State of Wisconsin Database Hosting Services Roles and Responsibilities

Transcription

1 State of Wisconsin Hosting Services oles and esponsibilities

2 Document evision History (Major Post Publishing evisions Only) Date Version reator Notes 12/9/

3 This document describes the Hosting Services roles and responsibilities as they are assigned to the DOA Division of Enterprise Technology (DET) and state agencies that subscribe to the service. A separate document, Hosting Service Offering Definition, fully details this service and should be referred to for that description. For descriptions of the many services offered by DET to agencies, please see the IT Services atalog ( Hosting falls under the Hosting category. Specific distinction between what DET does for the agency and what the agency does itself depends upon the distinction between the terms system and application. The system end defines the functions performed by DET, any activity that is general to any database. This includes operations such as database software installation, creation of new database instances, enterprise-level planning for infrastructure such as networks and security, detailed interaction with the database vendor to resolve problems, and obtaining software updates. The system-level DBA is responsible for system (as opposed to application) performance and tuning, disaster recovery planning and related backup/recovery activities, patch application and version upgrades, high-level storage allocation and resource planning, and other such activities that require administrator-level access to the databases or the operating systems on which they run. The application DBA is responsible for anything specific to the agency's business applications. Typical activities include creating tables and indexes, reviewing data models and consulting with development staff, tuning code and database structures within applications, handling security issues that are internal to the agency (such as assigning roles to agency-specific IDs and consulting with agency security or business personnel on structuring database access), migrating data and database structures between environments as needed, and, in general, performing activities that require a specific knowledge of the agency's business and applications. In addition, agencies are responsible for the acquisition and installation of specific tools they choose to use in their development environments (such as TOAD for Oracle). A further responsibility of the DET system DBA is to work with agency personnel to find ways to allow them to perform the functions they need to get their work done. These oles and esponsibilities standards have been established for that purpose. These standards, however, are expected to be dynamic through evolving practices with agency feedback. odes: D E Administrative staff responsible for the activity onsulted about the activity esponsible through delegation Agency end user responsible for the activity Table 1. DET/Agency o-managed oles and esponsibilities esponsibility ategory 1 Application 2 Application esponsibility Manage application level objects as the object owner Manage application level objects as a user other than the object owner D 6, 20 D 4, 20 Hosting oles and esponsibilities 3 12/9/2010

4 esponsibility ategory esponsibility 3 Application 4 Application 5 Application 6 Application 7 Application 8 Application 9 Application 10 Application 11 Application 12 Application 13 Application 14 Application 15 Application 16 Application 17 Application 18 Application 19 Application 20 Application 21 Application 22 Backup and ecovery 23 Backup and ecovery 24 Backup and ecovery Provide technical assistance to application developers Design replication strategy for distributed application databases Implement replication for distributed application databases Establish application database naming conventions Troubleshoot and facilitate resolution of application database problems Open problem tickets with DBMS provider to resolve application database problems 4 3, 5 18 Provide application database on call support 2, 3, 4 Schedule agency application jobs including maintenance plans using database's internal job scheduler Schedule agency application jobs using O/S job scheduler (ron, trl-m, etc) reate application code objects that reside in the database (e.g., PL/SQL objects) Design business application Design application database objects in SQL Server, application schema objects in Oracle. reate application data model, including data definitions and other documentation Design and develop application business code that resides in the database (e.g., PL/SQL 4, 6, 9, 11 8 DE 6, 24 4, 6 DE 4, 6, 20 Write application SQL 6 Debug PL/SQL programs DE 2, 5, 23, Manage data updates in application tables (from inside or outside a business application). Prototype application database changes as a developer user (not the application object owner) Prepare applications for DBMS software upgrades and patches. Modify applications and Determine database backup/recovery strategy to enable recovery from disaster or system Backup Oracle databases, log files and software to enable recovery from disaster or system Backup SQL Server databases, log files and software to enable recovery from disaster or 24 DE 4, 6, 24 DE 21, Hosting oles and esponsibilities 4 12/9/2010

