Self-Hosted · No Data Leaves Your Network
TuneVault

# Oracle Operational Intelligence

Diagnose. Tune. Control.
See everything. Fix anything.

Runs inside your own datacenter. 200+ Oracle DB + EBS 12.2 health checks, AI diagnostics, and EBS operations — with no data leaving your network.

Install on Oracle Linux 8 / RHEL in 15 minutes. Or try the cloud version free with your own database.

Download Self-Hosted → Oracle Linux 8 / RHEL · Docker · 15-min install
View DB Demo → 200+ checks, AI analysis, PDF export — live demo
View EBS Demo → EBS ops — CM, Workflow, ADOP, deep diagnostics

See TuneVault in action

DBA Agent — Autonomous Investigation
Blocking session resolved in 60 seconds
DB Health Checks — 200+ in 2 Minutes
15 critical issues surfaced automatically
EBS Service Control — No SSH Needed
Start/stop EBS services from a browser
TuneBot — AI Oracle Assistant
Connected to your live database findings
Autonomous Monitoring — No SSH Needed
Schedule health checks, auto-create tickets, get alerted
Questions? hello@tunevault.app
Supports: Self-Hosted SE / SE2 EE RAC ASM EBS 12.2 11g → 21c
tunevault agent
▸ 14:22:15 Running Oracle health check...
▸ 14:22:18 ✓ Tablespace analysis complete
▸ 14:22:21 ✓ Slow SQL queries identified
▸ 14:22:24 ✓ Wait events & contention analyzed
▸ 14:22:26 ✓ EBS detected — activating 100+ EBS checks
▸ 14:22:29 ✓ Concurrent Managers, WF Mailer, ADOP healthy
▸ 14:22:31 Report ready. DB + EBS PDF available.
Core Platform

## Built for Oracle DBAs

200+ native checks across tablespaces, wait events, SQL plans, SGA/PGA, undo/temp, invalid objects, index fragmentation, backup status, and RAC/ASM health. AI recommendations with exact remediation commands — not alerts, answers.

- ✓ 200+ deterministic checks — Standard & Enterprise, RAC, ASM
- ✓ SQL tuning advisor with index and rewrite recommendations
- ✓ Patch advisor — CPU/PSU gap analysis (11g → 23ai)
- ✓ ADDM-aware root cause analysis
- ✓ Autonomous monitoring — delta-aware, zero alert fatigue
- ✓ Fleet dashboard across all instances

Connect Your DB View Sample Report →
EBS — Only Platform That Does Both

## The only platform that natively handles
Oracle E-Business Suite

20+ EBS-specific checks auto-activate on EBS detection — Concurrent Managers, OPP, OACore, Forms, Workflow Mailer, ADOP. Detected automatically via `APPS.DUAL` probe. Appears only when EBS is present.

If you run EBS 12.1.x or 12.2.x, no one else covers this layer. We do.

- ✓ Concurrent Manager load, backlog & INACTIVE status
- ✓ OPP thread health & Output Post Processor recovery
- ✓ Workflow Mailer queue depth & SMTP validation
- ✓ ADOP session state & patch phase tracking
- ✓ OACore availability & Forms module health
- ✓ Whitelisted EBS shell commands for 4am incidents

View Sample EBS Report → Explore EBS Coverage

From the Field

## 20 years of Oracle operations notes

Real incidents, real fixes, real production lessons from our founder's blog.

Migration May 2025
Oracle ZDM — Zero Downtime Migration
10-section deep dive: architecture, pre-requisites, response file parameters, migration flow, monitoring and troubleshooting from production migrations.
Read →
Performance Apr 2024
Oracle Database Performance Crisis: Analysis & Recommendations
Real-world EBS crisis — CPU at 120 load average, 250+ concurrent requests pending. Root causes and step-by-step resolution documented.
Read →
Migration Aug 2017
EBS 12.2 Cloning Procedure — Complete Steps
Definitive reference for cloning EBS 12.2 — rapid clone on DB and apps tiers, post-clone configuration, autoconfig, and sanity checks for a production-equivalent clone.
Read →
Built for enterprise Oracle environments
🔐

#### Credentials Encrypted at Rest (AES-256-GCM)

Oracle passwords, SSH keys, and API keys are stored encrypted. Never plaintext.

