What problem Exadata Exascale solves

Classic Exadata storage is tied to a cluster. ASM runs on the database servers, owns the disk groups and knows where every extent lives. The model is fast and proven, but it has costs:

• Storage is carved per cluster. Space you gave to one VM cluster’s disk groups is hard to hand to another.
• Thin clones need a read-only test master. You refresh the master, then rebuild the clones.
• The entry point is a whole rack, or at least a dedicated slice of one.

Exascale moves storage management from the database servers to the storage servers and turns the storage grid into a shared, multi-tenant pool. Smart Scan, RDMA, flash cache, XRMEM and storage indexes all stay.

The building blocks

Four terms replace most of what you know from ASM.

• Pool disk. A partition of an Exadata cell disk. Each pool disk has a media type: HC (high capacity HDD), EF (extreme flash) or XT (the extended HDD tier on X11M).
• Storage pool. A set of pool disks of the same media type, spread across storage servers. A cluster needs at least one. You grow a pool by resizing pool disks, adding pool disks or adding storage servers.
• Vault. The logical container your database uses, and the closest thing to an ASM disk group. A vault takes space from storage pools and sets limits for space, IOPS, flash cache and XRMEM. It also has its own access controls, so it works as a security boundary. You reference it with an @ prefix.
• File and extent. Every file is split into 8 MB extents, mirrored and striped across all the storage behind the vault.

ALTER SYSTEM SET db_create_file_dest = '@PRODVAULT' SCOPE=BOTH;

Where redundancy lives now

Redundancy and content type belong to the file, and that took me a moment to accept after years of NORMAL and HIGH disk groups. Each file type has a template with media type, redundancy and content type (DATA or RECO). The database tells Exascale what kind of file it’s creating, and Exascale applies the matching template. You don’t need separate vaults for data and recovery files. Exascale still keeps data and recovery extents on different disks, and it never puts a mirror on the same storage server as its primary.

How a read or write travels

Exascale keeps an extent map that records where the primary and mirror copies of each file extent live. Every database server and every instance caches that map. When the database needs a block, it looks up the extent in its local cache and sends the I/O over RDMA to the storage server that holds it, with no broker in between.

Management goes a different way. Exascale RESTful Services (ERS) is the endpoint for every management operation, such as creating a vault, changing a quota or taking a snapshot. ERS never handles file I/O.

If the map is stale, for example after you add a storage server, the storage server rejects the I/O. The client refreshes its map and retries, and the database carries on.

Snapshots and thin clones without a test master

On classic Exadata, sparse clones depend on a read-only parent. Exascale uses redirect-on-write.

With copy-on-write, the first change to a block forces a copy of the original before the write, which puts an extra read and an extra write on the hot path. With redirect-on-write, the new version goes to a new location and the clone’s metadata points to it. Unchanged blocks stay shared with the parent.

So you can create a thin clone of a live read/write database or PDB, or of an existing snapshot, and there’s no test master to maintain. Clones can be thin or full copies. For dev and test, this is the feature I’d show a customer first.

Thin clone SQL on Exadata Exascale

The SQL is the PDB snapshot copy syntax you may already know. When the PDB’s files live in an Exascale vault, the database uses native Exascale cloning for it, so the clone is thin, sits in the same vault as the source and is created almost instantly whatever the size of the data files.

-- thin clone of a running PDB
CREATE PLUGGABLE DATABASE devpdb FROM prodpdb SNAPSHOT COPY;
ALTER PLUGGABLE DATABASE devpdb OPEN INSTANCES=ALL;

-- read-only point-in-time snapshot, and a clone made from it later
ALTER PLUGGABLE DATABASE prodpdb SNAPSHOT prod_0800;
CREATE PLUGGABLE DATABASE qapdb FROM prodpdb USING SNAPSHOT prod_0800 SNAPSHOT COPY;

Leave out SNAPSHOT COPY and you get a full, block-for-block copy.

One catch if the source CDB has a Data Guard standby: the standby gets a full copy of the clone’s data files, not a thin one. If the clone is only for dev or test, add STANDBYS=NONE so it isn’t created on the standby.

The Exadata Exascale services

Exascale adds a handful of processes. You won’t manage most of them directly, but you’ll see them in logs and in escli output.

With fewer than five storage servers, some EGS instances run on the database servers so the cluster still has five.

The command-line tool is escli, installed on database and storage servers since 24.1. It works alongside CellCLI and DBMCLI, which you still use. In OCI you’ll rarely need it, because the console and the REST APIs cover the same operations.

19c and 26ai work differently

If you’re planning a migration, start here.

• Oracle AI Database 26ai talks to Exascale natively. Files live directly in the vault, and there is no ASM.
• Oracle Database 19c uses Exascale block storage instead: Exascale Direct Volumes (EDV) presented to the VM, with ASM on top and the usual DATA, RECO and LOG disk groups.

In ExaDB-XS a VM cluster runs one version or the other, and a 26ai cluster can’t share a vault with a 19c cluster. Storage scaling differs as well. On 26ai you grow the vault online with one command. On 19c you grow the vault and then adjust the DATA and RECO allocations for each container database.

Exadata Exascale in the cloud: ExaDB-XS

ExaDB-XS gives you Exadata without renting a whole infrastructure. Oracle runs the physical servers in a shared model, and you pay for compute and vault storage. From the current documentation:

• A VM needs at least 8 ECPUs and scales in steps of 4.
• You can reserve ECPUs so a later scale-up needs no restart. You license only the enabled ECPUs.
• Each VM is billed for at least 48 hours, then per second. Extra ECPUs are billed per second with a 1-minute minimum.
• VM file systems live on shared Exascale storage, so Oracle can move a VM to another server for maintenance or after a failure.

Recent updates added single-node VM clusters without a RAC license, scaling enabled ECPUs to zero, automatic failover with Data Guard and Oracle-managed database software updates. Oracle revises the service limits from time to time, so check the limits page before you size anything.

