USER GUIDE. Snow Inventory Oracle Scanner Version 2.2 Release date Document date

Transcription

1 USER GUIDE Product Snow Inventory Oracle Scanner Version 2.2 Release date Document date

2 CONTENT ABOUT THIS DOCUMENT... 3 OVERVIEW... 3 OPERATING TEMS SUPPORTED... 3 DEPENDENCY ON OTHER SNOW PRODUCTS... 3 PREREQUISITES... 3 Windows... 3 Linux and Unix... 3 FILES... 4 INSTALLATION... 5 AUTOMATIC ORACLE INVENTORY... 6 ORACLE INVENTORY WITH SPECIFIC USER AND PERMISSIONS... 6 ORACLE PERMISSIONS REQUIRED... 7 CONFIGURATION AND RUNNING... 9 CONFIGURATION XML FILE... 9 OUTPUT ENCRYPTION OF PASSWORDS SCHEDULING KNOWN ISSUES APPENDIX CONFIGURATION EXAMPLES Example 1: Minimal configuration file Example 2: Advanced Oracle configuration Example 3: Advanced Oracle configuration Example 4: Advanced Oracle configuration Page 2 of 14

3 ABOUT THIS DOCUMENT This document describes how to configure the Snow Inventory Oracle Scanner. OVERVIEW From version 2.0 the Snow Inventory Oracle Scanner is a Java program. This makes the scanner platform independent and it can be run on a variety of platforms. OPERATING TEMS SUPPORTED For information on supported operating systems, see the document System Requirements for all Snow products, which is available for download at DEPENDENCY ON OTHER SNOW PRODUCTS The Snow Inventory Oracle Scanner is started from a Snow Inventory Client. The Snow Inventory Oracle Scanner 2.2 requires Snow Inventory Data Provider 4.6 to be installed on the Snow system platform. PREREQUISITES To run the Snow Inventory Oracle Scanner, the target computer is required to have Java Runtime Environment 6.0 (1.6) or later installed. NOTE: Due to an internal defect in Java, Java Runtime Environment 1.7.0_7 must not be used. See section Known issues for more information. WINDOWS In Windows the Oracle Scanner is run with an administrative user account (Local Admin on the server). LINUX AND UNIX In Linux and Unix there are two privilege options for running the Oracle Scanner, and each option is described in the sections below. FULL PRIVILEGES A user with root privileges or a user with privileges to run the Java runtime with the sudo program is required. Page 3 of 14

4 PRINCIPLE OF LEAST PRIVILEGES A user is required that has sudo rights to specific operating system commands depending on operating system, see table below. The sudoers file also need to have the NOPASSWD option set. An Oracle database user is required for each database that is to be inventoried. The user can be the same for all databases and then configured in the configuration file with the <DefaultInstanceCredentials>. The user can also be unique and configured with the <InstancesWithConfiguration>, see section below. Example from sudoers file for Solaris. User snow has the rights to execute the commands with sudo and no password: ## ## User privilege specification ## root ALL=(ALL) ALL snow ALL=NOPASSWD: /usr/bin/pwdx Following commands are used for determining OracleHome. If OracleHome is set in the configuration file, the user doesn t need sudoers rights to this command. Operating system Solaris AIX and Linux HP-UX Command pwdx ls pfiles FILES File sios.jar sios.xml sios.log sios.properties <resultfile>.xml Description This is the only required file for the Snow Inventory Oracle Scanner. It is an executable Java archive that performs inventory of Oracle databases on the current server that it is executed on. sios.jar is started from a Snow Inventory Client. Configuration file used for advanced configuration when using the Inventory clients for Windows and Linux (optional). When using the Inventory client for Unix, configuration of the Snow Inventory Oracle Scanner is done in the configuration file of the Unix client. Log file Properties file containing information about installation date, last run date, Java version, output filename, and version. The result file from the Snow Inventory Oracle Scanner Page 4 of 14

5 INSTALLATION The Snow Inventory Oracle Scanner is integrated into all Snow Inventory Clients. When requesting a Snow Inventory Client for the desired operating systems the customer needs to specify that the Oracle Management Option needs to be included. Page 5 of 14

