Ralf Durben Business Unit Datenbank. Oracle Corporation

Transcription

1 Ralf Durben Business Unit Datenbank Oracle Corporation

2 Realize Immediate Value Grid Control Management of all the Oracle Grid components Centrally manage entire enterprise Out-of-box management for all Oracle products Product Controls Fully functional standalone management Out-of-box with each product

3

4 g Zero-implementation, Zero time-to-value Access by Anybody, Anywhere Open Repository Schema Easy extensibility and customization Support of Standards Scalability, robustness and self-maintenance

5 HTTP/S Manage from Anywhere HTML Console HTTP/S Mobile Device HTTP/S Firewall Portals HTTP/S Open Repository

6 Installed in a private oracle home via Regular install off a CD/Stage Download from central Management Server Controlled by: emctl start stop status agent Typically started at bootup time By default occupies port 1813 (http/s)

7 (Continued) Runtime consists of: Persistent emagent process Periodic, short-lived processes (due to OSCmd fetchlet) Lightweight Watchdog process that monitors and corrects

8 From OMS To OMS Receive Commands: Config changes, Realtime Metric Values RemoreOp Submission Upload Data & Heartbeating Scheduler Target Inv. State Mgr Self Monitor Metadata Mgr Agent Services OS Cmd SQL SNMP HTTP Fetchlet Engine

9 Installed in private oracle home along with all its dependencies Controlled via: emctl start stop status oms Runtime consists of: Apache Server Oracle s J2EE Container (OC4J) with EM App Lightweight Watchdog process that monitors and corrects

10 Console Access Console User Interface (JSPs / Servlets) Notification DispatcherJob Dispatcher Self Monitor Data Loader To Repository Agent Client Layer: Configuration changes Data and Heartbeat Receiver Real time metrics Remote Ops submission To Agent From Agent

11 Installed within an Oracle database For large scale, it should be a dedicated database Consists of data storage structures plus pl/sql code that executes on demand or on schedule Performs the following operations: Historical data summarization and purging Availability calculations Notification queuing and dispatching Job scheduling

12 net - ASO https EM Repository Browser Net - ASO OMS icmp https agent agent Managed Target Managed Target

13 Extensibility

14 EM Black Box 3. Extend Console UI 3 2. Build custom UI s and Report through Repository Access 2 Active Management Repository 1. Define and instrument target metrics Agent 1 Agent Agent

15 Extend EM to mange to custom applications Add new managed target types Ex: 3rd party Application management Add metrics to existing target types Ex: Site-specific host monitoring Extend EM for comprehensive management Custom reporting based on EM Repository data Ex: Service Level Reporting Custom job system Ex: Scriptable EM commands via the CLI Integrate EM with 3rd party management products Custom alert notification methods Ex: Link to trouble-ticketing system Customize GUI for existing target types Ex: Link in-context to 3rd party tools

16 User Access

17 User Security The breadth of management tasks available in Enterprise Manager depends on the privileges and roles assigned to the administrators.

18 Default Users: SYSMAN - is created by default during the installation of Oracle Enterprise Manager. The SYSMAN Super Administrator then creates other administrator accounts for daily administration work. The SYSMAN account should only be used to perform infrequent system wide, global configuration tasks. SYS - database users defined in the Management Repository after install SYSTEM - database users defined in the Management Repository after install

19 By default during the installation of Oracle Enterprise Manager, one Super Administrator is created with the username of SYSMAN. A Super Administrator has the ability to perform all of the following tasks: Ability to create, modify and delete any Enterprise Manager administrator. Ability to create any role in the system. Ability to perform any action on any target in the system. Ability to see all areas of the Management System primary tab.

20 System Privileges - allow a user to perform system wide operations within Enterprise Manager 10g Grid Control. VIEW ANY TARGET ADD ANY TARGET USE ANY BEACON MONITOR ENTERPRISE MANAGER Target Privileges - allow a user to perform operations on a specific target within Enterprise Manager 10g Grid Control. VIEW - Allows the administrator to view properties, inventory and monitor information about a target. OPERATOR - Allows the administrator to perform Startup, Shutdown, and Edit target properties operations on a target. FULL - Implicitly grants all the target privileges and allows the administrator to 1) Delete a targetand 2) Configure credentials for maintenance operations of a target ADD TARGET IN GROUP - Allows the administrator to add a target in a specific group and to grant privileges on a group. The privileges are propagated. MANAGE TARGET GROUP - Allows the administrator to add a target in a specific target group or delete a target from a specific target group.