Exadata Exascale field notes

• Plan vaults around security and resource boundaries, such as a business unit or an environment. Splitting them by file type, the way we split DATA and RECO, buys you nothing.
• Before you promise Exascale features to a 19c application, check what works on EDV and ASM. The native vault features need 26ai.
• Your monitoring scripts probably query ASM views. On 26ai those views won’t show vault usage, so plan to use escli or OCI metrics.
• Thin clones are cheap to create, and the changed blocks they collect keep growing. Put a cleanup policy in place from the start.

Wrapping up

With Exadata Exascale, the database still reads straight from the cells, as it always has on Exadata. What moved is ownership: management now lives on the storage servers, and storage is shared and sliced into vaults instead of belonging to one cluster.

In the next posts I want to get hands-on: creating a vault, cloning a PDB with redirect-on-write and comparing the I/O path with a classic ASM deployment. If you already run Exascale, tell me what you ran into. I’d like to include real field notes. Until then, the Engineered Systems section of the blog has my older notes on Exadata and ODA.

References

• Oracle Exadata Exascale: Exascale Services
• Oracle Exadata Database Service on Exascale Infrastructure: Overview
• Oracle Exadata Database Service on Exascale Infrastructure: What’s New
• Using Exascale Block Storage with EDV

O post Exascale for the ASM generation: how Exadata storage works now apareceu primeiro em Blog DBA Dutra.

Olá a todos,

Como muitos ainda não devem saber, entrei para a Oracle como Strategic Customer Service Manager e me tornei um ACE Alumni.

O Programa Oracle ACE é destinado a Clientes e Parceiros, não a funcionários.

Fiquei no programa por 6 anos e vou continuar dando suporte ao programa, agora do lado da Oracle.

Sou muito grato pelo programa, especialmente para Jennifer Nicholson, Oana-Aurelia Bonu e Cassandra Call, que o administra com paixão e me apoia todos esses anos.

Continuarei escrevendo blogs e ajudando dentro do possível a comunidade como sempre foi desde 2010.

Obrigado a todos pelo carinho e respeito que sempre a comunidade e o programa teve comigo.

Até logo
Andre Ontalba

O post ACE Alumni – Fim de um ciclo apareceu primeiro em Blog DBA Dutra.

What is Network Path Analyzer?

Network Path Analyzer is a network reachability analysis tool based on real-time network configuration. Its primary data input is the network routing and security configuration in a customer tenancy, augmented with key network runtime state data, such as the status of a load balancer backend set or the state of a FastConnect virtual circuit.

Network Path Analyzer answers the following questions that are essential for the cloud network operations team to obtain an accurate and deep understanding of endpoint reachability in their cloud networks:

• If they can’t, why? What is missing?
• If they can, how? Over which routing paths, using which security policies?

Finding the answers to these questions in a complex network can be labor-intensive and time-consuming. It involves analyzing the virtual network topologies, carefully walking through multiple route tables, and scrutinizing different network security groups (NSGs) or security lists along the multi-hop network paths. If done manually, it can be error-prone.

Network Path Analyzer is a great network troubleshooting tool. Additionally, since it doesn’t use or need any traffic along the network paths because it operates solely on the configuration and runtime state data, it is also an effective tool for proactive configuration validation.

Benefits of Network Path Analyzer

Armed with Network Path Analyzer, you can realize the following benefits:

• Troubleshoot reachability issues caused by misconfiguration much faster, significantly reducing the Mean Time to Resolution (MTTR) for this type of outage
• Proactively verify and validate the network routing and security policy configuration for your reachability intents before even starting to send application traffic.
• A tool to perform on-demand validation of the logical network paths to match your intent

How to use Network Path Analyzer

Network Path Analyzer is directly available under Networking on the Oracle Cloud Console. You only need to create a path analysis and run it. An API is available to programmatically create, manage, and run your path analyses.

When creating a path analysis, specify the source and destination endpoints, the network protocol, and the source and the destination ports. For endpoints, you can select an IP address or an OCI resource. The viable OCI resource options include an IP address from a VCN subnet, a compute instance virtual network interface card (VNIC), an application load balancer, or a network load balancer.

In my simulation, I am checking bi-directional communication between 2 compute instances.

Select the “Network Path Analyzer” option in the Network Command Center

Click “Create Path Analysis”

Now fill in the Source and Destination information.

In my case I am testing communication between 2 compute instances (VM) via port 22 (SSH).

After filling in the information, perform the analysis.

After a few minutes, a communication report will be displayed where you can identify if it is working or if there is some type of problem.

Network Path Analyzer can assist with your troubleshooting process for the following reachability-related scenarios:

• Virtual machines (VMs) in your multi-VCN applications can’t communicate with each other. You want to check the configured path.
• Your frontend web server in a multitier application can’t reach the load balancer VIP of the application tier.
• Your load balancer can’t reach some of the backends.
• An on-premises endpoint in your hybrid cloud application can’t reach an OCI instance.
• Your on-premises site can’t access a cloud application hosted by your Oracle instances.

Network Path Analyzer is a tool to assist in troubleshooting reachability issues by quickly identifying misconfiguration and reducing the MTTR caused by configuration issues. It’s also an effective tool for customers to proactively verify their network configuration against their reachability intents so that they can proactively catch and correct misconfiguration and reduce outages.

I hope this article can help you

See you in the next article.

Disclaimer: “The postings on this site are my own and do not necessarily represent my current employer positions, strategies, or opinions. The information here was edited to be useful for general purpose, specific data, and identifications was removed to allow reaching a generic audience and to be useful.

O post Network Path Analyzer – OCI apareceu primeiro em Blog DBA Dutra.

Object Storage is a regional cloud service. Buckets are logical containers created in a tenancy inside a region in which customer data is stored as objects.

You can store a copy of all objects from one bucket in another bucket located inside a different region for redundancy. This copy can help you recover from a disaster that could affect an entire cloud region. Cross-region object replication provides protection from a regional outage.

