Oracle Audit Vault. Server Installation Guide Release for Linux x86 E September Beta Draft

Transcription

1 Oracle Audit Vault Server Installation Guide Release for Linux x86 E September 2008 Beta Draft

2 Oracle Audit Vault Server Installation Guide, Release for Linux x86 E Copyright 2007, 2008, Oracle. All rights reserved. Primary Author: Rod Ward and Prakash Jashnani Contributing Author: Owens, Janet Blowney Sumit Jeloka, Nilima Kapoor, Robert Chang, Tammy Bednar, K Karun, Deborah Contributor: Vipul Shah, Donna Keesling, Martin Widjaja, Trivikrama Samudrala, Sarma Namuduri, Luann Ho, Alan Galbreath, Valarie Moore The Programs (which include both the software and documentation) contain proprietary information; they are provided under a license agreement containing restrictions on use and disclosure and are also protected by copyright, patent, and other intellectual and industrial property laws. Reverse engineering, disassembly, or decompilation of the Programs, except to the extent required to obtain interoperability with other independently created software or as specified by law, is prohibited. The information contained in this document is subject to change without notice. If you find any problems in the documentation, please report them to us in writing. This document is not warranted to be error-free. Except as may be expressly permitted in your license agreement for these Programs, no part of these Programs may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose. If the Programs are delivered to the United States Government or anyone licensing or using the Programs on behalf of the United States Government, the following notice is applicable: U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the Programs, including documentation and technical data, shall be subject to the licensing restrictions set forth in the applicable Oracle license agreement, and, to the extent applicable, the additional rights set forth in FAR , Commercial Computer Software--Restricted Rights (June 1987). Oracle USA, Inc., 500 Oracle Parkway, Redwood City, CA The Programs are not intended for use in any nuclear, aviation, mass transit, medical, or other inherently dangerous applications. It shall be the licensee's responsibility to take all appropriate fail-safe, backup, redundancy and other measures to ensure the safe use of such applications if the Programs are used for such purposes, and we disclaim liability for any damages caused by such use of the Programs. Oracle, JD Edwards, PeopleSoft, and Siebel are registered trademarks of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners. The Programs may provide links to Web sites and access to content, products, and services from third parties. Oracle is not responsible for the availability of, or any content provided on, third-party Web sites. You bear all risks associated with the use of such content. If you choose to purchase any products or services from a third party, the relationship is directly between you and the third party. Oracle is not responsible for: (a) the quality of third-party products or services; or (b) fulfilling any of the terms of the agreement with the third party, including delivery of products or services and warranty obligations related to purchased products or services. Oracle is not responsible for any loss or damage of any sort that you may incur from dealing with any third party. Alpha and Beta Draft documentation are considered to be in prerelease status. This documentation is intended for demonstration and preliminary use only. We expect that you may encounter some errors, ranging from typographical errors to data inaccuracies. This documentation is subject to change without notice, and it may not be specific to the hardware on which you are using the software. Please be advised that prerelease documentation is not warranted in any manner, for any purpose, and we will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.

3 Contents Preface... vii Audience... Documentation Accessibility... Related Documents... Conventions... vii vii viii viii 1 Oracle Audit Vault Server Installation Overview 1.1 Deploying Oracle Audit Vault Server Oracle Audit Vault Installation Components Oracle Audit Vault Installation Methods Interactive Installation Methods Automated Installation Methods Using Response Files Audit Vault Server Installation Installation Considerations Hardware and Software Considerations Multiple Oracle Homes Oracle Audit Vault Server Preinstallation Requirements 2.1 Becoming Familiar with the Features of Oracle Audit Vault Logging In to the System as the root User Checking the Hardware Requirements Checking the Operating System Requirements Checking the Network Setup Configuring Name Resolution Installing on DHCP Computers Installing on Multi-homed Computers Installing on Computers with Multiple Aliases Creating the Required Operating System Groups and Users Creating the Oracle Inventory Group Creating the OSDBA Group Creating an OSOPER Group (Optional) Creating the Oracle Software Owner User Determining Whether an Oracle Software Owner User Exists Creating an Oracle Software Owner User Modifying an Oracle Software Owner User Beta Draft iii

