End-to-End Database OpenTelemetry, Priority Transactions, and More

New ODP.NET 23.26.2 Features

Key Takeaways

• ODP.NET 23.26.2 has been released for managed and core providers.
• New features include end-to-end Oracle AI Database OpenTelemetry tracing, priority transactions, EF Core spatial, post quantum cryptography, in-memory certificates and credentials, TLS state transfer, and metrics filtering.
• Oracle Database Vector Store Connector for .NET (production), ODP.NET SQL script execution (preview), and Oracle Deep Data Security for ODP.NET will be arriving soon.

ODP.NET 26ai (23.26.2) is now available on NuGet for both core and managed providers. This release adds new capabilities for observability, transaction management, EF Core spatial, and security — helping you build more robust Oracle .NET apps. Let’s take a closer look at each of these features and benefits.

End-to-end App Observability

OpenTelemetry is a popular observability framework and a standard for application end-to-end tracing. Your app, ODP.NET, and Oracle AI Database each can emit their own traces, but spotting bottlenecks requires a single, combined view over the entire stack. Client apps and ODP.NET can unify traces on the same host via one OpenTelemetry collector; the database, however, emits a separate trace — forcing admins to align client and database traces manually.

With end-to-end OpenTelemetry, traces are unified and aligned automatically, making cross‑stack analysis faster and easier. Here’s an ODP.NET ExecuteReader query execution combined trace, visualized in Jaeger, an open‑source distributed tracing tool.

An ODP.NET ExecuteReader query execution trace, visualized in Jaeger, an open-source distributed tracing tool.

The entire operation takes 14 ms. The database activity (orange) runs early on and lasts 3 ms, while ODP.NET activity (blue) spans the entire operation. ODP.NET and Oracle Database OpenTelemetry tags — such as db.namespace, db.response.returned_rows, and db.user—appear combined in an easy‑to‑read graphical view.

Identifying errors and performance issues is easier when database and ODP.NET operations align visually for each round trip. The db.odp.roundtrip.duration and db.odp.roundtrip.count tag data help pinpoint latency and excessive activity.

As an OpenTelemetry collector, Jaeger provides a holistic view of app activity. Here, it aggregates seven query executions from ODP.NET and Oracle Database traces.

Aggregating query executions from ODP.NET and Oracle AI Database traces

In the screen shot, we see most queries finish in about half a second or less — except the fourth, which takes 3.8 seconds. This view makes slow operations easy to spot, then lets you drill into the query’s trace to see whether the delay is on the client or database side — and why.

While this blog post example uses Jaeger, any OpenTelemetry Protocol (OTLP)–compliant collector, such as Prometheus or Splunk, works with Oracle OpenTelemetry. The only other requirement is ODP.NET and Oracle AI Database must use the same exporter for unified tracing.

Oracle’s end-to-end tracing works by embedding database OpenTelemetry child spans within ODP.NET traces. ODP.NET passes the client app context to the database, which then links its own trace to ODP.NET’s to create a unified view. The combined trace is exported to a collector. Notably, ODP.NET never gains access to the database trace itself.

Database spans are generated on each round trip — such as command executions, reads, and fills. By default, database OpenTelemetry is off. To enable end-to-end tracing, set the ODP.NET property DatabaseOpenTelemetryTracing = true. You can set it on OracleConfiguration, OracleConnection, OracleDataSource, OracleDataSourceBuilder, or in app/web.config.

You can toggle database OpenTelemetry on and off at any point in an ODP.NET connection’s lifetime. This lets you trace only the code you need to without adding unnecessary overhead to the rest of the app.

End-to-end tracing gives developers a holistic view of app activity, speeding performance analysis and error resolution.

Unblock Critical Updates with Priority Transactions

Not every app transaction matters equally. Some are more critical to business operations than others. When a low‑priority transaction unintentionally holds row locks, it can block higher‑priority work from updating the same rows. This can occur after an exception leaves the low‑priority transaction uncommitted. In these cases, an administrator must kill the blocker so the app can continue its work. That manual cleanup adds overhead, degrades user experience, and can trigger downtime.

Starting in Oracle AI Database 26ai (23.26.2), Priority Transactions solve this issue. If a low‑priority transaction blocks a higher‑priority one, the former automatically rolls back and the latter can then commit. Low priority transactions no longer block high priority ones.

While the low-priority transaction session stays active afterwards, the application must acknowledge the rollback — typically by calling ODP.NET Rollback(). Until then, any command execution on the low-priority transaction session returns ORA‑63302 or ORA‑63300.

In ODP.NET 23.26.2, both managed and core providers support Priority Transactions. The priority levels are High (default), Medium, and Low. High‑priority transactions can roll back Medium and Low ones; Medium transactions can roll back Low ones.

Rollbacks don’t happen immediately when a high‑priority transaction is blocked. The database waits for the target time to elapse, then rolls back lower‑priority transactions.

• High priority transactions wait until PRIORITY_TXNS_HIGH_WAIT_TARGET.
• Medium priority transactions wait until PRIORITY_TXNS_MEDIUM_WAIT_TARGET.

Set ODP.NET transaction priority with the OracleTransactionPriority enum (High, Medium, Low). Configure it via OracleConfiguration, OracleConnection, OracleDataSourceBuilder, or in the .NET Framework config file using the TransactionPriority property. You can also set it when starting a transaction using OracleConnection.BeginTransaction.

This code snippet below shows how to use ODP.NET transaction priority. Two transactions are created that update the same row; one is low priority and the other high. The low priority transaction executes its data change first but does not commit. The high priority transaction executes and waits until PRIORITY_TXNS_HIGH_WAIT_TARGET expires. When it does, it can then commit the data change.