Configure the IAM policies

1. Log in to the OCI console and click Identity, and then click Policies.
2. Create a new policy and add the following statements:

Allow group 'OracleIdentityCloudService'/'OCI_Administrators' to manage buckets in tenancy	
Allow group 'OracleIdentityCloudService'/'OCI_Administrators' to manage objects in tenancy	
Allow service objectstorage-us-ashburn-1 to manage object-family in tenancy	
Allow service objectstorage-us-chicago-1 to manage object-family in tenancy

Configure Object Storage cross-region replication

1. Go to the source bucket and click Create Policy as shown in the following image.

Note: The destination bucket “Replication_Blog” has to be created in the destination region us-chicago before setting up replication. Setup replication policy on source bucket by selecting the destination region and bucket to replicate to and then click Create.

Select the Destination Region and Destination Bucket for replicating objects and click Create.

In the Bucket Information tab, the Replication field displays Enabled for the source bucket in US East (Ashburn) region.

In the US Midwest (Chicago) region, go to the Bucket Information tab and verify if the Replication is Enabled on the destination bucket as well :

Navigate to the destination region and bucket and confirm that the objects uploaded to the source bucket have been replicated in the destination bucket in US Midwest (Chicago) region. 

I hope this article can help you

See you in the next article.

Disclaimer: “The postings on this site are my own and do not necessarily represent my current employer positions, strategies, or opinions. The information here was edited to be useful for general purpose, specific data, and identifications was removed to allow reaching a generic audience and to be useful.

O post Object Storage – Cross Region Replication apareceu primeiro em Blog DBA Dutra.

What is a Globally Distributed Database

A globally distributed database is a method of partitioning data to distribute the computational and storage workload, which helps achieve hyperscale computing.

Companies often achieve hyperscale computing using database sharding, in which they distribute segments of a data set—a shard—across lots of databases on many different computers.

Sharding uses a shared-nothing architecture in which shards share no hardware or software. All the shards together make up a single logical database, called a sharded database.

From the application’s perspective, a sharded database looks like a single database: the number of shards and data distribution across those shards are completely transparent to database applications. From the perspective of a database administrator, a shared database consists of multiple databases that can be managed collectively.

Oracle Globally Distributed Database

Oracle Globally Distributed Database disperses segments of a data set across many databases (shards) onto different computers—on-premises or in the cloud. It enables globally distributed, linearly scalable, multimodel databases. It requires no specialized hardware or software. Oracle Globally Distributed Database does all this while rendering the strong consistency, full power of SQL, support for structured and unstructured data, and the Oracle Database ecosystem. It meets data sovereignty requirements and supports applications that require low latency and high availability.

• SQL language used for object creation, strict data consistency, complex joins, ACID transaction properties, distributed transactions, relational data store, security, encryption, robust performance optimizer, backup and recovery, and patching with Oracle Database
• Oracle innovations and enterprise-level features, including Advanced Security, Automatic Storage Management (ASM), Advanced Compression, partitioning, high-performance storage engine, SMP scalability, Oracle RAC, Exadata, in-memory columnar, online redefinition, JSON document store, and so on
• Sharding-aware Oracle Database tools, such as SQL Developer, Enterprise Manager Cloud Control, Recovery Manager (RMAN), and Data Pump, for sharded database application development and management
• Programmatic interfaces, such as Java Database Connectivity (JDBC), Oracle Call Interface (OCI), Universal Connection Pool (UCP), Oracle Data Provider for .NET (ODP.NET), and PL/SQL, including extensions for sharded application development
• Extreme availability with Oracle Data Guard and Oracle Active Data Guard. Other replication options include Raft replication, built into Oracle Globally Distributed Database.
• Support for multi-model data like relational, text, and JSON
• Existing life-cycle management and operational processes can be kept, leveraging in-house and worldwide Oracle database administrator skill sets
• Enterprise-level support
• Extreme scalability and availability of NoSQL databases

Benefits of Oracle Globally Distributed Database

Oracle Globally Distributed Database provides linear scalability, complete fault isolation, and global data distribution for the most demanding applications.

Key benefits of Oracle Globally Distributed Database include:

• Linear Scalability

The Oracle Globally Distributed Database shared–nothing architecture eliminates performance bottlenecks and provides unlimited scalability. Oracle Globally Distributed Database supports scaling up to 1000 shards.

• Extreme Availability and Fault Isolation

Single points of failure are eliminated because shards do not share resources such as software, CPU, memory, or storage devices. The failure or slow-down of one shard does not affect the performance or availability of other shards.

Oracle MAA best practice solutions, such as Oracle Data Guard and Oracle RAC, protect shards.

An unplanned outage or planned maintenance of a shard impacts only the availability of the data on that shard, so only the users of that small portion of the data are affected, for example, during a failover brownout.

• Geographical Distribution of Data

Oracle Globally Distributed Database enables you to deploy a global database, where a single logical database can be distributed over multiple geographies. This makes it possible to satisfy data privacy regulatory requirements (Data Sovereignty) and allows the storage of particular data close to its consumers (Data Proximity).

New Features: Oracle Globally Distributed Database and 23c

• Raft Replication
• Directory-Based Sharding
• Synchronous Duplicated Tables
• Fine-Grained Refresh Rate Control For Duplicated Tables
• Sharded Database Coordinated Backup and Restore Enhancements
• Automatic Data Move on Sharding Key Update
• Move Data Chunks Between Shardspaces
• Global Partitioned Index Support on Subpartitions
• PL/SQL Function Cross-Shard Query Support
• Pre-Deployment Network Validation
• New Partition Set Operations for Composite Sharding
• Parallel Cross-Shard DML Support
• Oracle Data Pump Adds Support for Sharding Metadata
• Automatic Parallel Direct Path Load Using SQL*Loader

The Oracle Globally Distributed Database is set to revolutionize the world of distributed database operations.

I hope you first enjoyed this great resource we have at OCI.

In the next articles, we will provide more technical details about the product Oracle Globally Distributed Autonomous Database and also go into details of the new features with Oracle 23c.

See you in the next article.

Disclaimer: “The postings on this site are my own and do not necessarily represent my current employer positions, strategies, or opinions. The information here was edited to be useful for general purpose, specific data, and identifications was removed to allow reaching a generic audience and to be useful.

O post Oracle Globally Distributed Database – Overview apareceu primeiro em Blog DBA Dutra.