4 2.6.5 Verifying That the User nobody Exists Checking the Kernel Parameters Identifying the Required Software Directories Oracle Base Directory Oracle Inventory Directory Oracle Home Directory Identifying or Creating an Oracle Base Directory Identifying an Existing Oracle Base Directory Creating an Oracle Base Directory Creating Directories for Oracle Audit Vault Database Files Setting the DISPLAY Environment Variable Installing the Oracle Audit Vault Server 3.1 Accessing the Server Installation Software Basic Installation Performing the Single Instance Server Installation Advanced Installation Prerequisite Information for Installing in an Oracle Real Application Clusters Environment Advanced Installation Installing Single Instance and Installing in an Oracle Real Application Clusters Environment Performing a Silent Installation Using a Response File Audit Vault Server Installation Details Basic and Advanced Installation Details Screens Audit Vault Name Oracle Audit Vault Home Oracle Audit Vault Server Accounts Advanced Server Installation: Database Vault User Credentials Screen Database Vault Owner and Database Vault Account Manager Accounts Database Vault Owner and Database Vault Account Manager Passwords Advanced Server Installation: Node Selection Screen Advanced Server Installation: Specify Database Storage Options Screen Advanced Server Installation: Specify Backup and Recovery Option Screen Advanced Server Installation: Specify Database Schema Passwords Screen Postinstallation Server Tasks Download Patches Download Critical Patch Updates Reset User Passwords Using SQL*Plus to Reset Passwords Enable or Disable Connections with the SYSDBA Privilege Run DVCA to Set Instance Parameters and Lock Out SYSDBA Sessions (Oracle RAC only) Download JDBC Driver Files for Microsoft SQL Server, Sybase ASE Database, and IBM DB2 UDB Connectivity Download SQL Server 2005 JDBC Driver for SQL Server Connectivity Download jconnect JDBC Driver for Sybase ASE Connectivity Download IBM DB2 JDBC Universal Driver for DB2 UDB Connectivity Log in to Oracle Audit Vault Console Next Steps to Perform as an Oracle Audit Vault Administrator iv Beta Draft

5 4 Upgrading Oracle Audit Vault Server 4.1 Back Up and Recovery of Audit Vault Server Upgrade Requirements Upgrade Procedure Performing a Silent Upgrade Installation Using a Response File Post Upgrade Information Removing the Oracle Audit Vault Server Software Index 5.1 Removing the Audit Vault Server Software Beta Draft v

6 List of Tables 2 1 Operating System, Kernel Version, and Packages Requirements Invalid Oracle Audit Vault Name and Oracle Audit Vault Account Characters Special Characters Allowed in the Oracle Audit Vault Home Name Valid Oracle Audit Vault Administrator and Auditor Password Characters vi Beta Draft

7 Preface Oracle Audit Vault Server Installation Guide for Linux x86 explains how to prepare for, install, and configure Oracle Audit Vault Server (Audit Vault Server). It provides specific instructions for the operating system and Oracle software technology components that the Audit Vault Server requires. Audience This document is intended for Oracle database administrator's (DBAs) and system administrators as well as those who are involved in the installation of Oracle Audit Vault and its related components. Documentation Accessibility Our goal is to make Oracle products, services, and supporting documentation accessible, with good usability, to the disabled community. To that end, our documentation includes features that make information available to users of assistive technology. This documentation is available in HTML format, and contains markup to facilitate access by the disabled community. Accessibility standards will continue to evolve over time, and Oracle is actively engaged with other market-leading technology vendors to address technical obstacles so that our documentation can be accessible to all of our customers. For more information, visit the Oracle Accessibility Program Web site at Accessibility of Code Examples in Documentation Screen readers may not always correctly read the code examples in this document. The conventions for writing code require that closing braces should appear on an otherwise empty line; however, some screen readers may not always read a line of text that consists solely of a bracket or brace. Accessibility of Links to External Web Sites in Documentation This documentation may contain links to Web sites of other companies or organizations that Oracle does not own or control. Oracle neither evaluates nor makes any representations regarding the accessibility of these Web sites. TTY Access to Oracle Support Services Oracle provides dedicated Text Telephone (TTY) access to Oracle Support Services within the United States of America 24 hours a day, 7 days a week. For TTY support, call Outside the United States, call Beta Draft vii

8 Related Documents Conventions For more information, see the following documents: Oracle Audit Vault Release Notes Oracle Audit Vault Collection Agent Installation Guide Oracle Audit Vault Licensing Information Oracle Audit Vault Administrator's Guide Oracle Audit Vault Auditor's Guide Oracle Database Oracle Clusterware and Oracle Real Application Clusters Installation Guide for Linux Oracle Database Oracle Clusterware and Oracle Real Application Clusters Administration and Deployment Guide Oracle Database Vault Installation Guide for Linux x86 Oracle Database Vault Administrator's Guide The following text conventions are used in this document: Convention boldface italic monospace Meaning Boldface type indicates graphical user interface elements associated with an action, or terms defined in text or the glossary. Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values. Monospace type indicates commands within a paragraph, URLs, code in examples, text that appears on the screen, or text that you enter. viii Beta Draft