5 esponsibility ategory esponsibility 25 Backup and ecovery 26 Backup and ecovery 27 Backup and ecovery 28 Backup and ecovery 29 Backup and ecovery 30 Backup and ecovery 31 Backup and ecovery Manage the rollup, backup, archiving and deletion of database system log files (e.g., Determine strategy to back out/recover from application database changes and data changes Backup agency SQL Server application databases. Manage application database backup Backup agency Oracle application schemas. Manage application schema backup schedule. 22 D 9,11, 25 D 22 estore agency Oracle application schemas D 22 estore agency SQL Server databases D 9, 11, 17 Perform system-level database recoveries 9, onfiguration Manage Oracle standby databases, streams, other. 9, onfiguration 34 onfiguration Manage SQL Server replication configuration 9, 11 reate and drop database instances 9 35 onfiguration Assign application databases to appropriate database instances in SQL Server 36 onfiguration Assign application schemas to appropriate Instances in Oracle 9 37 onfiguration 38 onfiguration 39 onfiguration Manage database system parameters 9, 11 Manage database clustering 9 onfigure Oracle Text D 4 40 Manage system-level auditing (e.g., when and what rights were used) Manage application-level auditing (e.g., ad hoc developer access to production data) Define system-level database security standards, including database authentication method D 19, Define application-level database security standards 44 Manage access to database catalog or data dictionary 45 System-level user account creation Hosting oles and esponsibilities 5 12/9/2010

6 esponsibility ategory esponsibility 46 Application-level user account creation D 12, 13, System-level user password management 48 Application-level user password management D 13, Manage space quotas and defaults for systemlevel users Manage space quotas and defaults for application-level users System-level role creation D Application-level role creation D Assign privileges and roles to system users Assign application-level privileges and roles to application users Assign system-level privileges and roles to application users D 4, Manage user access from one Oracle instance to another at system level Manage application user access between local and remote Oracle application databases at Manage directories, i.e., provide access to flat files residing on a Gateway server D 4 D 2 Manage public synonyms D 4 Manage private synonyms for application users D 4 61 DBMS Software Monitor availability of DBMS patches and other fixes DBMS Software Identify DBMS software components to be installed and a standard software configuration 63 DBMS Software Plan and install DBMS patches (e.g., Oracle to ) 64 DBMS Software Plan and install DBMS upgrades (e.g., Oracle 9i to 10g) 65 DBMS Software Facilitate development of DBMS client install procedure DBMS Software oordinate DBMS client software upgrades and patch installs with DBMS server upgrades and 67 DBMS Software Install and configure DBMS client software on Hosting oles and esponsibilities 6 12/9/2010

7 esponsibility ategory esponsibility workstations 68 DBMS Software onfigure database server to client connectivity 9, DBMS Software Deploy Oracle Net client configuration file updates to database servers 70 DBMS Software Provide agencies with Oracle Net client configuration files and updates 71 DBMS Software oordinate deployment of Oracle Net client configuration files within agencies 72 Network Enable network communication between database servers and clients (e.g., firewall 73 O/S Install and configure database server hardware and O/S 9, O/S 75 O/S 76 O/S 77 O/S 78 O/S 79 O/S onfigure O/S clustering Define server security standards reate O/S user accounts for system and application database administrators. System database administrators on Unix would belong to DBA group. System database administrators on Windows would be local admin. Application database administrators would have a subset of permissions given to system database administrators on the Oracle gateway servers. Manage OS directory structure Manage DBMS directory structure and contents (e.g., view directory content, add/delete directories, add/delete files, create, view, modify, and delete share, directory and file permissions) on the Oracle gateway servers. Manage agency-specific directory structure and contents (e.g., view directory content, add/delete directories, add/delete files, create, view, modify, and delete share, directory and file permissions) 1 D O/S Troubleshoot and resolve O/S, cluster and network-related server problems 81 O/S Monitor availability of O/S patches 82 O/S Install O/S patches 83 O/S Schedule database system-support jobs including maintenance plans Hosting oles and esponsibilities 7 12/9/2010