🛡️

#### Encryption Everywhere

TLS in motion, AES-256 at rest, encrypted Agent channel. Your data never travels unprotected.

📋

#### Full Audit Trail

Every command, every approval, every change — logged with user identity and timestamp.

✅

#### Approval Workflows

Gated execution for prod environments. Multi-level sign-off enforced before any remediation runs.

🎫

#### Ticketing Integration

Built-in TuneOps ticketing with RBAC approvals and audit trail. REST API available for ServiceNow / Jira / PagerDuty integration — connector plugins on roadmap.

👥

#### Role-Based Access

DBA / Apps DBA / Functional / Dev / SDM / Manager personas with granular permission tiers.

Security Architecture

## Security Model — Shared Responsibility, Zero Trust

What a CISO needs to know before approving a demo. TuneVault's security posture, in plain terms.

🔐
Database Layer
Transport + Credential Handling

- Direct connection: TLS-encrypted; credentials can be session-only (not saved) or encrypted at rest with AES-256
- Proxy agent: HTTPS outbound only, AES-256 encrypted config, SHA-256 verified downloads
- API keys: per-connection, rotatable, usage-tracked with IP + timestamp
- Rotation warning: amber alert at 90-day threshold — visible in dashboard

🛡️
SSH Operations (Opt-In)
Guardrails + Audit

- Command allowlist: only approved operations execute — shell metacharacters rejected at gate
- Full audit trail: user + timestamp + exact command + output — append-only log
- Session limits: 15-min idle timeout, 1-hour hard max
- Customer-defined scope: OS user, SSH target, and permissions set by your team
- No interactive shell: the allowlist IS the only execution path
- Rate limiting: per-user caps + global concurrent stream ceiling

🤝
Shared Responsibility
What We Own / What You Own

- TuneVault protects: encrypted transport, AES-256 config at rest, tamper-proof downloads, command guardrails, audit logging, session limits, rate limiting
- You protect: OS-level permissions, SSH user scope, network firewall rules, your VPN/WAF configuration
- SOC 2 Type II: in progress — documentation available on request
- DPA: available on request at hello@tunevault.app

Read the full security audit → Security & Trust Center → No plaintext credentials stored TLS + AES-256 everywhere

Built for every Oracle role
Core DBA
DBA

- Health checks & diagnostics
- SQL tuning & index advisor
- Patch gap analysis
- Clone & runbooks
- Autonomous monitoring

Apps DBA
Apps DBA

- EBS-native health checks
- ADOP & FMW homes
- Concurrent Managers
- OPP & Workflow Mailer
- Apps Tier operations

Functional
Functional Consultant

- Setup object migration
- FNDLOAD wizard
- Profile diffs
- Workflow monitoring
- Value set management

Developer
Developer

- Invalid object tracking
- SQL console
- Object deployment
- custom_top migration
- Code-level diagnostics

Management
SDM / Manager

- SLA dashboard
- Change calendar
- Audit summary
- Weekly PDF reports
- Fleet health score

🖥 PuTTY SSH client ⌨ SQL*Plus terminal 📂 Manual SCP transfers $_ Root shell access
🌐 Everything in the browser.
No desktop tools. No root access needed.
No PuTTY. No SQL*Plus. No terminal sessions.
Monitoring, tuning, and control — all in one browser window. Direct TCP connects without any install; Agent mode uses a lightweight connector on your Oracle server for secured environments.

Real findings. Zero guesswork.

## What TuneVault finds
in minutes

These are actual diagnostic outputs — styled exactly as they appear in the dashboard. This is the product, previewed.