9 1 1 Oracle Audit Vault Server Installation Overview Oracle Audit Vault is a powerful enterprisewide audit solution that efficiently consolidates, detects, monitors, alerts, and reports on audit data for security auditing and compliance. Oracle Audit Vault provides the ability to consolidate audit data and critical events into a centralized and secure audit warehouse. This chapter provides an overview of the Oracle Audit Vault Server (Audit Vault Server) installation process. This chapter includes the following sections: Deploying Oracle Audit Vault Server Oracle Audit Vault Installation Components Oracle Audit Vault Installation Methods Audit Vault Server Installation Installation Considerations 1.1 Deploying Oracle Audit Vault Server It is recommended that you install Audit Vault Server on its own host computer or a host that contains other repository databases such as Enterprise Manager Grid Control or the Oracle Recovery Manager (RMAN) repository database. This enables Oracle Audit Vault to have high availability to these other databases. For scalability, the Audit Vault Server can implement Real Applications Cluster (RAC) and Data Guard for disaster recovery. 1.2 Oracle Audit Vault Installation Components Oracle Audit Vault software installation consists of two parts: Audit Vault Server installation that can be either: Single Instance installation Clustered using an Oracle Real Application Clusters (Oracle RAC) installation Oracle Audit Vault collection agent installation (see Oracle Audit Vault Collection Agent Installation Guide) 1.3 Oracle Audit Vault Installation Methods You can choose different installation methods to install Audit Vault Server, as follows: Beta Draft Oracle Audit Vault Server Installation Overview 1-1

10 Audit Vault Server Installation Interactive Installation Methods Automated Installation Methods Using Response Files Interactive Installation Methods When you use the interactive method to install Oracle Audit Vault to perform a Basic, Advanced, or Upgrade installation, Oracle Universal Installer displays a series of screens that enable you to specify all of the required information to install the Oracle Audit Vault software Automated Installation Methods Using Response Files Oracle Audit Vault provides a response file template for Audit Vault Server (av.rsp) and one for an upgrade installation (upgrade_av.rsp). These response template files can be found in the <AV installer location>/response directory on the Audit Vault Server installation media. When you start Oracle Universal Installer and specify a response file, you can automate all of the Audit Vault Server installation. These automated installation methods are useful if you need to perform multiple installations on similarly configured systems or if the system where you want to install the software does not have X Window system software installed. For Audit Vault Server, Oracle Universal Installer can run in silent (noninteractive) mode. For silent mode, specify both the -silent and -responsefile options followed by the path of the response file on the command line when you invoke Oracle Universal Installer. For example:./runinstaller -silent -responsefile <Path of response file> Oracle Universal Installer runs in silent mode if you use a response file that specifies all required information. None of the Oracle Universal Installer screens are displayed, and all interaction (standard output and error messages) and installation logs appear on the command line. Prepare the response file by entering values for all parameters that are missing in the first part of the response file, then save the file. Do not edit any values in the second part of either response file. See Section 3.5 for information about performing an Audit Vault Server silent installation and Section 4.4 for information about performing a silent upgrade installation. Note: The basic installation is not supported in silent mode. Silent installation is only supported for the advanced installation. 1.4 Audit Vault Server Installation The Audit Vault Server installation consists of three options: Upgrade Existing Audit Vault Server Home detects upgradable Audit Vault Server homes on the system and enables the upgrade option to the current release. Perform an upgrade on the selected upgradable Audit Vault Server home detected on the system. Basic installation simplifies the installation process and prompts for a minimal set of inputs from the user to perform a full installation. An Oracle RAC 1-2 Oracle Audit Vault Server Installation Guide Beta Draft

11 Installation Considerations installation is not supported through this option; only a single instance installation is supported. Advanced installation offers the user more control and options for the installation process, including storage options and backup options. This option supports the installation of Audit Vault Server on a cluster and as a single instance. Communication at the management level between the Audit Vault Server and the Audit Vault collection agent can be secured after the installation is complete. This is done as part of the postinstallation configuration, in which SSL is configured for the mutual authentication between the Oracle Audit Vault management service on the server side and each collection agent over HTTPS. After you check the requirements described in Section 1.5, the general steps to install Audit Vault Server include these tasks: 1. Run Oracle Universal Installer to perform Audit Vault Server installation. 2. Run postinstallation and configuration tasks using AVCA. 1.5 Installation Considerations This section contains information that you should consider before deciding how to install this product. It includes contains the following topics: Hardware and Software Considerations Multiple Oracle Homes Hardware and Software Considerations The platform-specific hardware and software requirements included in this installation guide were current at the time this guide was published. However, because new platforms and operating system versions might be certified after this guide is published, review the certification matrix on the OracleMetaLink Web site for the most up-to-date list of certified hardware platforms and operating system versions. The OracleMetaLink Web site is available at If you do not have a current Oracle Support Services contract, then you can access the same information at Multiple Oracle Homes This product supports multiple Oracle homes. This means that you can install this release of the software more than once on the same system, in different Oracle home directories. See Section for more information. Beta Draft Oracle Audit Vault Server Installation Overview 1-3

