awesome technical detail.   Kellyn Pot'Vin has all the details here
Oak Table World 2016- Oracle Open World Edition!

While you might be focusing on what Oracle will be announcing in the coming weeks, or possibly strategizing for your 2017 IT plans, many of us are also preparing for COLLABORATE 2017.  IOUG is currently soliciting speakers to submit abstracts for sessions for the annual conference in April of 2017.  You can learn more at

If you are more interested in just attending COLLABORATE, registration will open on Thursday October 27th at

If you have submitted sessions before, and possibly not made the cut.  Perhaps you are wondering how you could improve your abstract or chances of getting accepted?  Veteran speaker and performance expert Craig Shallahamer has a great blog:
5 Ways To Help Get Your 2017 IOUG Abstracts Accepted

I'll be presenting Sunday Sept 18th, at  Moscone West - 3022 from 2:15pm - 3:00pm PDT, the session number UGF1765 "10 Things Every DBA Needs to Learn That Have Nothing to Do with Databases".

So if you see me out at OpenWorld, feel free to say hi, and ask some great technical questions.  I'll be running between OpenWorld, JavaOne and of course Oak Table World throughout the week.

Sunday, March 27, 2016

Oracle User Groups - Collaborate 2016

What is Collaborate 2016?  It is the yearly meeting of three of the largest Oracle product user groups in the world.  This conference brings together three unique sets of groups.  Oracle is a very large company and addresses the needs of many things in the technology world.  From the start Oracle has been a technology company, building one of the first relational database platforms, and from that time to today they continue to build  the main technology that drives modern businesses.

Somewhere in the late 1980's Oracle started building out specific application software.  Software that could be used to meet the functional needs of large companies and even governments.  The first version I used was only for financial transactions, but since then Oracle has expanded into many fields spanning all types of businesses, their flagship product: Oracle E-Business Suite.  In the 2000's Oracle has also procured other software products to extend their business application functions into Human Capital Management with Peoplesoft, Customer Relationship Management Siebel, and small to medium manufacturing businesses with JD Edwards.  Oracle's technology list goes on and on, including tools like WebCenter Portal and GoldenGate just to name a few.

Collaborate is the only conference where you can see a global collection of professionals covering all of these technologies in one place.  Bringing together the Independent Oracle Users Group (IOUG), Oracle Applications User Group (OAUG), and the QUEST user group.  Why is this unique or important?

Oracle technology is complex, sometimes it can be the most complex software in your data center.  This is not specifically by design, but with many years of design for reliability and thousands of features, this may be inevitable.  The hundreds of thousands of customers of Oracle is a testament to this.  Again at it's foundation 76% Oracle customers run the Oracle database, and all of them use Oracle Java.  Both of these require deep technical expertise, and all OAUG and most QUEST customers use these technologies to keep their businesses running 24x7.  Who keeps all this running?  Just a small group of people, whose business titles could be just about anything, but we generally call them developers, web administrators, application administrators, and database administrators (DBA).  Only the DBA seem to have been given the 3 letter acronym treatment for 30+ years, but very few go by this title any more.

Is a DBA built?  No one is born as DBA, nobody learns a software product from DNA.  Often DBA is much more of a state of mind, and of course a set of skills.  Skills learned and honed through practice, training, and making mistakes.  Often the main view of a technical expert is the lone wolf sitting in a room at a terminal.  Making genius decisions, taking big risks, and finding amazing answers at the last moment.  This Hollywood view is probably the farthest from the truth.

Everyone learns from someone.  That someone could be the technical author who wrote the manual for Oracle database install guide.  It could be the person who wrote a blog entry that you found and answers that critical question on how to setup a TNS names entry for a RAC database custom service.  Mostly we learn from our peers, fellow students in school, our coworkers, or even the person that left the system in the state you inherited it.  Now the question one has to ask is this.  Is this the best way to learn?

