The internet is on fire with recent news of a new security vulnerability identified in Apache Log4j.

Log4j is an open-source logging framework used by major Java-based enterprise applications and servers. The vulnerability is being considered as one of the most dangerous ones found in recent years. It potentially allows attackers to execute arbitrary code within a company’s network by sending crafted log messages. It has been identified as CVE-2021-44228 and called Log4Shell.

Security-mature organizations started assessing their exposure almost immediately due to the severity of the exploit and provided security patches or workaround solutions to safeguard systems and data from this threat.

In life sciences, we quickly reacted to the issue, identified the resolutions for the respective products of different versions, and developed an action plan immediately for cloud hosting customers.

In close collaboration and coordination with our customers and their users, we were able to patch and protect against this vulnerability for all our life sciences hosted clients within a few hours to safeguard each hosted application.

Often, Siebel system administrators or Siebel developers need to switch the Siebel application to the vanilla or out-of-the-box configuration, in order to test/debug a version of Siebel that has custom configurations. In earlier Siebel releases (prior to Open UI), developers had to switch the Siebel SRF (Siebel Repository File) to an out-of-the-box SRF and restart the Siebel services to be able to view the application in vanilla mode.

In the latest versions of Siebel (Open UI), Oracle has made it much easier to run the application in a vanilla configuration mode. With the introduction of the Open UI version, the system now has two object manager parameters that can be used to do this quickly. By default, the two parameters are set to “False” in the object manager component:

• Manifest Safe Load – Default set to False, doesn’t run in Vanilla Mode
• Enable Safe Load – Default set to False, doesn’t run in Vanilla Mode

By setting these parameters to “True,” the application will run in the vanilla out-of-the-box configuration. This is very helpful when debugging issues and working with Oracle support to identify the root cause of any encountered application issues.

We encountered a strange issue in our customer’s Oracle CTMS application. Our team had configured a customer’s Oracle Siebel CTMS application based on their specific business requirements, including the need for new views for end-users.

The application was working fine for years without any issues until the customer reported that certain views in the application were no longer accessible or visible. When users were trying to navigate to the view, the mouse icon would change to an hourglass for some time and then stop without navigating to the requested view.

Upon further analysis, we identified that the HTTP request made to access the view was not receiving an HTTP 200 OK success status response code. The HTTP 200 OK success status response code indicates that the request has succeeded. The connection attempt was made from the browser, but the server denied the request.

The cause of the issue was due to the latest update to the snort rules updated in the Load Balancer. Snort rules are primarily used for intrusion and vulnerability detection. It uses the rules to identify whether the incoming URL is malicious or not. In this specific case, when navigating to a custom view, the snort rules detected it as a suspicious URL and dropped the connection.

Our IT team identified the snort rule causing the issue. Disabling this rule returned the application to functioning as desired for the custom views.

Do you experience issues with your Siebel applications and infrastructure? If so, reach out to us for help.

Is your Oracle Siebel CTMS Application slow? Siebel message broadcasting could be the reason!

The Siebel message broadcasting feature is typically used by application system administrators to send important information to application end users about system downtime and system availability.

In recent Open UI versions of Siebel, this notification appears at the top right corner of the screen. When users run the BI Publisher report, the same message bar feature is also used to notify the user that the report has generated.

All of these broadcast messages are stored in a table named S_BRDCST_MSG and queried by the application to send a notification to the relevant user on the desired frequency. Though there may not be any new message, the table is still queried regularly by the application to check for a new message. This causes some application performance issues, as well as a potential delay in basic user navigation and general application usage. We recently had one of our customers who has a very high user volume and as a result, very heavy BIP report usage, that experienced application performance dip regularly.

The message broadcasting feature can be disabled in the object manager component level if the application does not use the feature. If the users are using this message broadcast feature,  a scheduled job can be built to expire and purge the old message records from the message broadcasting table, which, if done regularly, should address any performance lag resulting from this particular issue.