12 Installation Considerations 1-4 Oracle Audit Vault Server Installation Guide Beta Draft

13 2 2 Oracle Audit Vault Server Preinstallation Requirements This chapter describes the following Oracle Audit Vault Server (Audit Vault Server) preinstallation requirements. This chapter includes the following sections: Becoming Familiar with the Features of Oracle Audit Vault Logging In to the System as the root User Checking the Hardware Requirements Checking the Operating System Requirements Checking the Network Setup Creating the Required Operating System Groups and Users Checking the Kernel Parameters Identifying the Required Software Directories Identifying or Creating an Oracle Base Directory Creating Directories for Oracle Audit Vault Database Files Setting the DISPLAY Environment Variable 2.1 Becoming Familiar with the Features of Oracle Audit Vault To plan the installation process, you must be familiar with the features of Oracle Audit Vault. Oracle Audit Vault Administrator's Guide discusses the basic features of Oracle Audit Vault. 2.2 Logging In to the System as the root User Before you install the Oracle software, you must complete several tasks (described in the sections that follow) as the root user. Log in to your system as the root user. 2.3 Checking the Hardware Requirements The system must meet the following minimum hardware requirements: At least 1024 MB of available physical memory (RAM) The following table gives the relationship between the available RAM and the required swap space: Beta Draft Oracle Audit Vault Server Preinstallation Requirements 2-1

14 Checking the Hardware Requirements Available RAM Between 1024 MB and 2048 MB Between 2049 MB and 8192 MB More than 8192 MB Swap Space Required 1.5 times the size of RAM Equal to the size of RAM 0.75 times the size of RAM Audit Vault Server installation disk space requirements 1.4 GB of disk space for the Audit Vault Server software files in the Oracle base directory 700 MB of additional disk space for the Audit Vault Server database files in the Oracle base directory. This is only if the database storage option is on the file system. For other storage options, such as Automatic Storage Management (ASM), the database files will be stored elsewhere. Also, this 700 MB of disk space is only the starting size. The Oracle Audit Vault administrator must take future growth of the database size into consideration, especially as the server collects more and more audit data. To ensure that the system meets these requirements, perform the following tasks: 1. To determine the physical RAM size, enter the following command: # grep MemTotal /proc/meminfo If the size of the physical RAM installed in the system is less than the required size, then you must install more memory before continuing. 2. To determine the size of the configured swap space, enter the following command: # grep SwapTotal /proc/meminfo If necessary, see your operating system documentation for information about how to configure additional swap space. 3. To determine the available RAM and swap space, enter the following command: # free Note: Oracle recommends that you take multiple readings for the available RAM and swap space before determining a value. This is because the available RAM and swap space keep changing depending on the user interactions with the computer. 4. To determine the amount of disk space available in the /tmp directory, enter the following command: # df -k /tmp If there is less than 400 MB of disk space available in the /tmp directory, then complete one of the following steps: Delete unnecessary files from the /tmp directory to meet the disk space requirement. Set the TEMP and TMPDIR environment variables when setting the environment of the oracle users. Extend the file system that contains the /tmp directory. If necessary, contact your system administrator for information about extending file systems. 2-2 Oracle Audit Vault Server Installation Guide Beta Draft

15 Checking the Operating System Requirements 5. To determine the amount of free disk space on the system, enter the following command: # df -k 6. To determine whether the system architecture can run the software, enter the following command: # grep "model name" /proc/cpuinfo Note: This command displays the processor type. Verify that the processor architecture matches the Oracle software release that you want to install. If you do not see the expected output, then you cannot install the software on this system. 2.4 Checking the Operating System Requirements Depending on the products that you intend to install, verify that the software is installed on the system listed in Table 2 1. The procedure following Table 2 1 describes how to verify whether these requirements are addressed. Note: Oracle Universal Installer checks your system to verify that it meets the listed requirements. To ensure that your system passes these checks, verify the requirements before you start Oracle Universal Installer. Note: The platform-specific hardware and software requirements included in this installation guide were current at the time this guide was published. However, because new platforms and operating system versions might be certified after this guide is published, review the certification matrix on the OracleMetaLink Web site for the most up-to-date list of certified hardware platforms and operating system versions. The OracleMetaLink Web site is available at If you do not have a current Oracle Support Services contract, then you can access the same information at Beta Draft Oracle Audit Vault Server Preinstallation Requirements 2-3

16 Checking the Operating System Requirements Table 2 1 Item Operating system Kernel version Operating System, Kernel Version, and Packages Requirements Requirement One of the following operating system versions: Oracle Enterprise Linux 4 Oracle Enterprise Linux 5 Red Hat Enterprise Linux AS/ES 3.0 (Update 3 or later) Red Hat Enterprise Linux AS/ES 4.0 Red Hat Enterprise Linux AS/ES 5.0 SUSE Linux Enterprise Server 9.0 SUSE Linux Enterprise Server 10.0 The operating system requirements are the same as those for Oracle Database 10g release 2. If Oracle Database 10g release 2 is installed, then your system automatically meets these requirements. The system must be running the following kernel version (or a later version): Red Hat Enterprise Linux 3.0: EL Note: This is the default kernel version. Red Hat Enterprise Linux 4.0, Oracle Enterprise Linux 4: EL Red Hat Enterprise Linux 5.0, Oracle Enterprise Linux 5: SUSE Linux Enterprise Server 9.0: SUSE Linux Enterprise Server 10.0: The kernel version requirements are the same as those for Oracle Database 10g release 2. If Oracle Database 10g release 2 is installed, then your system automatically meets the kernel version requirements. 2-4 Oracle Audit Vault Server Installation Guide Beta Draft