The Oracle Database Security Assessment Tool (DBSAT), currently in version 3.1.0 (January 2024), is a command-line tool focused on detecting potential security vulnerabilities. Its greatest scope occurs within the database but it also inspects operating system and network components (listener) in search of failures.

The tool provides insight into the current status of users, roles, permissions, and security control policies to promote successful approaches to mitigating potential security risks.

What’s new in DBSAT 3.0 ?

New checks added in DBSAT 3.0 include the newly introduced Oracle Database 23c SQL Firewall, auditing-related issues, sensitive data and transparent sensitive data protection, and a wealth of other checks necessary for any security-conscious organization. Remarks and recommendations are updated to make them clearer and actionable.

Desupport notices list database features and parameters that are reaching or have reached their end-of-life so you can take proactive measures to phase out their usage. DBSAT Discoverer also added support for India’s permanent account number (PAN) and the unique identification (Aadhaar) number.

From its beginning, DBSAT offered a distillation of decades of security experience, checking configuration issues that might introduce unnecessary risk. Until now, DBSAT clearly identified checks that were related to security frameworks like the DISA STIGs, Center for Internet Security (CIS) benchmarks, or data privacy regulations like GDPR. However, no checks clearly indicated that they were Oracle best practices. DBSAT 3.0 fixes that issue: Findings that are Oracle best practices are now clearly identified.

When is DBSAT not enough?

DBSAT is a simple standalone tool that helps assess the security configuration of a single Oracle Database. What if you want to automate assessments across your fleet, track deviations from approved baselines, get alerts, keep history, and compare all in one interface? Use Oracle Data Safe or Oracle Audit Vault and Database Firewall to go the extra mile in assessments.

The DBSAT is made up of two components:

DBSAT Collector: Responsible for executing SQL queries and operating system commands that collect the data to be evaluated. The data is stored in a file that is later used by DBSAT Reporter in the analysis phase.

DBSAT Reporter: Responsible for analyzing the collected data and generating reports of findings and recommendations in files of multiple formats such as HTML, Excel and Text.

Reference: https://docs.oracle.com/en/database/oracle/security-assessment-tool/3.0.0/satug/index.html#GUID-999F5696-F368-4E54-86DB-DEFC593B2042

The main benefits of using DBSAT are:

• Quick identification of database security configuration errors;
• Recommendations based on best security practices;
• Reduction of the amplitude of an attack and exposure to risk.

DBSTAT works on Oracle database 11.2.0.4 and later versions including multitenant and cloud environments. The supported platforms are:

Oracle DBSAT runs on:

• Solaris x64 and Solaris SPARC64
• Linux x86-64 and Linux 64-bit Arm
• Windows x64
• HP-UX IA (64-bit)
• IBM AIX (64-bit) and Linux on zSeries (64-bit)

Its use is very simple and consists of downloading the MOS file (My Oracle Support – Doc ID 2138254.1), unzipping it, and running the script to collect and report security vulnerabilities. DBSAT is a lightweight utility that does not hamper system performance while running.

Running DBSAT Collector:

For DBSTAT to collect all the data and perform a complete validation, it must be executed from the database server, as some operating system commands are executed to collect data that cannot be obtained from the database. DBSTAT must also be run with an operating system user that has read permission on ORACLE_HOME files and directories for data to be collected and processed properly.

Collections in the database are carried out mainly on data dictionary views, so the user that will be provided in the connection string to the database must have sufficient permissions to select data from these views.

Collector Prerequisites

To gather all necessary data, run the Oracle DBSAT Collector on the database server. The collector uses operating system commands to gather process and file system information that the database alone cannot provide. Besides, the Oracle DBSAT Collector must be run as an OS user with read permissions on files and directories under ORACLE_HOME using SQL*Plus (through Oracle Database or Instant Client) to collect and process file system data using OS commands.

The Oracle DBSAT Collector collects most of its data by querying database views. It must connect to the database as a user with sufficient privileges to select from these views. Grant the DBSAT user the following privileges:

• CREATE SESSION
• READ or SELECT on SYS.REGISTRY$HISTORY
• Role SELECT_CATALOG_ROLE
• Role DV_SECANALYST (if Database Vault is enabled or if Database Vault Operations Control is enabled)
• Role AUDIT_VIEWER (12c and later)
• Role CAPTURE_ADMIN (12c and later)
• READ or SELECT on SYS.DBA_USERS_WITH_DEFPWD
• READ on SYS.DBA_AUDIT_MGMT_CONFIG_PARAMS
• READ on SYS.DBA_CREDENTIALS
• EXECUTE on SYS.DBMS_SQL

Syntax for running the DBSAT Collector:

$ dbsat collect <database_connect_string> <output_file>

[oracle@oracle-db-lab dbsat]$  ./dbsat collect "c##test1/test#123" /home/oracle/dbsat/collect/output_ORCL

Database Security Assessment Tool version 3.1 (Jan 2024)

This tool is intended to assist you in securing your Oracle database
system. You are solely responsible for your system and the effect and
results of the execution of this tool (including, without limitation,
any damage or data loss). Further, the output generated by this tool may
include potentially sensitive system configuration data and information
that could be used by a skilled attacker to penetrate your system. You
are solely responsible for ensuring that the output of this tool,
including any generated reports, is handled in accordance with your
company's policies.

Connecting to the target Oracle database...


SQL*Plus: Release 19.0.0.0.0 - Production on Fri Jan 19 23:52:20 2024
Version 19.19.0.0.0

Copyright (c) 1982, 2023, Oracle.  All rights reserved.


Connected to:
Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production
Version 19.19.0.0.0

Setup complete.
SQL queries complete.
OS commands complete.
Disconnected from Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production
Version 19.19.0.0.0
DBSAT Collector completed successfully.

Calling /u01/app/oracle/product/19.0.0/dbhome_1/bin/zip to encrypt output_ORCL.json...

Enter password:
Verify password:
  adding: output_ORCL.json (deflated 86%)
zip completed successfully.
[oracle@oracle-db-lab dbsat]

By default, the file will be generated and compressed with a password. However, we can omit the need to enter a password by adding the -n parameter in the best collect call. However, considering information security, this is not recommended.

