Copyright 2014 Oracle and/or its affiliates. All rights reserved.

Transcription

1 Management Overview, Architecture and Deployment Akanksha Sheoran

2 Safe Harbor Statement The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle s products remains at the sole discretion of Oracle.

3 Agenda Setting up Management Management Architecture Understanding Gateway Understanding Agent High Availability Architecture Documentation 3

4 Setting up Management Prerequisite Tenant Admin has signed up for Database and/or Java Cloud Service Tenant Admin has the public IP address to reach the VM hosting the service(s) Tenant Admin has the SSH keys for communicating to respective service(s) Corporate firewall has been set up to communicate with Oracle Cloud Enterprise Manager 12cRel5 has been installed Action Configure proxy within EM to match corporate settings Setup SSH Credentials as named credentials Deploy Gateway Agent Deploy Hybrid Agent on the VM Reconfigure the Hybrid Cloud Gateway, if needed Results On premise EM can now manage the Cloud instances 4

5 Enterprise Manager Deployment Architecture Explained 1. Convert any On-Premise EM target agent as Gateway 1. Forwards communication received from Hybrid agent through local proxy to on-premise OMS 2. Agent is deployed using SSH push mechanism from On-Premise EM 1. On-premise OMS initiates requests to Hybrid Agent using HTTP tunneling over SSH 2. Agent communicates back to the on-premise OMS via a local proxy that routes requests back to on-premise OMS through a SSH tunnel 3. The Agent-OMS communication path is created by the Gateway On-premise EM OMS Private Cloud HTTPS Gateway Secure encrypted SSH connection HTTPS Port 1748 Gateway Proxy Oracle PaaS Agent

6 On Premise OMS to Agent Communication 1. OMS communicates via Gateway over SSH, using an EMCTL dispatcher on the Oracle Cloud In the hybrid case, instead of doing it directly over HTTP/S the framework is doing it over SSH using a dispatcher on the PaaS side 2. The EMCTL dispatcher forwards communication from the OMS to the Hybrid Agent, and streams the responses from the Agent back to the on-premise On-premise EM OMS Private Cloud HTTPS Gateway Secure encrypted SSH connection Emctl Dispatcher TMClient over HTTPS HTTPS Oracle PaaS Agent 3. The emctl dispatcher process stays alive for the duration of the session 4. The SSH connection is always initiated by the Gateway

7 Agent to On-Premise OMS Communication 1. Agent can't make direct calls to the On-Premise OMS The bridge is created by Gateway using SSH tunneling to the Oracle Cloud side The SSH bridge presents fake OMS endpoints to the hybrid agent and it is only used to communication from the hybrid agent to the OMS At any given time, there is a single bridge to any given Agent Bridge is used to send requests form the Oracle Cloud to the OMS (not reverse ) HTTPS Private Cloud EM OMS OMS End Points Gateway SSH Secure encrypted SSH connection Local Fake OMS End Points Gateway Proxy HTTPS Oracle PaaS Agent 2. Gateway Proxy works by getting HTTPS requests from Hybrid Agent and streams the request to the Gateway over SSH

8 Gateway Agent Criteria for choosing Gateway direct SSH connect to OC or through corporate proxy Recommendation: Multiple Gateway s to achieve scalable and highly available monitoring Hard disk space requirement same as regular EM Agent Simple Registration and de-registration mechanisms Register any agent as a Step1: Run emcli command from On-Premises OMS home : emcli register_hybridgateway_agents -agent_list='<list of EM agents names separated by space> Deregister Gateway back to EM Agent: Step 1: Run the emcli : emcli deregister_hybridgateway_agent -hybridgateway_agent_list="<hybrid_cloud_gateway_agents>" External proxy that supports SSH tunneling (for example, SOCK4, SOCK5, HTTP) Oracle Confidential Internal/Restricted/Highly Restricted 8

9 Gateway Agent Q : How do i verify if my existing agent is a Gateway or not? Ans: Verify if agents is successfully registered as Gateway byi. Open the $EMSTATE/sysman/emd/targets.xml ii. Check for property name and value entry for hybridgateway in target.xml <Property NAME="Type" VALUE="hybridgateway"/> The oracle_hybridcloud_connection is a new target type that represents the bridge between a agent and the On-Premise OMS Q : How do i find out all Hybrid Gateway Agents for all Hybrid Agents? Ans: Create config search using SQL select target_name,agent_name from MGMT$AGENTS_MONITORING_TARGETS where target_type='oracle_hybridcloud_connection' 9

