Standby DB Alert Log Contains: "kcbztek_populate_tbskey: db key in controlfile and datafile 1 is inconsistent" (Doc ID 2512024.1)

Last updated on APRIL 17, 2023

Applies to:

Symptoms

The alert log of an 11.2.0.4 Data Guard standby database contains the following after MRP is started:

Managed Standby Recovery not using Real Time Apply
kcbztek_populate_tbskey: db key in controlfile and datafile 1 is inconsistent..
Parallel Media Recovery started with 4 slaves
Sat May 05 23:29:14 2018
Errors in file /oracle/app/oracle/diag/rdbms/mydb/MYDB/trace/MYDB_dbw0_13500696.trc:
ORA-01186: file 1 failed verification tests
ORA-28374: typed master key not found in wallet
File 1 not verified due to error ORA-28374

Trace files on the standby exhibit similar symptoms to those on the primary.  The master key ID (mkid) values are identical as well.

Standby trace contains:

Changes

TDE was implemented using Fast Offline Encryption, but this was performed improperly for a Data Guard setup.  The primary was encrypted first, which is incorrect.  The standby should have been encrypted first.

Following this, an attempt was made to "roll back" TDE by closing the wallet and moving it elsewhere.

Finally, a new wallet was created with a brand new master key.  (This wallet lacked the original master key for the database.)

The primary experienced "ORA-28374: typed master key not found" errors, caused by rekeying the database after removing the wallet.  This led to the same errors on the standby, causing MRP to stop.  Following this, the ENCRYPTION_WALLET_PARAMETER was removed from the standby sqlnet.ora.  The standby began to produce "kcbztek_populate_tbskey: db key in controlfile and datafile 1 is inconsistent" messages and continued to throw ORA-28374.

Cause

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.