Running DBSAT Reporter:

The prerequisite for DBSAT Reporter is that Python 2.6 or higher is installed on the server where the report will be generated. By default it is already installed in most UNIX environments.

To confirm the existence and version of Python run:

python -V 

Syntax for running the DBSAT Report:

dbsat report [-a] [-n] [-x <section>] <input_file>

The Reporter supports the following command-line options:

• -a

Runs the reports for all the database accounts.

• -n

Specifies no encryption for output.

• -g

Shows all grants including common grants in a pluggable database.

• -x

Excludes a section from the report.

Valid sections are:

• USER : User Accounts
• PRIV : Privileges and Roles
• AUTH : Authorization Control
• CRYPT : Encryption
• ACCESS :Fine-Grained Access Control
• AUDIT : Auditing
• CONF : Database Configuration
• NET : Network Configuration
• OS : Operating System

To exclude multiple sections use a comma-separated list, for example:

-x USER,PRIV

Or:

-x USER -x PRIV

Omitting this option will include all sections of the report.

The same path name is used to generate the report files produced by the Reporter in HTML, Excel, JSON, and Text formats with the appropriate file extensions.

Run the Reporter.

[oracle@oracle-lab dbsat]$ export JAVA_HOME=/u01/app/oracle/product/21.0.0/dbhome_1/jdk
[oracle@oracle-lab dbsat]$ export PATH=$JAVA_HOME/bin:$PATH
[oracle@oracle-lab dbsat]$ ./dbsat report -n output_ORCL

Database Security Assessment Tool version 3.1 (Jan 2024)

This tool is intended to assist you in securing your Oracle database
system. You are solely responsible for your system and the effect and
results of the execution of this tool (including, without limitation,
any damage or data loss). Further, the output generated by this tool may
include potentially sensitive system configuration data and information
that could be used by a skilled attacker to penetrate your system. You
are solely responsible for ensuring that the output of this tool,
including any generated reports, is handled in accordance with your
company's policies.

DBSAT Reporter ran successfully.

[oracle@oracle-lab dbsat]$

DBSAT Reports:

DBSAT produces output in various formats for various audiences and purposes. An HTML report, for example, provides detailed results in an easy-to-navigate format using links while a Spreadsheet report provides a high-level summary of each finding, as well as allowing you to manipulate columns by adding new ones for your purposes and prioritization.

Example of a DBSAT summary in HTML:

1. Rule title and unique ID:

The ID has two parts: the prefix identifies the report section and the suffix identifies the specific rule.

2. Status:

Status can be used to define the prioritization of indicators, where a high-risk finding requires immediate action while a low-risk finding can be scheduled and adjusted with less priority.

• Pass: No errors or risks identified;
• Evaluate: It is necessary to carry out a manual analysis to identify the degree of risk;
• Some Risk: Low risk;
• Significant Risk: Medium rich;
• Severe Risk: High security risk;
• Opportunity: Additional opportunities to improve security using additional technologies.

3. Summary:

Discovery summary.

4. Details:

Provides detailed information to explain the discovery.

5. Remarks:

Explains the standard used to evaluate the results found. It can also explain recommended actions for remediation if a risk is reported.

6. References:

Lists the discovery based on the CIS Oracle Database Benchmark, DISA STIGs, Oracle Best Practices.

I hope this article helps you.  

See you in the next article.

Disclaimer: “The postings on this site are my own and do not necessarily represent my current employer positions, strategies, or opinions. The information here was edited to be useful for general purpose, specific data, and identifications was removed to allow reaching a generic audience and to be useful.

O post Database Security Assessment Tool (DBSAT 3.0) apareceu primeiro em Blog DBA Dutra.

I will reproduce the steps on Compute instance in OCI; I hope that is not your case on a production database server, but nobody knows when shit happens, and you may need this procedure to recover and put your database online after an accident.

   As you can see, my database is up and running in my Oracle 19c home.

The location of my ORACLE HOME is listed for this database on my file /etc/oratab

Now, let’s issue a backup of my oracle home, do this procedure with root user. You can backup OH online, no problem at all on the database side to issue this step.

[oracle@oracle-db-lab dbhome_1]$ tar -cf /home/oracle/dbhome19c_installed.tar .
[oracle@oracle-db-lab dbhome_1]$ ls -ltrh /home/oracle/dbhome19c_installed.tar
-rw-r--r--. 1 oracle oinstall 5.0G Jan 18 22:35 /home/oracle/dbhome19c_installed.tar
[oracle@oracle-db-lab dbhome_1]$

I will remove all files on my Oracle Home to simulate the corruption or loss of the Oracle Home.

After removing the directory we will validate that it is not working

Now all utilities were gone!!

As root user again, let’s restore our backup from Oracle Home to the correct path using these commands below and let’s check the size of the folder:

[oracle@oracle-db-lab dbhome_1]$ tar -xf /home/oracle/dbhome19c_installed.tar .

Now all utilities were gone!!

As root user again, let’s restore our backup from Oracle Home to the correct path using these commands below and let’s check the size of the folder:

[oracle@oracle-db-lab dbhome_1]$ tar -xf /home/oracle/dbhome19c_installed.tar .

As you can see, it is the same size as the original one, 5 GB, which is good for us. To guarantee that everything is good, I will do a relink on Oracle binaries before I try to open my database again.

There are no errors on the relink file, so it means that we successfully restored our original Oracle home, and now we can start our database again.

I hope this article helps you restore the situation I described initially. I recommend you include a backup of your Oracle Home in your backup schedules. Otherwise, you will need to reinstall Oracle again and maybe patch all the patches you applied to your Oracle Home before the crash.  

See you in the next article.

Disclaimer: “The postings on this site are my own and do not necessarily represent my current employer positions, strategies, or opinions. The information here was edited to be useful for general purpose, specific data, and identifications was removed to allow reaching a generic audience and to be useful.

O post Backup and restore your Oracle Home apareceu primeiro em Blog DBA Dutra.

First, you need access to an OCI environment. When you have an environment, ensure your user has been assigned to a group with permission to manage the email-family resources.