🔴 CRITICAL
Tablespace
USERS tablespace 92.5% full
Add datafile or enable AUTOEXTEND
`ALTER DATABASE DATAFILE ... AUTOEXTEND ON;`
⚠️ WARNING
EBS — ADOP
3 stale ADOP sessions detected
Release locks with:
`adop phase=cleanup`
🔴 CRITICAL
EBS — Concurrent Manager
ICM not running
Restart Internal Concurrent Manager:
`adcmctl.sh start apps/apps`
⚠️ WARNING
Memory — SGA
Buffer cache hit ratio 71.2%
DB_CACHE_SIZE undersized for workload. Increase by 2–4 GB and monitor V$DB_CACHE_ADVICE.
🔴 CRITICAL
Backup — Archivelog
Archive log dest 94% full
Free space immediately:
`RMAN> DELETE ARCHIVELOG ALL COMPLETED BEFORE 'SYSDATE-1';`
🔴 CRITICAL
Sessions
17 blocking sessions detected
SID 234 (FNDLIBR) — blocker
└─SID 441, 502, 638...
SID 119 (OACORE) — blocker
⚠️ WARNING
EBS — OPP
OPP service down
Workflow notifications stalled. Restart Output Post Processor via EBS Control panel.
🔴 CRITICAL
Performance — Redo
Redo log switches: 47/hour
Logs undersized — causing I/O spikes.
`ALTER DATABASE ADD LOGFILE ... SIZE 500M;`
200+
Automated checks
Tablespace, wait events, slow SQL, SGA/PGA, EBS services, and more — every run.
Minutes
Full diagnostic
vs. hours of manual SQL queries, log grepping, and alert log archaeology.
0
Terminal sessions
No PuTTY. No SSH. No root access required. Browser only.
100%
Audit trail
Every check run, every action, every finding — logged and exportable.

TuneOps Ticketing

## Every finding becomes a ticket.
Every action tracked.

TuneOps converts health check findings into structured tickets — automatically. From `TO-0001` through enterprise scale, every issue has an owner, a status, and a full audit trail.

01
OPEN
Health check detects a finding. TuneOps opens a ticket automatically with full context, severity, and remediation guidance.
02
ACKNOWLEDGED
DBA reviews and acknowledges the issue. Approval workflows route to the right team member based on role and hierarchy.
03
EXECUTING
Pre-approved remediation command runs. Every parameter logged. Every execution auditable — no undocumented one-liners.
04
RESOLVED
Issue resolved and verified. Next health check confirms fix. Delta-aware: won't re-open unless the issue resurfaces.
TO-0047 EXECUTING
Finding
Tablespace USERS at 94% — critical threshold breached
Remediation
`ALTER TABLESPACE USERS ADD DATAFILE SIZE 2G AUTOEXTEND ON`
Approved by
Lead DBA → Manager (chain complete)
14:03:12 Ticket opened — severity CRITICAL
14:07:44 Acknowledged by s.patel@corp.com
14:09:02 Approved by r.kumar@corp.com (Manager)
14:09:18 Executing remediation command...

Role-Based Access Control

## Every fix goes through
your approval chain.

Custom role hierarchies for enterprise teams. Every action logged. Every execution auditable. No DBA can run a remediation command without the right approvals in place.

MANAGER
Database Manager
Full access — approves critical remediations, manages team, views all connections
↓
LEAD DBA
Lead DBA
Approves standard remediations, manages Junior DBAs, runs on-demand checks
↓
SENIOR DBA
Senior DBA
Executes approved remediations, runs health checks, confirms tickets
↓
JUNIOR DBA
Junior DBA
Read-only access to reports and findings — no execution privileges
↓
VIEWER
Viewer
Dashboard + export only — perfect for stakeholder reporting
✅

#### Approval workflows

Critical remediations require sign-off from the right role tier before execution. TuneVault enforces the chain — no bypassing.

📋

#### Full audit trail

Every command, login, approval, and rejection is timestamped and logged. SOX auditors get exactly the evidence they need.

🏢

#### Custom hierarchies (Enterprise)

Enterprise plans support custom role configurations and multiple approval chains — model your actual org structure, not a generic template.

🔐

#### RBAC audit log

Every permission-denied API attempt is recorded with user, role, path, and timestamp. Know exactly when someone tried to exceed their access.

TuneBot AI Assistant

## Your Oracle knowledge
assistant.

TuneBot is your Oracle knowledge assistant. Ask about TuneVault features, Oracle best practices, EBS operations, and DBA workflows. Get knowledgeable answers from a 57-page, 35-topic knowledge base built for Oracle practitioners.