8 esponsibility ategory esponsibility 84 Performance and Tuning Monitor database system-level performance 3 85 Performance and Tuning Monitor application database performance D 3, 4, 7 10 DET exclusively manages MS SQL Servers, though in a customer-dedicated database server environment an agency may open a service request to request access to non-production servers as outlined in Table 2. Table 2. Independent Administrative Activities in a Dedicated SQL Environment Dedicated Non-Production MS SQL Servers Dedicated MS SQL Production Servers and All Shared MS SQL Servers 1 emote access to the environment oordinated activity performed by DET Staff 2 Local Administrative rights to the server oordinated activity performed by DET Staff 3 Ability to execute scripts interactively on a SQL Server Scripts scheduled in SQL job system, or via service request 4 Administrative control over all OS and SQL Scheduled jobs 5 Direct access to run SQL Profiler tools 6 Interactive bulk insert on a SQL Server 7 Interactive system monitoring with perfmon.exe Full control over agency specific jobs that do not require a systems administrative context SQL to execute Profiler trace available via service request Bulk insert from a client, or via scheduled job by service request. System monitoring via service request 8 Full access to SQL Activity Monitor SQL Monitor access by request 9 User creation oordinated activity performed by DET Staff Table 3 represents activities that are directly available to agency technical staff in a dedicated SQL Server database environment that DET recommends coordinating through a service request. These systems level functions are closely tied to the availability and recoverability of a server. Inappropriate use could result in server down time, and data loss to the customer. Table 3. oordinated Administrative Activities in a Dedicated SQL Environment Dedicated Non-Production MS SQL Servers Dedicated MS SQL Production Servers and All Shared MS SQL Servers 1 sp_configure oordinated activity performed by DET Staff Hosting oles and esponsibilities 8 12/9/2010

9 Dedicated Non-Production MS SQL Servers Dedicated MS SQL Production Servers and All Shared MS SQL Servers 2 Alter DB oordinated activity performed by DET Staff 3 Ability to restore a databases oordinated activity performed by DET Staff 4 creation oordinated activity performed by DET Staff 5 eplication configuration oordinated activity performed by DET Staff Notes Note 1 2 How is this provided? Access through Gateway Server for all UNIX files and services; Service equest if needed for further assistance Access to database files through Gateway Server. For Oracle, a Gateway server is a Linux file server / application server that is made available to agencies to support their applications. For SQL Server a Gateway server is any agency Windows files server. 3 Access to Oracle Enterprise Manager/Grid ontrol 4 DBA role granted to agency DBAs 5 Explain Plan role granted by DBAs 6 Access to schema owner ID/password 7 Standard DBMS tools 8 Access to UNIX services through Gateway Server 9 Agency submits Service equest 10 Agency staff may escalate application performance issues to system DBAs for resolution using system tools via Service equest 11 Agency submits a Problem ticket 12 Agency provides user ID requirements 13 Agency staff can change their SQL passwords 14 DBA role granted to agency DBAs (with triggers to restrict scope to agency IDs) 15 DBA role granted to agency DBAs (with triggers to restrict scope to agency storage space) 16 DBA role granted to agency DBAs and/or agency submits Service equest 17 Agency provides recovery requirements 18 Delegated access to Oracle Metalink 19 Delegated access to Oracle Metalink and documentation on Technet; testing through access to schema owner ID/password & DBA role granted to agency DBAs 20 Delegated permissions through UNIX groups on Gateway Servers 21 Grants from schema owner ID 22 Import/export enabled by access to schema owner ID/password & DBA role Hosting oles and esponsibilities 9 12/9/2010

10 Note How is this provided? granted to agency DBAs; running & scheduling can be done through Gateway Server 23 Plus Trace feature enabled by system DBA, granted by application DBA 24 Summary of basic SQL Server rights delegation: We will assign rights to the db_owner group for an agency database, to the designated agency user. Agency staff belonging to the db_owner group grants objects level access to other agency SQL users. 25 Agency outlines backup schedule requirements Hosting oles and esponsibilities 10 12/9/2010