It would be best if you had a DNS domain to publish your domain keys identified mail (DKIM) and sender policy framework (SPF) records.

1. Generate SMTP credentials

SMTP credentials are necessary to send email through Email Delivery.  Remember that each user is limited to a maximum of two SMTP credentials.

Log into the Oracle Cloud Console and navigate to Identity >> Domains >> OracleIdentityCloudService domain >> Users.

Click on SMTP Credentials and click on Generate credentials.

Fill out the description and Click on “Generate Credentials.”

Copy the username and password. You can’t retrieve the password after closing the dialog box for security reasons.

2. Create your email domain.

An email domain lets you set up essential authentication measures for sending emails. Under Developer Services, select Application Integration and Email Delivery.

Click Email Domains and create a domain. If setting up DKIM and SPF, choose a DNS domain that you own or control and plan to use for the sending email address.

Click on “Create Email Domain.”

3. Set up DKIM

DKIM is an email authentication technique that allows the receiver to verify the owner of an email domain. It gives the email a digital signature and a header field containing all the signature and key-fetching data. So, implementing DKIM improves email deliverability and can protect your domain against malicious emails sent on behalf of your domain.

Click on “Add DKIM”

Fill out the DKIM Selector after clicking on Generate DKIM Record and click on “Create DKIM.”

We now need to configure our DNS domain. Go to your zone and create the CNAME record with the value it gives you.

If done correctly, your DKIM signing status changes to Active. Depending on the update type, updates to your DNS records can take up to 24 hours to propagate globally.

After DNS propagation, active DKIM will appear.

Tip: Rotate your DKIM keys at least every six months. This reduces the risk of active keys being compromised, either by attackers cracking or stealing them.

4. Create an approved sender

You need an approved sender for all “From” addresses sending mail through OCI. Otherwise, mail is rejected. Every sender’s email address must be registered to use it for Email Delivery.

Important note the following details about approved senders:

• An approved sender is associated with a compartment and only exists in the region where it was configured. If you create an approved sender in the US West (Phoenix) region, you can’t send email through the US East (Ashburn) region with that sender.
• Using multiple addresses in the email “From:” header is discouraged because it increases the possibility that your mail is placed in a spam folder or discarded.
• Approved senders are unique to tenancies. The service returns a 409 Conflict error if you create a duplicate sender.

Under DKIM, you can see Approved Senders. Create one.

Click on “Create Approved Sender”

Fill out the email address that you will use as the Approved sender. After that, click on “Create Approved Sender.”

5. Configure SPF on your approved sender domain

The SPF allows you to state which email servers are permitted to send email on behalf of your domain. Email receivers use SPF to detect email spoofing.  Without SPF, a spam or phishing email can be spoofed to appear to be from a legitimate domain.

Navigate to your approved sender. Under the three-dot menu, select View SPF.

Choose your sending location and create a DNS TXT record with the corresponding value. I’m using All commercial regions.

It can take some time, but your domain now shows DKIM Signing and SPF working.

6. Configure the SMTP connection

Navigate to Configuration to access SMTP sending information to configure the connection in your system.

The following information is displayed:

• Public endpoint: The public endpoint used to send email to this region
• SMTP ports: The SMTP ports used to accept email. Email Delivery supports TLS on port 25 or 587 (recommended).
• Security: Indicates if TLS is being used. Customers must encrypt email while in transit to Email Delivery.

7. Send mail

Now that our email domain is set up and secured, we can begin sending mail! You can use your own SMTP library or product, such as Postfix. I’m using Postfix to integrate with Email Delivery.

Install Postfix

 Run the command: yum install postfix -y

[root@vm-blog ~]# yum install postfix -y
Last metadata expiration check: 2:30:40 ago on Tue 09 Jan 2024 08:31:43 PM GMT.
Package postfix-2:3.5.8-7.el8.aarch64 is already installed.
Dependencies resolved.
Nothing to do.
Complete!
[root@vm-blog ~]#

Start Postfix and make it running upon reboot.

Run the command:  service postfix start

[root@vm-blog ~]# service postfix start
Redirecting to /bin/systemctl start postfix.service
[root@vm-blog ~]#


chkconfig postfix on

[root@vm-blog ~]# chkconfig postfix on
Note: Forwarding request to 'systemctl enable postfix.service'.
[root@vm-blog ~]#

Edit the main.cf and add the endpoint in the end of the file

[root@vm-blog ~]# vi /etc/postfix/main.cf

### SMTP - RELAY
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
relayhost = smtp.email.us-ashburn-1.oci.oraclecloud.com:587

Create the sasl_passwd file in the same directory of main.cf.

vi /etc/postfix/sasl_passwd

The file contains this format:

smtp.email.us-ashburn-1.oci.oraclecloud.com:587 user:password*

*The user and password will be the SMTP credentials been generated in the first step.

Change the owner and permission of the sasl_passwd

[root@vm-blog ~]# chown root:root /etc/postfix/sasl_passwd
[root@vm-blog ~]# chmod 600 /etc/postfix/sasl_passwd

Generate the password hash and reload the postfix

[root@vm-blog ~]# postmap hash:/etc/postfix/sasl_passwd
[root@vm-blog ~]# postfix reload
postfix/postfix-script: refreshing the Postfix mail system
[root@vm-blog ~]#

Send the test email.  This require installing mailx package to validate.

Run the command:  yum install mailx -y

[root@vm-blog ~]# yum install mailx -y
Last metadata expiration check: 2:49:02 ago on Tue 09 Jan 2024 08:31:43 PM GMT.
Dependencies resolved.
======================================================================================================================================================================================================
 Package                                   Architecture                                Version                                            Repository                                             Size
======================================================================================================================================================================================================
Installing:
 mailx                                     aarch64                                     12.5-29.el8                                        ol8_baseos_latest                                     246 k

Transaction Summary
======================================================================================================================================================================================================
Install  1 Package

Total download size: 246 k
Installed size: 493 k
Downloading Packages:
mailx-12.5-29.el8.aarch64.rpm                                                                                                                                         6.0 MB/s | 246 kB     00:00
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                                                                                 5.6 MB/s | 246 kB     00:00
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                                                                                              1/1
  Installing       : mailx-12.5-29.el8.aarch64                                                                                                                                                    1/1
  Running scriptlet: mailx-12.5-29.el8.aarch64                                                                                                                                                    1/1
  Verifying        : mailx-12.5-29.el8.aarch64                                                                                                                                                    1/1

Installed:
  mailx-12.5-29.el8.aarch64

Complete!
[root@vm-blog ~]#

Now, send the email to validate.