🤖
TuneBot ● online
What causes tablespace to grow quickly?
👤
Common causes: large batch jobs, temporary segment usage, bulk inserts, or misconfigured UNDO retention. TuneVault's health checks can identify which segments are growing. Run a health check to see the specific drivers in your database.
Should I add a datafile or use autoextend?
👤
Fixed datafiles give predictable disk allocation and avoid fragmentation, while autoextend is dynamic but can cause performance spikes. Best practice: use fixed sizes with monitored thresholds. Check your storage capacity and growth rate to decide the right approach for your environment.
🧠

#### 57-page knowledge base

35 topics covering TuneVault setup, health checks, DB operations, SQL tuning, EBS administration, security, performance, and best practices.

📚

#### Answers Oracle questions

Ask about setup, configuration, troubleshooting, best practices, and DBA workflows. Quick answers powered by expert knowledge base.

⚡

#### Instant access

Available 24/7 on the dashboard. No setup required — just open TuneBot and start asking about Oracle, EBS, or TuneVault.

🔒

#### Knowledge-based, not data-driven

TuneBot answers from its knowledge base — not by analyzing your database or health checks. Privacy first.

EBS Deep Mode

## Three pillars. One agent.
Built for 4am.

When your EBS environment pages at 4am, you need answers — not a console to log into. Monitor catches it first. Sanity tells you why. Control lets you act.

PILLAR 01
📡

### Monitor

11 live service status cards

Real-time service status across your entire EBS stack. Auto-refreshes every 30 seconds, pauses when the tab is hidden to save resources.

- OPMN — process manager heartbeat
- NodeManager — WLS node controller
- WLS Admin Server — WebLogic admin
- Concurrent Managers — ICM + queues
- Internal Manager
- Standard Manager
- OPP — Output Post Processor
- WF Mailer — outbound mail engine
- WF Notification — queue depth
- Apps Listener — TCP connectivity
- Apache — web entry point

Sources: DB-only · TCP probe · DB+TCP hybrid
30s auto-refresh · pauses on tab hide
PILLAR 02
🔍

### Sanity

5 deep configuration audits

Catches misconfiguration before it becomes an incident. Five live Oracle query categories — each with expandable SQL and row-level evidence.

- FND_NODES consistency — AUTHENTICATION node required; orphaned/inactive nodes flagged
- ADOP Filesystem — sessions stuck >7d in PREPARE/APPLY/FINALIZE auto-fail
- 10 critical profile options — SITE-level GUEST_USER_PWD, ICX_SESSION_TIMEOUT, RRA_SERVICE_PREFIX + 7 more
- CM Config — zero-target queues, Standard Manager cache_size drift, ICM on inactive node
- WF Mailer Config — SMTP blank = fail; queue >100 = fail; >20 = warn; TEST_ADDRESS production-smell

Cache: 5-min per connection · ?refresh=1 bypass
All 5 cards carry expandable SQL panels + raw row preview
PILLAR 03
🎛️

### Control

Whitelisted catalog · dry-run · audit-logged

Controlled remediation with enterprise-grade guard rails. No arbitrary shell access — only pre-approved commands, server-side validated, every action on record.

- CM bounce — restart Concurrent Manager processes
- WF Mailer restart — reset stuck outbound mail engine
- OACore bounce — recycle OA Framework servlet
- OPP kick — restart Output Post Processor
- Recompile invalids — rebuild invalid Oracle objects

Trust model: Slug validated server-side · 403 on non-whitelist
Every attempt → audit_log · lockdown script + SHA-256 artifacts
VAULT
🛡️

### Vault — Security & Resilience

10-group security posture scanner, RMAN backup currency, Data Guard lag, FRA headroom, and CVE exposure mapped to Oracle CPU advisories. Score 0–100. PDF/XLSX export for compliance teams.

Open Vault →
TUNE
⚡

### Tune — Performance & Diagnostics

Top SQL killers, wait event root causes, live blocking sessions, ADDM auto-findings, patch gap analysis and OPatch runbook generation — all from your browser.

Open Tune →
View Sample Report → Run it on your DB → vs Datadog & OEM →

24/7 Autonomous Monitoring

## Schedule it once.
Know before problems escalate.

Schedule health checks every 1h, 6h, 12h, or 24h. TuneVault runs 200+ checks on cadence and sends delta-aware alerts — only on new findings, never noise.