17 Checking the Operating System Requirements Table 2 1 Item Packages (Cont.) Operating System, Kernel Version, and Packages Requirements Requirement The following packages (or later versions) must be installed: Red Hat Enterprise Linux 3.0: make binutils-2.14 gcc glibc compat-db compat-gcc compat-gcc-c compat-libstdc compat-libstdc++-devel openmotif setarch libaio Red Hat Enterprise Linux 4.0, Oracle Enterprise Linux 4: binutils el4 compat-libstdc compat-db control-center gcc el4 gcc-c el4 glibc glibc-common gnome-libs libstdc libstdc++-devel make pdksh sysstat xscreensaver rhel4.2 setarch Red Hat Enterprise Linux 5.0, Oracle Enterprise Linux 5: binutils-2.17 compat-libstdc compat-db control-center gcc-4.1 gcc-c el4 glibc glibc-common gnome-libs libstdc libstdc++-devel make-3.81 pdksh sysstat xscreensaver rhel4.2 setarch libaio Beta Draft Oracle Audit Vault Server Preinstallation Requirements 2-5

18 Checking the Operating System Requirements Table 2 1 Item Packages Packages (Cont.) Operating System, Kernel Version, and Packages Requirements Requirement The following packages (or later versions) must be installed: SUSE Linux Enterprise Server 9: binutils gcc gcc-c glibc gnome-libs libstdc libstdc++-devel make pdksh sysstat xscreensaver SUSE Linux Enterprise Server 10: binutils compat-libstdc gcc glibc glibc-devel ksh-93r-12.9 libaio libaio-devel libelf libgcc libstdc libstdc++-devel make-3.80 sysstat unixodbc unixodbc-devel The package requirements are the same as those for Oracle Database 10g release 2. If Oracle Database 10g release 2 is installed, then your system automatically meets the package requirements. To ensure that the system meets these requirements, perform the following tasks: 1. To determine which distribution and version of Linux is installed, enter the following command: # cat /etc/issue Note: Only the distributions and versions listed in the previous table are supported. Do not install the software on other versions of Linux. 2. To determine whether the required kernel is installed, enter the following command: # uname -r The following is sample output obtained by running this command on a Red Hat Enterprise Linux 3.0 system: 2-6 Oracle Audit Vault Server Installation Guide Beta Draft

19 Checking the Network Setup EL In this example, the output shows the kernel version (2.4.21) and errata level (15.EL) on the system. If the kernel version does not meet the requirement specified in Table 2 1, then contact your operating system vendor for information about obtaining and installing kernel updates. 3. To determine whether the required packages are installed, enter commands similar to the following: # rpm -q package_name If a package is not installed, then install it from your Linux distribution media or download the required package version from the Web site of your Linux vendor. 2.5 Checking the Network Setup Typically, the computer on which you want to install Oracle Audit Vault is connected to the network, has local storage to contain the Oracle Audit Vault installation, has a display monitor, and has a CD-ROM or DVD drive. This section describes how to install Oracle Audit Vault on computers that do not meet the typical scenario. It covers the following cases: Configuring Name Resolution Installing on DHCP Computers Installing on Multi-homed Computers Installing on Computers with Multiple Aliases Configuring Name Resolution When you run Oracle Universal Installer, an error might occur if name resolution is not set up. To avoid this error, before you begin installation, you must ensure that host names are resolved only through the /etc/hosts file. To ensure that host names are resolved only through the /etc/hosts file: 1. Verify that the /etc/hosts file is used for name resolution. You can do this by checking the hosts file entry in the nsswitch.conf file as follows: # cat /etc/nsswitch.conf grep hosts The output of this command should contain an entry for files. 2. Verify that the host name has been set by using the hostname command as follows: # hostname The output of this command should be similar to the following: myhost.mycomputer.com 3. Verify that the domain name has not been set dynamically by using the domainname command as follows: # domainname Beta Draft Oracle Audit Vault Server Preinstallation Requirements 2-7