21 EM2Go

22 EM2Go EM 10g To facilitate wireless access to performance and diagnostics information To enable a DBA to perform a corrective action from a wireless device on occurrence of an event. Perform basic administration tasks from a wireless device.

23

24

25

26 Downloadable agent installs Installs from central OMS site containing agent binaries on all ports Uses scripted pull install via OUI in silent mode Script can be wrapped to automate delivery to multiple nodes

27 Goal: 2000 hosts, 100 concurrent users Deployment Suggestion: 3 OMS Lintel boxes (Dell 1650) behind an SLB 2 Repository Lintel boxes (Dell 2650) running RAC Fast Disk subsystem, striped, mirrored (NetApps) DR solution based on physical standby database Total hardware cost: Less than $50K

28 Installation of EM10g Agent Automated using EM9i Job System Repository Migration captures EM9i Information: Administrators Preferred Credentials Roles Groups Hosts Databases Listeners EM9i and EM10g can be run in tandem Migration can be implemented incrementally Simplifies transition to the EM10g Grid Control Framework

29 Existing EM9i Environment Enterprise Manager 9i

30 Step One Install EM10g HTML Console Enterprise Manager 9i Enterprise Manager 10.1

31 Step Two Install EM10.1 Management Agent HTML Console Enterprise Manager 9i Enterprise Manager 10.1

32 Step Three Migrate Repository Data HTML Console Enterprise Manager 9i Enterprise Manager 10.1

33 Step Four Customize Metric Thresholds HTML Console Enterprise Manager 9i Enterprise Manager 10.1

34 System Monitoring

35 Applications Monitoring of Oracle Eco-system Complements ASLM for end-to-end monitoring Critical performance rollups Need to know management Application availability Homogenous Logical Sets

36 Monitor from anywhere via HTML-based Console Immediate Out-of-Box value: Real time monitoring Predefined metrics with Oracle-recommended defaults Historical collections for trend analysis Out-of-box notifications for critical alerts Enhanced Diagnostics Alerts shown in context of metric history Can compare metrics across targets for problem isolation

37 Enhanced Availability monitoring Breakdown of availability states over past day, week, month Blackouts for scheduled maintenance periods Can use EM baselines as aid to thresholding EM calculates thresholds based on deviations from past target performance Notifications Supports: , OS script, PL/SQL script, SNMP traps message has context-sensitive link to metric details in EM Console User Defined Metrics

38 User-defined monitoring policies (templates) Enhanced real-time graphs Availability enhancements Allow users to specify window for SLA calculations Notification enhancements: Customize messages Repeat notifications / Notification Escalations Integration with 3rd party management vendors

39 Job System

40 Basic job system functionality Support group operations

41 Job System EM 10g Distributed architecture Execute simple or complex tasks across 100 s of systems Easy to use and scalable Pre-packaged jobs Backup, export/import, patch, clone Ad hoc jobs Custom Host or SQL scripts Support for Group targets

42 Job System EM 10g Operational control Use of preferred credentials Stop / Retry / Resume & Suspend Simple purge policy Job Access privileges for cooperative management Job Library

43 Notification support User-defined multi-task jobs across different hosts Support dependencies between tasks on diff. targets/hosts Definer s rights jobs with new Execute privilege New job tasks (e.g. ias jobs) User-defined target properties as job parameters Abort job Enhanced scheduling Business calendars, run job on machine idle time, run on event, etc Enhanced load-balancing for jobs running in clusters/groups Job SDK

44 Configuration Management Policy Management

45 How many instances need to have a given patch applied? Is my O/S at the right patch level? Complete inventory of all Oracle software Versions Patch levels Configuration details for all Oracle products Related software and hardware configuration details