Scheduled Connections Live
PROD-ERP-01 Every 1h HEALTHY
PROD-ERP-02 Every 1h 2 WARNINGS
DR-STANDBY Every 6h HEALTHY
DEV-EBS-TEST Every 12h HEALTHY
⚠ Alert sent — PROD-ERP-02: Tablespace TEMP at 89% (new finding)
🔔

#### Delta-aware alerting

Alerts only fire on new findings — not on issues you already know about. Zero alert fatigue. No 3am pages for existing tickets.

⏰

#### Flexible cadences

Run checks every 1h for production, every 12h for development. Per-connection scheduling with per-connection severity thresholds.

📧

#### TuneOps email notifications

10 event types — ticket opened, escalated, approved, resolved, and more. Dedup window and rate limiting built in to prevent spam.

😴

#### Snooze & maintenance windows

Snooze alerts per connection during scheduled maintenance. Alerts resume automatically when the window closes.

Security & Compliance

## Built to pass
enterprise infosec review.

Security-first architecture. No passwords stored in plaintext. No inbound ports. No arbitrary shell access. Every design decision made to survive a serious security audit.

🔐

#### AES-256-GCM Encryption

All credentials encrypted at rest using AES-256-GCM. No plaintext passwords ever stored — not in the database, not in logs, not in env vars.

🌐

#### Outbound-Only Connections

The TuneVault Agent connects outbound via HTTPS — no inbound ports opened on your Oracle server. Nothing reaches in. Your firewall stays locked.

📜

#### Whitelisted Commands Only

No arbitrary shell access. Every executable command is in a pre-approved catalog, risk-rated, server-side validated. Slug not on the list → 403, logged.

🔍

#### Complete Audit Trail

Every command, login, approval, and rejection is timestamped and immutably logged. Every action on record — no exceptions, no overrides.

🛡

#### Open-Source Agent

The TuneVault Agent is open-source Python — you install it, you control it, you kill it. No black-box software running on your Oracle server.

🏢

#### SAML 2.0 SSO

Enterprise SSO via Okta, Azure AD, Google Workspace, or any SAML 2.0 provider. Group-to-role mapping for automated access provisioning.

Compliance-ready reports for: SOX Change SOX Access Audit HIPAA Activity PCI-DSS ISO 27001 View Security Page →

Compliance report exports for audit evidence — TuneVault is not itself SOX/HIPAA/PCI/ISO certified.

REST API v1

## Your Oracle data.
Your tools.

Enterprise tier includes a full REST API. Pull health check results, ticket state, fleet status, and activity logs into ServiceNow, Jira, PagerDuty, Slack, or any REST-enabled system. Direct connector plugins for ServiceNow / Jira on roadmap.

REST API v1 — curl example
curl -X GET \
https://tunevault.app/api/v1/health/checks \
-H "Authorization: Bearer tv_live_..." \
-G -d "connection_id=42&limit=5"
// Response
{
"data": [ // Latest health check results
{ "id": 1842, "score": 87,
"findings": 3, "severity": "warning" }
],
"meta": { "total": 48 }
}
🔔 PagerDuty Auto-escalate critical findings
🎫 ServiceNow / Jira Sync TuneOps tickets bidirectionally
💬 Slack / Teams Post alerts to your DBA channel
Available Endpoints
GET /api/v1/health/connections
GET /api/v1/health/checks
GET /api/v1/health/fleet
GET /api/v1/tuneops/tickets
GET /api/v1/tuneops/stats
GET /api/v1/activity/log
GET /api/v1/team
RATE LIMITS
Enterprise: 100 req/min
Business: 60 req/min
Team: 30 req/min
View API Docs →

Claude MCP Integration

## Ask Claude about
your Oracle databases.

TuneVault's MCP server gives Claude Desktop and Claude Code direct access to your Oracle data — 20 tools covering health checks, SQL queries, tablespace usage, ADOP status, CVE scans, and more. No copy-paste, no context switching.