20 Checking the Network Setup This command should not return any results. 4. Verify that the hosts file contains the fully qualified host name by using the following command: # cat /etc/hosts grep `eval hostname` The output of this command should contain an entry for the fully qualified host name and for the localhost. For example: myhost.us.mycompany.com myhost localhost localhost.localdomain If the hosts file does not contain the fully qualified host name, then open the file and make the required changes in it Installing on DHCP Computers Dynamic Host Configuration Protocol (DHCP) assigns dynamic IP addresses on a network. Dynamic addressing enables a computer to have a different IP address each time it connects to the network. In some cases, the IP address can change while the computer is still connected. You can have a mixture of static and dynamic IP addressing in a DHCP system. In a DHCP setup, the software tracks IP addresses, which simplifies network administration. This lets you add a new computer to the network without having to manually assign that computer a unique IP address. Oracle Audit Vault cannot be installed in an environment where the IP addresses of the Audit Vault Server or the Audit Vault collection agent can change. If your environment uses DHCP, ensure that all Oracle Audit Vault systems use static IP addresses Installing on Multi-homed Computers You can install Oracle Audit Vault on a multi-homed computer. A multiple-homed computer is associated with multiple IP addresses. This is typically achieved by having multiple network cards on the computer. Each IP address is associated with a host name. In addition, you can set up aliases for the host name. By default, Oracle Universal Installer uses the ORACLE_HOSTNAME environment variable setting to find the host name. If the ORACLE_HOSTNAME environment variable is not set and you are installing Oracle Audit Vault on a computer that has multiple network cards, then Oracle Universal Installer determines the host name by using the first entry in the /etc/hosts file. Clients must be able to access the computer either by using this host name or by using aliases for this host name. To verify this, ping the host name from the client computers using the short name (host name only) and the full name (host name and domain name). Both tests must be successful. Setting the ORACLE_HOSTNAME Environment Variable Use the following procedure to set the ORACLE_HOSTNAME environment variable. For example, if the fully qualified host name is somehost.us.acme.com, then enter one of the following commands: Bourne, Bash, or Korn shell: 2-8 Oracle Audit Vault Server Installation Guide Beta Draft

21 Creating the Required Operating System Groups and Users $ ORACLE_HOSTNAME=somehost.us.acme.com $ export ORACLE_HOSTNAME C shell: % setenv ORACLE_HOSTNAME somehost.us.acme.com Installing on Computers with Multiple Aliases A computer with multiple aliases is registered with the naming service under a single IP address. The naming service resolves all of those aliases to the same computer. Before installing Oracle Audit Vault on a computer with multiple aliases, set the ORACLE_HOSTNAME environment variable to the computer whose host name you want to use. 2.6 Creating the Required Operating System Groups and Users Depending on whether or not this is the first time Oracle software is being installed on this system and on the products that you are installing, you may need to create several operating system groups and users. The following operating system groups and user are required if you are installing Oracle Audit Vault: The OSDBA group (dba) You must create this group the first time you install Oracle Audit Vault software on the system. It identifies operating system user accounts that have database administrative privileges (the SYSDBA privilege). The default name for this group is dba. The OSOPER group (oper) This is an optional group. Create this group if you want a separate group of operating system users to have a limited set of administrative privileges (the SYSOPER privilege). By default, members of the OSDBA group also have the SYSOPER privilege. An unprivileged user Verify that the unprivileged user nobody exists on the system. The nobody user must own the external jobs (extjob) executable after the installation. The following operating system group and user are required for all installations: The Oracle Inventory group (oinstall) You must create this group the first time you install Oracle software on the system. The usual name chosen for this group is oinstall. This group owns the Oracle inventory, which is a catalog of all Oracle software installed on the system. Note: If Oracle software is already installed on the system, then the existing Oracle Inventory group must be the primary group of the operating system user that you use to install new Oracle software. The following topics describe how to identify an existing Oracle Inventory group. The Oracle software owner user (typically, oracle) Beta Draft Oracle Audit Vault Server Preinstallation Requirements 2-9

22 Creating the Required Operating System Groups and Users You must create this user the first time you install Oracle software on the system. This user owns all software installed during the installation. This user must have the Oracle Inventory group as its primary group. It must also have the OSDBA and OSOPER groups as secondary groups. Note: In Oracle documentation, this user is referred to as the oracle user. A single Oracle Inventory group is required for all installations of Oracle software on the system. After the first installation of Oracle software, you must use the same Oracle Inventory group for all subsequent Oracle software installations on that system. However, you can choose to create different Oracle software owner users, OSDBA groups, and OSOPER groups (other than oracle, dba, and oper) for separate installations. By using different groups for different installations, members of these different groups have DBA privileges only on the associated databases, rather than on all databases on the system. See Also: Oracle Database Administrator's Guide for more information about the OSDBA group and the SYSDBA and SYSOPER privileges Note: The following topics describe how to create local users and groups. As an alternative to creating local users and groups, you could create the appropriate users and groups in a directory service, for example, Network Information Services (NIS). For information about using directory services, contact your system administrator or see your operating system documentation. The following topics describe how to create the required operating system users and groups: Creating the Oracle Inventory Group Creating the OSDBA Group Creating an OSOPER Group (Optional) Creating the Oracle Software Owner User Creating the Oracle Inventory Group You must create the Oracle Inventory group if it does not already exist. The following topics describe how to determine the Oracle Inventory group name, if it exists, and how to create it if necessary. Determining Whether the Oracle Inventory Group Exists When you install Oracle software on the system for the first time, Oracle Universal Installer creates the orainst.loc file. This file identifies the name of the Oracle Inventory group and the path of the Oracle Inventory directory. To determine whether the Oracle Inventory group exists, enter the following command: # more /etc/orainst.loc 2-10 Oracle Audit Vault Server Installation Guide Beta Draft