What if you could find the a person who has already done what you are trying to accomplish?  What if you could find someone who has done the one thing not equal to your project, but the one thing that fits into your project.  What if you could find three people that have done three differently unique things with Oracle database that you are trying to combine?

Those are the interactions that user groups make possible.  It's not the main presentation, it's the question after the presentation.  It's exchanging a business card at the end of the session.  It's meeting the person in the room waiting for the same speaker as you that just finished implementing what you are now trying to implement.  It might even be meeting the product director, or even the developer.  These are not things that happen to the lone wolf sitting in their room.  You could search google and the internet for hours or days and this would never happen.  But at Collaborate this happens a 100 times a day.

Why?  It's actually very simple.  Out of every 100 people doing Oracle work, maybe 1 does a blog.  Of 100 tasks a week that each blogger does, they may blog on one of them.  That's one article out of 10,000 possible.  Blogging takes time, DBA's don't have it.  Manuals are written in a one direction style, if you want to travel from Chicago to New York, you get on the freeway, and you drive straight, and you exit in New York.  Anything beyond that and you are on your own.

So why did I write all this?  What am I asking for?

Take time, go to a Collaborate.
Persuade the managers of tight budgets that attending Collaborate is worth weeks of google searches.
Those that go to Collaborate go to share, inform, and learn.

For me Collaborate is five 14 hour days of talking Oracle, meeting Oracle professionals, learning, and sharing.

The last 25+ years of how we got here is due to a small group of technical people that work hard, share their knowledge, and grow the profession as a whole.  The next 25 years will be no different.

Thursday, September 24, 2015

IOUG SELECT Journal Q3 2015

This is the cover of the January 1999 issue of IOUG SELECT Journal.  This is the oldest issue I could find in my collection, and is probably close to when I joined IOUG as a paid member.  At the time I would never have dreamed that I would become the Executive Editor for the magazine or get to work with some of the largest names in Oracle technology. 

Times have changed, and how we get our information has also changed.  For me one thing has not changed.  The IOUG has always been a critical part of my career.  Every paid member, and volunteer I have meet over the past 16 years is interested in the same thing. 

How can I get the best non-biased information on Oracle Technology? 

That might mean getting independent reviews, internal workings on Oracle technology, or even mentoring on technical writing, and presenting.  As much as I have become dependent on the Internet for quick answers, only though the IOUG have I been able to advance my technical communication skills.  Knowing something is important, but being able to communicate it is business.

With the 87th issue of SELECT Journal, we are going to do something we have never done before (to my knowledge).  We are giving away this issue to everyone. The Journal is just one of the benefit to paid members.  In this case we hope that by making this issue widely available, everyone can see some of the benefits the IOUG brings to it’s paid members. 
Every author in the Journal was just like you.  At some point they had not presented to a crowed, they had not authored a blog, they had not written an article, they had not worked with editors, and they had not been published.  Growing acumen in technical spaces requires not just detailed knowledge, but the ability to apply it, and therefore communicate it.

I’m lucky enough as Executive Editor to help grow new authors and work with a great set of volunteer editors.  I’m always excited to work with new authors, and I know they are excited to see their work published.

As Alex says in his column on personal resiliency, “get out of your comfort zone.”  Join us at IOUG.

The issue Q3 2015 issue is now available at: 
Have comments, contact me at
Or leave your comments bellow.

Monday, September 14, 2015

Oracle VM - SSL server probably obsolete

Users of Oracle Virtual Machine for x86 technology may be encountering a interesting problem.  The issue lies in the management tool OVMM or Oracle Virtual Machine Manager or OVM Manager access.

This affects users of the stand alone Oracle VM for x86, as well as users of the engineered systems Oracle Virtual Compute Appliance (VCA), Oracle Private Cloud Appliance (PCA), Exalogic in virtual configurations, Exadata in virtual configurations, and Oracle Database Appliance (ODA) in a virtual configuration.