Run this command:

echo "This a test message from DBADUTRA BLOG" | mail -s "Validation DKIM, SPF, Email Delivery - OCI" -r <approved sender email address> <recipient email address>

Validate that you received the email

Check on Dashboard

Remember the first 3.100 emails sent are free. After this, you pay $0.085 per 1000 emails Sent.

I hope this article can help you; it is a reliable, robust, low-cost solution for high-volume email sending. Remember that all the resources used for this article are always free.

See you in the next article.

Disclaimer: “The postings on this site are my own and do not necessarily represent my current employer positions, strategies, or opinions. The information here was edited to be useful for general purpose, specific data, and identifications was removed to allow reaching a generic audience and to be useful.

O post Sending email using OCI Email Delivery service apareceu primeiro em Blog DBA Dutra.

Começamos criando uma compute instance no OCI em uma sub-rede Virtual Cloud Network (VCN) onde temos acesso SSH, seja via Internet Gateway ou um canal privado. Esta VCN deve ter um Gateway de Serviço que permitirá acesso privado à Oracle Services Network para fins de acesso ao Object Storage. Estou usando o Oracle Linux 8 em ARM de baixo custo para minha implantação. Você pode alterar o formato dependendo das necessidades desejadas.

Ja fiz um artigo sobre isso “Criando um Compute Instance”

Crie o bucket que vamos usar para armazenar nossos dados. Deve ser do tipo Armazenamento padrão. Certifique-se de que esteja definido como privado, a menos que você queira armazenar também os dados de outras pessoas.

Precismos usar Grupos Dinâmicos para atribuir à nossa instância um Instance Principal e, em seguida, escrever políticas para permitir que ela funcione com nosso novo bucket.

Criando um Dynamic Group

Criamos um grupo dinâmico para vincular políticas à nossa instância. Neste exemplo, estamos usando apenas uma instância, portanto identificamos essa instância pelo OCID.

A seguir, vamos vincular nosso Dynamic Group a um conjunto de permissões usando uma Política.

Criando uma Politica para acesso ao Object Storage.

É aqui que atribuímos permissões aos membros do Dynamic Group que acabamos de criar. Criaremos uma política com uma instrução que permite que a instância que executa o backup interaja com o bucket específico que queremos montar.

Temos tudo setado para que possamos fazer a instalação no Linux e configurar a ferramenta rclone para que possamos ter acesso ao Object Storage.

Instalando pacotes e arquivo de configuração.

Faremos SSH em nossa instância usando o usuário opc com acesso sudo. A partir daí, instalaremos o rclone e o fuse:

[opc@vm-blog var]$ sudo yum-config-manager --enable ol8_developer && sudo yum install -y rclone fuse fuse3
Oracle Linux 8 Development Packages (aarch64)                                                                                                                         134 MB/s | 108 MB     00:00
Last metadata expiration check: 0:00:31 ago on Wed 13 Dec 2023 09:18:37 PM GMT.
Package fuse3-3.3.0-17.0.1.el8.aarch64 is already installed.
Dependencies resolved.
======================================================================================================================================================================================================
 Package                                   Architecture                               Version                                              Repository                                            Size
======================================================================================================================================================================================================
Installing:
 fuse                                      aarch64                                    2.9.7-17.0.1.el8                                     ol8_baseos_latest                                     81 k
 rclone                                    aarch64                                    1.65.0-1.0.1.el8                                     ol8_developer                                         19 M

Transaction Summary
======================================================================================================================================================================================================
Install  2 Packages

Total download size: 19 M
Installed size: 76 M
Downloading Packages:
(1/2): fuse-2.9.7-17.0.1.el8.aarch64.rpm                                                                                                                              2.3 MB/s |  81 kB     00:00
(2/2): rclone-1.65.0-1.0.1.el8.aarch64.rpm                                                                                                                             95 MB/s |  19 MB     00:00
------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Total                                                                                                                                                                  94 MB/s |  19 MB     00:00
Running transaction check
Transaction check succeeded.
Running transaction test
Transaction test succeeded.
Running transaction
  Preparing        :                                                                                                                                                                              1/1
  Installing       : rclone-1.65.0-1.0.1.el8.aarch64                                                                                                                                              1/2
  Installing       : fuse-2.9.7-17.0.1.el8.aarch64                                                                                                                                                2/2
  Running scriptlet: fuse-2.9.7-17.0.1.el8.aarch64                                                                                                                                                2/2
  Verifying        : fuse-2.9.7-17.0.1.el8.aarch64                                                                                                                                                1/2
  Verifying        : rclone-1.65.0-1.0.1.el8.aarch64                                                                                                                                              2/2

Installed:
  fuse-2.9.7-17.0.1.el8.aarch64                                                                    rclone-1.65.0-1.0.1.el8.aarch64

Complete!
[opc@vm-blog var]$

A seguir, criaremos um link simbolico para o diretorio /usr/bin directory:

[opc@vm-blog var]$ sudo ln -s /usr/bin/rclone /sbin/mount.rclone
[opc@vm-blog var]$

Crie um diretório para rclone em /etc/rclone e use o editor de sua preferência para criar um /etc/rclone/rclone.conf

Teste da instalação

A execução dos seguintes comandos montará o sistema de arquivos remoto (Object Storage):

sudo mkdir -p /backup

Depois que nosso local de montagem for criado:

[root@vm-blog rclone]# sudo rclone mount \
>     backup:blog_backup /backup\
>     --allow-other \
>     --cache-dir /tmp/rclone/cache \
>     --config /etc/rclone/rclone.conf \
>     --dir-perms 0770 \
>     --file-perms 0660 \
>     --log-file /var/log/rclone.log \
>     --log-level ERROR \
>     --tpslimit 50  \
>     --umask 0117 \
>     --vfs-cache-mode writes \
>     --vfs-fast-fingerprint &
[1] 73993