23 Creating the Required Operating System Groups and Users If the output of this command shows the oinstall group name, then the group already exists. If the orainst.loc file exists, then the output from this command is similar to the following: inventory_loc=/u01/app/oracle/orainventory inst_group=oinstall The inst_group parameter shows the name of the Oracle Inventory group, oinstall. Creating the Oracle Inventory Group If the orainst.loc file does not exist, then create the Oracle Inventory group by entering the following command: # /usr/sbin/groupadd oinstall Creating the OSDBA Group You must create an OSDBA group in the following circumstances: An OSDBA group does not exist, for example, if this is the first installation of Oracle software on the system An OSDBA group exists, but you want to give a different group of operating system users database administrative privileges in a new Oracle installation If the OSDBA group does not exist or if you need a new OSDBA group, then create it as follows. In the following command, use the group name dba unless a group with that name already exists. # /usr/sbin/groupadd dba Creating an OSOPER Group (Optional) Create an OSOPER group only if you want to identify a group of operating system users with a limited set of database administrative privileges (SYSOPER operator privileges). For most installations, it is sufficient to create only the OSDBA group. If you want to use an OSOPER group, then you must create it in the following circumstances: If an OSOPER group does not exist, for example, if this is the first installation of Oracle software on the system If an OSOPER group exists, but you want to give a different group of operating system users database operator privileges in a new Oracle installation If you need a new OSOPER group, then create it as follows. In the following command, use the group name oper unless a group with that name already exists. # /usr/sbin/groupadd oper Creating the Oracle Software Owner User You must create an Oracle software owner user in the following circumstances: If an Oracle software owner user does not exist, for example, if this is the first installation of Oracle software on the system Beta Draft Oracle Audit Vault Server Preinstallation Requirements 2-11

24 Creating the Required Operating System Groups and Users If an Oracle software owner user exists, but you want to use a different operating system user, with a different group membership, to give database administrative privileges to those groups in a new Oracle installation Determining Whether an Oracle Software Owner User Exists To determine whether an Oracle software owner user named oracle exists, enter the following command: # id oracle If the oracle user exists, then the output from this command is similar to the following: uid=440(oracle) gid=200(oinstall) groups=201(dba),202(oper) If the user exists, then determine whether you want to use the existing user or create another Oracle software owner (oracle) user. If you want to use the existing user, then ensure that the primary group of the user is the Oracle Inventory group and that it is a member of the appropriate OSDBA and OSOPER groups. Note: If necessary, contact your system administrator before using or modifying an existing user. See one of the following sections for more information: To modify an existing Oracle software owner user, see Section To create an Oracle software owner user, see the following section Creating an Oracle Software Owner User If the Oracle software owner user does not exist or if you need a new Oracle software owner user, then create it as follows. In the following procedure, use the user name oracle unless a user with that name already exists. 1. To create the oracle user, enter a command similar to the following: # /usr/sbin/useradd -g oinstall -G dba[,oper] oracle In this command: The -g option specifies the primary group, which must be the Oracle Inventory group, for example, oinstall. The -G option specifies the secondary groups, which must include the OSDBA group and, if required, the OSOPER group (for example, dba or dba, oper). 2. Set the password of the oracle user: # passwd oracle See Section to continue Modifying an Oracle Software Owner User If the oracle user exists, but its primary group is not oinstall or it is not a member of the appropriate OSDBA or OSOPER groups, then enter a command similar to the following to modify it. Specify the primary group using the -g option and any required secondary group using the -G option: # /usr/sbin/usermod -g oinstall -G dba[,oper] oracle 2-12 Oracle Audit Vault Server Installation Guide Beta Draft

25 Checking the Kernel Parameters Verifying That the User nobody Exists Before installing the software, perform the following procedure to verify that the nobody user exists on the system: 1. To determine whether the user exists, enter the following command: # id nobody If this command displays information about the nobody user, then you do not have to create that user. 2. If the nobody user does not exist, then enter the following command to create it: # /usr/sbin/useradd nobody 2.7 Checking the Kernel Parameters Note: The kernel parameter and shell limit values shown in the following section are recommended minimum values only or the value checked at the time of the installation. For production database systems, Oracle recommends that you tune these values to optimize the performance of the system. See your operating system documentation for more information about tuning kernel parameters. Verify that the kernel parameters shown in the following table are set to values greater than or equal to the recommended minimum value shown or the value checked at the time of the installation. Parameter Value File semmsl semmns semopm semmni /proc/sys/kernel/sem shmall /proc/sys/kernel/shmall shmmax Half the size of physical memory (in bytes) /proc/sys/kernel/shmmax shmmni 4096 /proc/sys/kernel/shmmni file-max /proc/sys/fs/file-max ip_local_port_range Minimum:1024 Maximum: /proc/sys/net/ipv4/ip_local_port_range rmem_default /proc/sys/net/core/rmem_default rmem_max /proc/sys/net/core/rmem_max wmem_default /proc/sys/net/core/wmem_default wmem_max /proc/sys/net/core/wmem_max Beta Draft Oracle Audit Vault Server Preinstallation Requirements 2-13