A
Claude + TuneVault MCP ● connected
Which tablespace is closest to full on PROD-ERP-01?
👤
UNDOTBS1 is at 91.3% (18.4 GB / 20 GB) — the most at-risk tablespace. USERS is next at 84.7%. I'd recommend either extending UNDOTBS1 or investigating long-running transactions that are holding UNDO segments open.
Any blocking sessions right now?
👤
No blocking sessions detected. All 42 active sessions are running normally — no waits in the lock chain.
What EBS patches were applied last month?
👤
3 patches applied in May 2026: Bug 31984268 (May 12, Applied), Bug 33533539 (May 8, Applied), Bug 34729166 (May 3, Applied). All patches show fs_clone=Y — file system clone completed successfully.
🤖

#### 20 live Oracle tools

Health checks, tablespace usage, blocking sessions, ADOP status, CVE scans, Concurrent Manager, Workflow errors, EBS patches, TuneOps tickets, and more — all accessible via natural language.

⚡

#### Works in Claude Desktop and Claude Code

Standard MCP Streamable HTTP transport — one config block and you're connected. No plugins, no wrappers. Tested with Claude 4.x.

🔒

#### Auth via API key

Generate a scoped API key at Settings → API Keys. Your database credentials never leave TuneVault — Claude only sees query results, not raw credentials.

📖

#### Full tool reference

Browse all 20 tools → or go to Setup Guide to get connected in under 2 minutes.

The Founder

## Built by a DBA,
for DBAs.

TuneVault isn't built by a SaaS team that read about Oracle. It's built by someone who's lived inside Oracle environments for two decades.

KA
Kiran Kumar Ale
Founder

20+ years Oracle E-Business Suite, Database Administration, and Enterprise Cloud (OCI). 20+ enterprise EBS upgrades (11i → 12.2.x) and OCI migrations delivered globally.

Blog
LinkedIn
Read full bio

- 20+ enterprise EBS upgrades (11i → 12.2.x) and OCI migrations delivered globally
- Deep expertise in RAC, ASM, Data Guard, Performance Tuning, DR, SSO (OAM/IDCS/Azure AD), Automation (Shell/SQL/Python/Ansible)
- Cross-platform migrations (AIX/HP-UX to Linux), WebLogic/FMW, ADOP, SSL/TLS, DMZ architecture

Certifications & Credentials

Holder of 23 Oracle and project management credentials spanning cloud, applications, database, and delivery methodology.

☁️ Oracle Cloud Infrastructure & AI

- OCI 2025 Certified Multicloud Architect Professional
- OCI 2025 Migration Architect Certified Professional
- OCI 2024 Generative AI Certified Professional
- OCI 2025 Data Science Professional
- OCI 2025 Certified AI Foundations Associate
- OCI 2025 Certified Foundations Associate
- Oracle AI Vector Search Professional
- Oracle Cloud Database Services 2025 Certified Professional

⚙️ Oracle Fusion Applications

- Oracle Fusion AI Agent Studio Foundations Associate – Rel 1
- Oracle Fusion Cloud Applications ERP Process Essentials Certified – Rel 1
- Oracle Fusion Cloud Applications HCM Process Essentials Certified – Rel 1
- Oracle Fusion Cloud Applications SCM Process Essentials Certified – Rel 1
- Oracle Fusion Cloud Applications CX Process Essentials Certified – Rel 1
- Oracle Data Platform 2025 Certified Foundations Associate

🗄️ Oracle Database & E-Business Suite

- Oracle Database 11g Administrator Certified Professional
- Oracle Database 10g Administrator Certified Professional
- Oracle Database 10g Administrator Certified Associate
- Oracle E-Business Suite R12 Applications Database Administrator Certified Professional
- Oracle Autonomous Database Cloud 2019 Certified Specialist
- Oracle Certified Associate, Oracle WebLogic Server 11g System Administrator
- Oracle Cloud Infrastructure Classic 2018 Certified Associate Architect

📋 Project Management

- PRINCE2® Foundation Certificate in Project Management
- PRINCE2® Practitioner Certificate in Project Management

## See exactly what's wrong with your Oracle database.

Get a full diagnostic in minutes. No full-time DBA required. No configuration needed.

Run Your Free Health Check → Self-Hosted →
SOC 2 Type II — in progress DPA available on request — hello@tunevault.app or support@tunevault.app