A seguir, vamos montar o storage editando nosso /etc/fstab (ponto de monagem deve ser um diretório existente):

backup:blog_backup /backup rclone rw,umask=0117,nofail,_netdev,args2env,config=/etc/rclone/rclone.conf,uid=1000,gid=1000,file_perms=0760,dir_perms=0770,allow_other,vfs_cache_mode=writes,cache_dir=/tmp/rclone/cache 0 0

Depois que seu fstab for editado:

[root@vm-blog /]# sudo mount -av
/                        : ignored
/boot                    : already mounted
/boot/efi                : already mounted
/var/oled                : already mounted
/dev/shm                 : already mounted
none                     : ignored
/backup                  : already mounted
[root@vm-blog /]#

Para este teste configurei o diretório de backup padrão para banco de dados e servidor Web no Object Storage.

Podemos ver aqui que os backups foram gerados no /backup.

Aqui podemos confirmar que os objetos estão no bucket e sincronizados com o arquivos que foram gerados no servidor pelo backup.

Espero que este artigo possa te auxiliar em uma solução simples e sincronizada para seus backups, lembrando que todos os recursos utilizados para este artigos são Always Free.

Te vejo em um próximo artigo.

Até a próxima.

Disclaimer: “The postings on this site are my own and do not necessarily represent my current employer positions, strategies, or opinions. The information here was edited to be useful for general purpose, specific data, and identifications was removed to allow reaching a generic audience and to be useful.

O post Fazendo Backup do seu sistema usando Object Storage (OCI). apareceu primeiro em Blog DBA Dutra.

The current process (using export-import) takes a few days.

To reduce the time, an alternative approach was implemented

• Replicate constantly all production changes to a standby database.   This is achieved using Data Guard
• For the refresh
  • Stop synchronization
  • Drop old DEV databases
  • Create new DEV databases by cloning from the standby database
  • Restart synchronization

The new procedure should considerably reduce the refresh time considerably to a few hours.

1         Pre-Requirements

• Oracle version and Patch Level on Primary and Secondary should be same.
• Db_unique_name on standby and primary database should be different in order to used in DG_CONFIG setting of the LOG_ARCHIVE_CONFIG parameter.

2         Preparation

Standby preparation

Check if standby is in sync with primary

****** To check archivelog apply lag

SELECT al.thrd "Thread", almax "Last Seq Received", lhmax "Last Seq Applied" FROM
(select thread# thrd, MAX(sequence#) almax FROM v$archived_log WHERE resetlogs_change#=(SELECT resetlogs_change#
FROM v$database) GROUP BY thread#) al, (SELECT thread# thrd, MAX(sequence#) lhmax FROM v$log_history
WHERE resetlogs_change#=(SELECT resetlogs_change# FROM v$database) GROUP BY thread#) lh WHERE al.thrd = lh.thrd;

Convert standby in snapshot standby

shutdown immediate
startup mount
alter database convert to snapshot standby;
alter database open;

 

Create DB links between Standby and DEV

---- Standby

alter pluggable database ALL open read only;
CREATE USER c##r_clone identified by Oracle23 CONTAINER=ALL;
GRANT CREATE SESSION, CREATE PLUGGABLE DATABASE, SYSOPER, RESOURCE, CREATE ANY TABLE, UNLIMITED TABLESPACE TO  c##r_clone CONTAINER=ALL;
GRANT DBA to c##r_clone;

CREATE DATABASE LINK refresh_link CONNECT TO c##r_clone identified by Oracle23 using 'DUTSD'; 

----- Dev Database

CREATE DATABASE LINK refresh_link CONNECT TO c##r_clone identified by Oracle23 using 'DUTSST';

alter pluggable database ALL open read only;
CREATE USER c##r_clone identified by Oracle23 CONTAINER=ALL;
GRANT CREATE SESSION, CREATE PLUGGABLE DATABASE, SYSOPER, RESOURCE, CREATE ANY TABLE, UNLIMITED TABLESPACE TO  c##r_clone CONTAINER=ALL;
GRANT DBA to c##r_clone;

Cleanup old PDB’s in DUTSD

####### DROP OLD PDB - DUTSD
Show pdbs; 

ALTER PLUGGABLE DATABASE <PDBNAME> CLOSE;
DROP PLUGGABLE DATABASE <PDBNAME> INCLUDING DATAFILES;

3 Clone PDBs

The files of standby were created using OMF convention.   For this reason the database files need to be converted from

+DATA01/DUTSD/<GUID>/DATAFILE/<file>.<id>  to

+DATA01/DUTSST/DATAFILE/<file>.dbf’

Clone DUTSD

CREATE PLUGGABLE DATABASE DUTSD FROM DUTSD@refresh_link storage unlimited tempfile reuse 
file_name_convert=('+DATA01/DUTSD/CCA899613E3D0713E0531114C30A2022/DATAFILE/duts01.474.1147957609','+DATA01/DUTSST/DATAFILE/duts01.dbf',
'+DATA01/DUTSD/CCA899613E3D0713E0531114C30A2022/DATAFILE/duts02.269.1147957617','+DATA01/DUTSST/ /DATAFILE/duts02.dbf') 
keystore identified by "Duts23" parallel 6;

4 Finalize the refresh

. oraenv
sqlplus / as sysdba
shutdown immediate

startup mount

Restore datafiles permissions

exec dbms_dnfs.restore_datafile_permissions('<CDBNAME>');

Convert the snapshot back to physical standby

show pdbs
alter database convert to physical standby;
shutdown immediate
startup

See you soon in other articles.

Stay tuned by following us on Twitter @aontalba and Linkedin.

Disclaimer: “The postings on this site are my own and do not necessarily represent my current employer positions, strategies, or opinions. The information here was edited to be useful for general purpose, specific data, and identifications was removed to allow reaching a generic audience and to be useful.”

O post Refresh database from Data Guard apareceu primeiro em Blog DBA Dutra.