If your Oracle Siebel application has any issues or your organization needs guidance on how to optimize the usage of the application, please reach out to us.

Site monitors and study managers, listen up: Oracle’s innovation pack 2016 (IP2016) for Siebel Clinical finally supports up-versioning of approved trip reports. No more handwriting the changes on the approved, printed version. No more squeezing clarifications into the site visit record comments field. No more creating a separate trip report with a similar name to serve as an addendum.

Here are some highlights of this exciting new feature:

• Trip report is locked post-approval
• Approved version can be copied to a new record, bringing along all of its contents, which can then be edited
• Trip report version number and revision history can be tracked
• Approved trip reports cannot be deleted; instead, previous versions can be designated as “obsolete”

For more on IP2016 features and benefits, fill out the contact form below and we’ll get back to you.

The satellites are finally in orbit! In Oracle’s innovation pack 2016 (IP2016) for Siebel Clinical, they introduced a new feature that allows clinical sites to have satellite sites organized beneath them.

Here are some highlights of the satellite site feature:

• Multiple satellite sites can be defined for an individual parent site
• Parent site data defaults to all of its satellites, including subject visit template, principal investigator, and site team
• Certain field data can be modified from the parent site default data
• Option exists to assign subject visits from parent site to satellite site
• Summary of subject enrollment data rolls up from satellite sites to parent site
• Payment and contract data rolls up from satellite sites to parent site

For more on IP2016 features and benefits, fill out the contact form below and we’ll get back to you.

Study managers, rejoice! In Oracle’s innovation pack 2016 (IP2016) for Siebel Clinical, Oracle introduced a new feature that allows subjects who are enrolled at one site to be transferred to another – without losing any history.

Here are some highlights of the subject transfer feature:

• Ability to transfer subjects from one site to another within the same study
• Option to retain the subject’s visit data from the source site
• Option to apply the destination site visit template to the incoming subject
• Ability to apply the payment exceptions set for the destination site to the incoming subject
• Complete tracking of subject transfer history at both the site and subject level

For more on IP2016, fill out the contact form below and we’ll get back to you.

“Customer experience” is all the rage these days. And Oracle has got your back. In a recent major release (IP2015) of its Siebel platform, Oracle introduced a function called usage pattern tracking (UPT). It provides insight into user behavior, similar to web analytics.

Here’s a summary of UPT’s features:

• Can be used to analyze system usage and intelligently improve customer experience
• Provides reliable information that can be used to change application configuration and features, and to simplify the user interface
• Can be enabled by leveraging Siebel inbuilt modules (workflows and runtime events)
• Allows administrators to review details about when and how often users access the features in any Siebel application
• Monitor how often users use a Siebel application, screen, view, applet, or business component
• Monitor how users use a feature in a Siebel application
• Monitor feature usage after application upgrades or during development cycles
• Can be configured by administrators to monitor specific user events

For more information on UPT, the IP2015 release of Siebel, or upgrading your existing Siebel applications, fill out the “contact us” form below.

In our last “cloud fact or fiction” post, we discussed the ability to migrate clinical and pharmacovigilance data to the cloud. Let’s jump right in and talk about system integrations in the cloud.

Claim #7: Clinical trial software in the cloud cannot be integrated with other systems. 

Fact or fiction? Fiction.

Hosted clinical trial, data, and safety solutions can be integrated with other systems just like any in-house system. Hosting does not limit integration methods or types of systems.

Cloud system integrations can include:

• Clinical Data Analytics
• Clinical Data Management Systems (CDMS)
• Clinical Data Warehouses
• Clinical Trial Management Systems (CTMS)
• CRO systems
• Electronic Data Capture (EDC) Systems
• Electronic document management systems (EDMS)
• Financial systems
• Interactive Voice Response Systems (IVRS)
• Investigator Portals
• Safety and Pharmacovigilance Systems

Check back for our next “cloud fact or fiction” post when we discuss system administration in the cloud. To read past posts in this series, click here.