When trying to use the latest browsers to navigate to the HTTPS protected version of the OVMM tool you will encounter errors such as:

  • SSL server probably obsolete.  (ERR_SSL_FALLBACK_BEYOND_MINIMUM_VERSION)
  • Secure Connection Failed (Error code: ssl_error_no_cypher_overlap) 
The issue can occur in Google Chrome, Firefox, and Internet Explorer.  I'm sure Safari won't be far behind.

This is due to changes in how secure socket layer is being communicated and basically de-supporting older versions.  The root of this problem is in the WebLogic layer that is used to host OVMM.
A good place to start is looking for help is at My Oracle Support (MOS) note:
Oracle VM: Connecting to Oracle VM Manager 3.2.x Results in "ssl_error_no_cypher_overlap" Error Message ( Doc ID 1997431.1 )

There may be related issues with older version of Oracle Enterprise Manager 11g, again caused by the configuration of WebLogic.

Initial workarounds include:
  • Using a previous version of the browser (such as Google Chrome prior to version 45, we are having good luck with version 41)
  • Use the non-secure connection to the tool (use HTTP vs. HTTPS), but be aware that passwords and other data will be transmitted over your network un-encrypted.
  • Look for patches / updates from Oracle for your specific tool / product.
I'm sure there will be much more fall out and updates from this.  I'm not a SSL or HTTPS expert, but I think this is affecting or will affect a lot of Oracle customers as we all work through the transition.

If you have other input / suggestions please add comments to the blog.


Sunday, April 12, 2015

Collaborate 15 - IOUG Cloud Track

It's April, and Collaborate 15 is upon us again.  For myself this event has approached at the speed of a bullet train, I'm still trying to get my act together.  For many of you, I'm sure your well prepared with your schedules all figured out, and a clear list of what your hoping to learn and take back to your workplace.
My personal dilemma is how to pick from all the great sessions available, for almost every time slot I have three or more sessions in mind that I must choose only one to attend.  I'm not sure if everyone has that problem, but at least a few people I have spoken to does.
Again this year I was lucky enough to be on the IOUG conference committee, and helped lead the Cloud Computing track.  In this role we help pick which topics and sessions will be in the track, and narrow down the presenters from those submitted in October of 2014.  I think we have curated a great selection of presenters for 2015, narrowing the 74 submissions down to 21.  As Cloud Computing is a somewhat broad topic, we have tried to cover a wide range of topics from external to internally hosted clouds, virtual computing from multiple vendors, and cloud tools.
I've very excited about all the sessions, but would like to highlight a few here.
  • Monday 12:45pm - Reef F - 463 Stack Attack - a hands on lab where you get to install OpenStack and test out automated virtual server build.
  • Monday 3:15pm - Banyan D - 598 "What Do You Think Database as a Service Is..." - a roundtable discussion with seasoned industry experts on cloud computing, ?aaS what does it mean, what do you get.  Come ask your questions.
  • Tuesday 9:45am and 2:00pm - Reef F - 162 Building DBaaS and 270 Best Practices for Oracle on VMWare - both great sessions covering Oracle database on VMWare automation in the morning, and then tuning and best practices in the afternoon.
  • Wednesday - 8:00am, 2:45pm, and 4:00pm - 460 Your own private cloud, 464 Self-service private cloud EM 12c, and 656 Private cloud with Oracle RAC 12c - sessions on three different ways to build out and create your own internal cloud with Oracle products.
  • Monday 10:30am - 649 Migrating Enterprise application to the hybrid cloud; Wednesday 9:15am - 530 Oracle Databases on Oracle's public cloud - two great sessions on making the jump to databases in the public cloud.
I can't highlight every session or topic here, but we tried to cover a wide range of topics.  If you are running virtualized systems internal to your company, automating databases deployment with OEM or other tools, or making the jump to public cloud providers I think we have sessions to meet your needs.
Check out the cloud track in the on-line session scheduler
Just filter on the track "Cloud Computing".
If you have any questions just look for one of the IOUG conference committee members in the black t-shirts with the cards on the back.