10 Agent Pre-requisites: Configure at least one Gateway Agent SSH port (default 22) must be open on Oracle Cloud virtual host Gateway Proxy default port 1748, or at least one port in the range 1830 to 1848 is free on Oracle Cloud virtual host Set up named credential that uses SSH private key authentication The Agent install user has sudo privileges to run the root.sh script Mass Agent deployment through Agent Push UI and EMCLI (no other agent deployment supported) Track able and Resume-able in case of failures 10

11 Agent Deployment process is orchestrated into 3 phases : Phase 1 [ On Agent Host] a. Using SSH deploys the agent in software only mode b. Configure the agent using emctl deploy agent c. Creates instance home and configure the proxy url of the agent instead of repos url Phase 2 [ On-Premise OMS ] a. Create an oracle_hybridcloud_connection target with the SSH credentials that were provided by the user while deploying agent in Phase1 b. Save the oracle_hybridcloud_connection target to the given Gateway Oracle Confidential Internal/Restricted/Highly Restricted 11

12 Agent Deployment under the cover Phase 3 [On Agent Host] a) Secures the agent using emctl secure agent b) Deploys plug-ins using AgentPluginDeploy.pl c) Update plug-in inventory on the OMS using emctl update_inventory plugin d) Start the agent using emctl start agent e) Discover Host and Targets with following steps: i. Runs command: emctl config agent addinternaltargets dump ii. Copy this dump to the OMS iii. Create the host/agent target on the OMS iv. Create an association between the agent oracle_emd instance to the oracle_hybridcloud_connection instance v. Save the targets to the agent f) Run root.sh to set the setuid bits on the nmo binaries Oracle Confidential Internal/Restricted/Highly Restricted 12

13 Gateway High Availability DMZ INTRANET Oracle PaaS Private Cloud On-Premise EM OMS Port 3872 Port 3872 Gateway Primary Gateway Secondary in Passive mode Associate Multiple Gateways for Hybrid Agents Secure encrypted SSH connection (directly or through HTTP proxy) Port 1748 HTTPS Port 1748 HTTPS Gateway Proxy Current Connection Inactive connection Agent First Gateway deployed is considered as Primary and subsequent ones are Secondary (passive mode) When Primary goes down, one of the secondary takes over and starts the Proxy. If this secondary also goes down, next secondary takes over, and so on. Oracle Confidential Internal/Restricted/Highly Restricted 13

14 Gateway High Availability Deploy Hybrid Gateway as Primary : emcli register_hybridgateway_agents -agent_list='<list of EM agents names separated by space> Deploy Hybrid Gateway as Secondary : emcli_install_location>/bin/emcli add_hybridgateway_for_hybrid_agent -hybrid_agent_name='<list of hybrid cloud agents> Once the Primary Gateway goes down the next time when it come up, it will be Secondary You can have multiple Primary Gateways for different set of Hybrid Agents Oracle Confidential Internal/Restricted/Highly Restricted 14

15 Gateway and Hybrid Agent Lifecycle Disassociate Gateway (to move to a new host) Single Gateway Decommission the Hybrid agents from the EM console and run the emcli emcli delete_hybridgateway_for_hybrid_agent -hybrid_agent_name=<hybrid_cloud_agent> - hybridgateway_agent_list=<hybrid_cloud_gateway_agents_to_disassociate> Multiple Gateway Stop the Gateway and Hybrid agents will get switched to new Master Gateway. You can also run the EMCLI that will cause the OMS to switch the Master to one of the Slave Gateways emcli delete_hybridgateway_for_hybrid_agent -hybrid_agent_name="hybrid_agent_name" - hybridgateway_agent_list="master_gateway_agent" Decommissioning Agents (Historical Data cleanup) From Home page of the Agent Agent menu Target Setup Agent Decommission Use Enterprise Manager based Patch Plan to patch multiple Gateways and Hybrid Agent 15

16 Documentation Management Chapter in EM Admin Guide FAQ Video : Oracle Cloud service creation to Gateway, Hybrid Agent deployment Resource Page on em.us This PPT will be uploaded to em.us Oracle Confidential Internal/Restricted/Highly Restricted 16