46 When things stop working, the first thing we do is try to figure out what has changed CalISO DBA Tracking changes Comparing and validating configurations Searching across enterprise Understanding product and feature usage

47 Our administrators spend about 25% of their time on installs and cloning -Verizon Information Services DBA Reduce manual labor in software life-cycle From hours to minutes Automate mass provisioning of reference systems Intelligent Cloning makes context-specific adjustments DB: home, host name, listener ias: IP address, host name, web listener 1 Select Software (and Instances) to Clone 2 Clone to Selected Targets 3 Update Inventory

48 Cloning an Entire Database RMAN-based Clone Library Online (w/ Archivelog mode) Scheduled as EM Job Data+Schema Cloning DBLINK-based Schema and data (subset) cloning Version and platform independent Cloning Wizard

49 Slammer virus exploited known security flaw to which patch was available 6 months prior to attack Real-time discovery of new patches Security patch rapid deployment dramatically reduces vulnerabilities Automated staging and application From hours to minutes 2 Determine Applicability 3 Apply Patch 1 Patch Published 4 Update Inventory

50 Automatic tracking by EM of critical bug advisories on MetaLink Daily inspection of all installations and flagging of violators In-context launch of patch wizard to deploy and apply appropriate patches

51

52 Policy Out-of-box policy definition Identify security vulnerabilities Missing patches Access vulnerabilities Open ports Configuration best practices Search enterprise for policy violations Standardize across systems

53 All Oracle Software 1. Security alerts 2. Critical patches Host 1. Detect open ports 2. Detect insecure services Application Server 1. HTTPD has minimal privileges 2. Use HTTP/S 3. Apache logging should be on 4. Demo applications disabled 5. Disable default banner page 6. Disable access to unused directories 7. Disable directory indexing 8. Forbid access to certain packages 9. Disable packages not used by DAD owner 10. Remove unused DAD configurations 11. Redirect _pages directory 12. Password complexity enabled 13. Use HTTP/S Database Services 1. Enable listener logging 2. Password-protect listeners 3. Disable direct listener administration 4. Disallow remote OS roles and authentication 5. Disallow use of remote password file 6. Restrict access to external procedure service Database User Privileges 1. Disable install and demo accounts 2. Disallow default user/password 3. PUBLIC has execute System privilege 4. PUBLIC has execute Object privilege 5. PUBLIC has execute UTL_FILE privilege 6. PUBLIC has execute UTL_SMTP privilege 7. PUBLIC has execute UTL_HTTP privilege 8. PUBLIC has execute UTL_TCP privilege 9. PUBLIC has execute DBMS_RANDOM 10. Password complexity 11. Restrict number of failed login attempts 12. Authentication protocol fallback 13. Connect and Resource grants

54 1. Insufficient Number of Control Files 11. Not Using Locally Managed Tablespaces 2. Insufficient Redo Log Size 12. SYSTEM TS Contains Non-System Data Seg 3. Insufficient Number of Redo Logs 13. Users with Permanent TS as Temporary TS 4. Use of Unlimited Autoextension 14. Insufficient Recovery Area Size 5. Use of Non-Standard Init. Parameters 15. Force Logging Disabled 6. Recovery Area Location Not Set 16. Not Using Spfile 7. Autobackup of Control File is not Enabled 17. Rollback in SYSTEM Tablespace 8. SYSTEM TS Used as User Default TS 18. Not Using Undo Space Management 9. Segment with Extent Growth Policy Violation 19. Non-uniform Default Extent Size 10.Tablespace Containing Mixed Segment Types

55 Deployments Summary Critical Patch Advisory Patching Searching Host and DB Comparison Policy Management Cloning DB Control Inherently only one deployment, thus not applicable Yes Yes Not Available Not applicable as there s only one host and one DB Yes Yes within same host Grid Control Yes Yes Yes Yes Yes Yes Yes

56 Application Service Level Management

57 Model End-User Communities Web Application Availability and Performance may vary from location to location

58 Approach Business transaction monitoring Preempt problems with proactive monitoring Monitoring of real end-user experience Complemented by traditional EM system monitoring