OracleTransaction low_priority_txn = conA.BeginTransaction(OracleTransactionPriority.Low);
OracleCommand cmdA = new OracleCommand(“update…sal=sal+1 where empno=7654”, conA);
cmdA.ExecuteNonQuery();

OracleTransaction high_priority_txn = conB.BeginTransaction(OracleTransactionPriority.High);
OracleCommand cmdB = new OracleCommand(“update…sal=sal+10 where empno=7654”, conB);

// Waits for PRIORITY_TXNS_HIGH_WAIT_TARGET seconds
cmdB.ExecuteNonQuery();
high_priority_txn.Commit();

EF Core Spatial Data

Oracle EF Core spatial support previewed last year. It enables Oracle spatial types to map to EF Core types via NetTopologySuite and performs create, query, update, and delete operations on them. In this release, the [Oracle.EntityFrameworkCore.NetTopologySuite](https://www.nuget.org/packages/Oracle.EntityFrameworkCore.NetTopologySuite/) library is production-ready. To learn more, I covered these Oracle EF Core spatial features in a prior post.

New Security Features

ODP.NET 23.26.2 adds new security algorithms, configuration options, and performance optimizations to better protect your .NET apps.

Post Quantum Cryptography

Today’s public‑key cryptography relies on math problems that are hard for classical computers to solve. Quantum computers could eventually break many of these schemes, so some bad actors are harvesting encrypted data now to decrypt in the future when quantum computing is powerful enough.

Post‑quantum cryptography (PQC) uses algorithms designed to resist quantum attacks. For security‑minded organizations, moving to PQC is a proactive step to protect data for the long term.

ODP.NET and Oracle AI Database support PQC with the Module Lattice Key Encapsulation Mechanism (ML-KEM) and Module Lattice Digital Signature Algorithm (ML-DSA) algorithms. This support is available in ODP.NET Core, managed, and unmanaged.

In-memory Certificates and Credentials

ODP.NET connections can now load additional in‑memory certificate and credential types, including single sign-on (SSO), PKCS #12 wallet (P12), and Privacy Enhanced Mail (PEM). Each user can hold multiple certificates and credentials, giving apps more configuration choices and fine grain control. Apps no longer have to read wallets only from directories or URLs — they can configure and load them directly in code.

Three new classes store in‑memory certificates and credentials for OracleConnection:

• OracleSSO — SSO certificates and credentials (Managed ODP.NET and ODP.NET Core)
• OracleP12 — P12 certificates and credentials (Managed ODP.NET and ODP.NET Core)
• OraclePEM —PEM certificates and credentials (ODP.NET Core only)

After configuring these objects, you must make them read‑only before associating them with OracleConnection for use. Here’s an ODP.NET sample that connects using an SSO file.

OracleConnection conn = new OracleConnection("User Id=/;Data Source=oracle");

// Create and populate OracleSSO with SEPS credential.
OracleSSO oracleSSO = new OracleSSO();
byte[] sso = File.ReadAllBytes("C:\\myWallets\\cwallet.sso");

oracleSSO.Set(sso, OracleCertificateFunctionality.None, OracleCredentialFunctionality.SEPS);
oracleSSO.MakeReadOnly();
conn.SetSSO(oracleSSO);
conn.Open();

TLS State Transfer

Managed ODP.NET and ODP.NET Core can share TLS context across processes, avoiding renegotiation and saving compute and network round trips.

You can enable TLS state transfer by setting NET_TLS_STATE_TRANSFER in listener.ora or cman.ora.

ODP.NET Metrics Filtering

ODP.NET metrics track connection statistics for monitoring and alerting purposes. By default, they publish at the application domain, connection pool, and database instance levels. If you only need one or two of these levels, ODP.NET 23.26.2 can be configured to filter for only the level(s) needed— so administrators see only the data that matters.

To configure, set the filter via the MetricsLevel value using the OracleMetricsLevel enum, which is available in managed ODP.NET config files or through OracleConfiguration in both core and managed.

Each metric publishes a “Level” tag to show its source:

• Application Domain — Level = ”AppDomain”
• Connection Pool — Level = ”ConnectionPool”
• Database Instance — Level = ”DbInstance”

Learn More

That’s a quick tour of what’s new in ODP.NET 23.26.2. For details, see the ODP.NET Developer’s Guide. Try these features in your next project and tell me what you think.

Coming Soon

These NuGet packages deliver an initial ODP.NET 23.26.2 feature set — but there’s more coming soon:

• Oracle Database Vector Store Connector (production): supports .NET vectors, Microsoft Agent Framework, and Semantic Kernel. Build and run AI vectors, agents, LLMs, and workflows using ODP.NET’s and Oracle AI Database’s native AI features seamlessly.
• SQL Script Execution (preview): execute SQL and PL/SQL scripts directly from files, making database changes easy to apply and automate in .NET.
• Oracle Deep Data Security Security for .NET apps: enforce fine-grained, database-level authorization for agentic AI, analytics, and .NET apps — applying controls based on user identity and runtime context to prevent unintended data exposure from prompt injection, excessive agency, and other risks.

I’ll cover these in upcoming posts. Stay tuned.

FAQ

What problem does end-to-end OpenTelemetry tracing solve?

It removes the need to manually line up separate client and database traces by automatically embedding database spans within ODP.NET traces for a unified, collector-friendly view.

How do Priority Transactions change blocking behavior?

If a lower-priority transaction blocks a higher-priority one, the database can roll back the lower-priority transaction (after a wait target), allowing the higher-priority transaction to proceed and commit.

What are the main security and operational enhancements in this release?

It introduces post-quantum cryptography algorithms, lets apps load certain wallets/certificates in memory (SSO/P12/PEM), enables TLS state transfer to reduce renegotiation overhead, and allows filtering ODP.NET metrics by level (AppDomain/ConnectionPool/DbInstance).