6 AUTOMATIC ORACLE INVENTORY The Snow Inventory Oracle Scanner is designed to perform automatic Oracle inventory without the need of providing or creating a specific user account within the Oracle databases. It automatically discovers all running Oracle instances on the current server, detects what user is running each database instance, and switches to that specific user when inventorying the databases. No specific permissions or no specific user is needed for the databases that are to be inventoried. The Oracle Scanner is designed to be lightweight and scalable regarding size and number of objects in database. Resource consumption is mainly CPU bound since metadata is often available in memory. The Snow Inventory Oracle Scanner is non-invasive and read-only, meaning that only read operations are performed when querying the database(s). It performs only SELECT queries based on PL/SQL blocks to extract necessary inventory data that is used for analyzing needs of a license. Snow Software recommends the use of Automatic Oracle Inventory rather than setting up specific user accounts or permission for each Oracle database ORACLE INVENTORY WITH SPECIFIC USER AND PERMISSIONS If specific credentials are required for the Oracle inventory, a user account needs to be created with SELECT permissions on ALL TABLES and DICTIONARY in all databases. The account also needs to be able to CREATE SESSION. This is done by granting the user SELECT ANY privileges on TABLE and DICTIONARY, see the example below. The user needs to be created and permissions need to be granted on each database that is to be inventoried. Example: Create the user <Oracle Scanner User> and grant SELECT ANY privileges in earlier versions than Oracle 12: CREATE USER <Oracle Scanner User> identified by <Password>; GRANT CREATE SESSION TO <Oracle Scanner User>; GRANT SELECT ANY TABLE to <Oracle Scanner User>; GRANT SELECT ANY DICTIONARY to <Oracle Scanner User>; For Oracle 12, the user needs to be created as a common user, which is done by typing c## before the username. Also, CONTAINER=ALL must be added to each line, see example below. Example: Create the user <Oracle Scanner User> and grant SELECT ANY privileges in Oracle 12: CREATE USER c##<oracle Scanner User> identified by <Password> CONTAINER=ALL; GRANT CREATE SESSION TO c##<oracle Scanner User> CONTAINER=ALL; GRANT SELECT ANY TABLE to c##<oracle Scanner User> CONTAINER=ALL; GRANT SELECT ANY DICTIONARY to c##<oracle Scanner User> CONTAINER=ALL; Page 6 of 14

7 ORACLE PERMISSIONS REQUIRED When performing automatic Oracle inventory via the user that runs the database instance, the required permissions are already granted to the user. When performing Oracle inventory using a specific Oracle user, the user needs to be granted the permissions required as illustrated in the section above (Oracle Inventory with specific user and permissions). In both cases the following objects are accessed and the user needs to be able to run SELECT queries towards these tables/views. Owner APPS CONTENT CONTENT DM DM DV LBAC MD ODM OLAP Table FND_PRODUCT_GROUPS ODM_DOCUMENT ODM_RECORD DM$MODEL DM$OBJECT DBA_DV_REALM LBAC$POLT SDO_GEOM_METADATA_TABLE ODM_MINING_MODEL DBA$OLAP_CUBES Owner Table ALL_VIEWS CDB_PDB_HISTORY DBA_ADVISOR_TASKS DBA_AWS DBA_CPU_USAGE_STATISTICS DBA_CUBES DBA_ENCRYPTED_COLUMNS DBA_FEATURE_USAGE_STATISTICS DBA_FLASHBACK_ARCHIVE DBA_FLASHBACK_ARCHIVE_TABLES DBA_LOB_PARTITIONS DBA_LOB_SUBPARTITIONS DBA_LOBS DBA_MINING_MODELS DBA_OBJECTS DBA_REGISTRY DBA_SEGMENTS DBA_SQL_PROFILES DBA_SQLSET DBA_SQLSET_REFERENCES Page 7 of 14

8 Page 8 of 14 Owner Table DBA_TAB_PARTITIONS DBA_TAB_SUBPARTITIONS DBA_TABLES DBA_TABLESPACES DBA_USERS DBA_WORKLOAD_CAPTURES DBA_WORKLOAD_FILTERS DBA_WORKLOAD_REPLAYS GV_$INSTANCE GV_$PARAMETER MODEL$ V_$ARCHIVE_DEST_STATUS V_$BLOCK_CHANGE_TRACKING V_$CONTAINERS V_$DATABASE V_$INSTANCE V_$LICENSE V_$OPTION V_$PARAMETER V_$PDBS V_$SESSION V_$SESSION_CONNECT_INFO Owner Table MAN MGMT_ADMIN_LICENSES MAN MGMT_FU_REGISTRATIONS MAN MGMT_FU_STATISTICS MAN MGMT_LICENSE_CONFIRMATION MAN MGMT_LICENSE_DEFINITIONS MAN MGMT_LICENSED_TARGETS MAN MGMT_LICENSES MAN MGMT_TARGET_TYPES MAN MGMT_TARGETS