26 Checking the Kernel Parameters Note: If the current value for any parameter is higher than the value listed in this table, then do not change the value of that parameter. To view the current values specified for these kernel parameters, and to change them if necessary: 1. Enter the commands shown in the following table to view the current values of the kernel parameters: Note: You will need root privileges to run the commands. Make a note of the current parameter values and identify any values that you must change. Parameter semmsl, semmns, semopm, and semmni shmall, shmmax, and shmmni file-max ip_local_port_range rmem_default rmem_max wmem_default wmem_max Command # /sbin/sysctl -a grep sem This command displays the value of the semaphore parameters in the order listed. # /sbin/sysctl -a grep shm This command displays the details of the shared memory segment sizes. # /sbin/sysctl -a grep file-max This command displays the maximum number of file handles. # /sbin/sysctl -a grep ip_local_port_range This command displays a range of port numbers. # /sbin/sysctl -a grep rmem_default # /sbin/sysctl -a grep rmem_max # /sbin/sysctl -a grep wmem_default # /sbin/sysctl -a grep wmem_max 2. If the value of any kernel parameter is different from the recommended minimum value, then complete the following procedure: Using any text editor, create or edit the /etc/sysctl.conf file, and add or edit lines similar to the following: Note: Include lines only for the kernel parameter values that you want to change. For the semaphore parameters (kernel.sem), you must specify all four values. However, if any of the current values are larger than the recommended value, then specify the larger value. You should set the value of kernel.shmmax to ; however, Oracle recommends that you set the value to 2 GB, as shown. kernel.shmall = Oracle Audit Vault Server Installation Guide Beta Draft

27 Checking the Kernel Parameters kernel.shmmax = kernel.shmmni = 4096 kernel.sem = fs.file-max = net.ipv4.ip_local_port_range = net.core.rmem_default = net.core.rmem_max = net.core.wmem_default = net.core.wmem_max = If you specify the values in the /etc/sysctl.conf file, they persist when you restart the system. On SUSE systems only, enter the following command to ensure that the system reads the /etc/sysctl.conf file when it restarts: # /sbin/chkconfig boot.sysctl on Setting Shell Limits for the Oracle User To improve the performance of the software on Linux systems, you must increase the following shell limits for the oracle user: Shell Limit Item in limits.conf Hard Limit Maximum number of open file descriptors nofile Maximum number of processes available to a single user nproc To increase the shell limits: 1. Add the following lines to the /etc/security/limits.conf file: oracle soft nproc 2047 oracle hard nproc oracle soft nofile 1024 oracle hard nofile Add or edit the following line in the /etc/pam.d/login file, if it does not already exist: session required /lib/security/pam_limits.so 3. Depending on the default shell of the oracle user, make the following changes to the default shell startup file: For a Bourne, Bash, or Korn shell, add the following lines to the /etc/profile file (or the /etc/profile.local file on SUSE systems): if [ $USER = "oracle" ]; then if [ $SHELL = "/bin/ksh" ]; then ulimit -p ulimit -n else ulimit -u n fi fi For a C shell (csh or tcsh), add the following lines to the /etc/csh.login file (or the /etc/csh.login.local file on SUSE systems): Beta Draft Oracle Audit Vault Server Preinstallation Requirements 2-15

28 Identifying the Required Software Directories if ( $USER == "oracle" ) then limit maxproc limit descriptors endif 2.8 Identifying the Required Software Directories You must identify or create the following directories for the Oracle software: Oracle Base Directory Oracle Inventory Directory Oracle Home Directory Oracle Base Directory The Oracle base directory is a top-level directory for Oracle software installations. On Linux systems, the Optimal Flexible Architecture (OFA) guidelines recommend that you use a path similar to the following for the Oracle base directory: /mount_point/app/oracle_sw_owner In this example: mount_point is the mount point directory for the file system that will contain the Oracle software. The examples in this guide use /u01 for the mount point directory. However, you could choose another mount point directory, such as /oracle or /opt/oracle. oracle_sw_owner is the operating system user name of the Oracle software owner, for example, oracle. You can use the same Oracle base directory for more than one installation or you can create separate Oracle base directories for different installations. If different operating system users install Oracle software on the same system, then each user must create a separate Oracle base directory. The following example Oracle base directories could all exist on the same system: /u01/app/oracle /u01/app/orauser /opt/oracle/app/oracle The following topics describe how to identify existing Oracle base directories that might be suitable for your installation and how to create an Oracle base directory if necessary. Regardless of whether you create an Oracle base directory or decide to use an existing one, you must set the ORACLE_BASE environment variable to specify the full path to this directory Oracle Inventory Directory The Oracle Inventory directory (orainventory) stores an inventory of all software installed on the system. It is required by, and shared by, all Oracle software installations on a single system. The first time you install Oracle software on a system, Oracle Universal Installer prompts you to specify the path to this directory. Oracle recommends that you choose the following path: 2-16 Oracle Audit Vault Server Installation Guide Beta Draft