9 CONFIGURATION AND RUNNING The Snow Inventory Oracle Scanner can be configured by using a configuration file. CONFIGURATION XML FILE The configuration file is XML-based and contains the following tags: Parameter <SiteName> <OutputPath> <StoragePath> <OracleScan> <OracleConfig> <DiscoverAllInstances> <IncludeInstances> <SID> <ExcludeInstances> <SID> <DefaultInstanceCredentials> <User> <Username> <Password> <InstancesWithConfiguration> <Instance> <SID> <User> <Username> <Password> <OracleHome> Description Snow site name. i.e. MyCorp Path to where output and log files will be placed Path to where properties files will be placed true/false Default = true Main tag of all Oracle specific options Can be left out, for automatic inventory, if left out none of the configuration below applies. true/false Must be present if OracleConfig is used Only scan specified instances instead of all instances (DiscoverAllInstances must then be set to false). Can be left out. Database instance SID. Can be repeated. Exclude database instances from being scanned. Can be left out. Database instance SID. Can be repeated. Default credentials to use when log into a database instance if no specific credentials is specified for the specific instance. Can be left out. Tag for specifying default Oracle credentials Username Password, encrypted (see section Encryption of passwords) Credentials for specific database instances. Can be left out. Database instance. Can be repeated. Database instance SID. Tag for specifying database specific Oracle credentials Username Password, encrypted (see section Encryption of passwords) Path to the Oracle home for the instance. If the OracleHome path is set, no automatic scanning for determining this path is performed. Page 9 of 14

10 OUTPUT The information from Snow Inventory Oracle Scanner will be integrated with the information collected by the Snow Inventory Client. ENCRYPTION OF PASSWORDS Encryption of passwords used in the configuration file and on the command line can be achieved by using a support program called snowcrypt which is available from Snow Support. It is a Windows only program which is run from a command prompt. The program is used in the following way, and the result is displayed on the next line of the command prompt: C:\Snowutils> snowcrypt encryptpass2 MyPassword 145f737f4f357d0ef01ffcc6ee8bd8576ebafcf8e36dfc5ed3c109bae2b24e6f5 SCHEDULING Scheduling is described in the document of the specific Snow Inventory Client that is used. KNOWN ISSUES The Java Runtime Environment (JRE) 1.7.0_07 contains a defect with the consequence that the Oracle inventory does not work. Any server running JRE 1.7.0_07 must upgrade to a later version for the Snow Inventory Oracle scanner to work properly. There is a validation on the configuration XML file. This means that some items must be in a specific order in the XML file. In case that a failure occurs related to the configuration file, check the order of the XML tags. Page 10 of 14

11 APPENDIX CONFIGURATION EXAMPLES EXAMPLE 1: MINIMAL CONFIGURATION FILE All active database instances on the server will be scanned. The result and log file will be placed in the same directory as the Oracle scanner. <?xml version="1.0" encoding="utf-8"?> <SnowConfig> <SiteName>MyCorp</SiteName> </SnowConfig> Page 11 of 14

12 EXAMPLE 2: ADVANCED ORACLE CONFIGURATION All active database instances on server will be scanned, except for DbInstance1. All instances will be scanned with the user Username 1 and corresponding password, except for DbInstance2 that will be scanned with the user Username 2 and corresponding password. The result and log file will be placed in the sub directory files. <?xml version="1.0" encoding="utf-8"?> <SnowConfig> <SiteName>MyCorp</SiteName> <OutputPath>files</OutputPath> <OracleConfig> <DiscoverAllInstances>true</DiscoverAllInstances> <ExcludeInstances> <SID>DbInstance1</SID> </ExcludeInstances> <DefaultInstanceCredentials> <User> <Username>Username 1</Username> <Password>Password 2</Password> </User> </DefaultInstanceCredentials> <InstancesWithConfiguration> <Instance> <SID>DbInstance2</SID> <User> <Username>Username 2</Username> <Password>Password 2</Password> </User> </Instance> </InstancesWithConfiguration> </OracleConfig> </SnowConfig> Page 12 of 14

13 EXAMPLE 3: ADVANCED ORACLE CONFIGURATION Only the database instances DbInstance1 and DbInstance2 on the server will be scanned. Both instances have their own credentials configured. The result and log file will be placed in the directory /var/log/sios. <?xml version="1.0" encoding="utf-8"?> <SnowConfig> <SiteName>MyCorp</SiteName> <OutputPath>/var/log/sios</OutputPath> <OracleConfig> <DiscoverAllInstances>false</DiscoverAllInstances> <IncludeInstances> <SID>DbInstance1</SID> <SID>DbInstance2</SID> </IncludeInstances> <InstancesWithConfiguration> <Instance> <SID>DbInstance1</SID> <User> <Username>Username 1</Username> <Password>Password 1</Password> </User> </Instance> <Instance> <SID>DbInstance2</SID> <User> <Username>Username 2</Username> <Password>Password 2</Password> </User> </Instance> </InstancesWithConfiguration> </OracleConfig> </SnowConfig> Page 13 of 14

14 EXAMPLE 4: ADVANCED ORACLE CONFIGURATION Inventory of an Oracle database instance with the OracleHome parameter specified instead of using automatic detection of Oracle Home. <?xml version="1.0" encoding="utf-8"?> < SnowConfig > <SiteName>MyCorp</SiteName> <OracleConfig> <DiscoverAllInstances>true</DiscoverAllInstances> <InstancesWithConfiguration> <Instance> <SID>MySid</SID> <OracleHome>/opt/oracle/current</OracleHome> </Instance> </InstancesWithConfiguration> </OracleConfig> </SnowConfig> Page 14 of 14