Friday, June 26, 2009

Oracle Apps DBA preparation II

I hope you have gone through Oracle apps 11i Architecture , installation & File system. If you are reading this post without reading Part I which is at http://reddba.blogspot.com/.html then please first go through it first then only you can appreciate this post.

By Now You know Apps Architecture , Installation 11i Apps & you had a glance Filesystem of Oracle Apps Vision Instance (If you don't understand all directories in file system don't worry, It took 2 years for me to understand various directories in Apps 11i)

Next you should try is Start Stop Oracle application 11i Services .
Order of Startup is 
First Database Services & then Application Tier Services (Middle Tier)
Order of Shutdown is 
First Application Tier Services & then Database.

In order to check How to Start Stop Oracle apps 11i Middle Tier services & where are shutdown / startup script exist check http://reddba.blogspot.com/2009/04/startup-shutdown-apps-services.html

Database & DB Listener startup / shutdown scripts are under $ORACLE_HOME/appsutil/scripts/$CONTEXT_NAME or $ORACLE_HOME/appsutil/scripts/$SID ( depending on your Apps 11i & AD version )

addbctl.sh is used to control database . Start/Stop database
addlnctl.sh is used to control database listener ( Note that database listener is different from Apps listener)

Try starting stopping services or better open startup / shutdown scripts to check what all they are doing (These are shell files & you can open them by any editor like vi in Unix & notepad on windows)

Apps 11i DBA preparation

As part of your Oracle Apps DBA training will include
roles & responsibilities of oracle Apps DBA.

1. Apps Architecture 
This is key topic & you should be very clear about Oracle Applications/E-Business Suite
11i components & Architecture. This is base of your knowledge & if you are not clear about
various components & uses it will be quite difficult in learning Apps.
Where to find Oracle Applications 11i architecture in Ocean of oracle Application
technical documentation. Well I agree with you go straight to http://download-uk.oracle.com/docs/cd/B25516_08/current/acrobat/11iconcepts.pdf and go through chapter 1 (Page 13 to Page 32 Just 20 Pages)

2. Installing Apps 11i
Next point in apps dba training is Oracle Apps 11i Install using Rapid Install preferably on Linux/Unix
Where to find Rapid Install 11i Oracle Apps Guide This is guide by Oracle http://download-uk.oracle.com/docs/cd/B25516_08/current/acrobat/r115102ins.pdf for a start Chapter 1 & 2 are enough page 13 to p 63 is enough to understand Installation)
Where to find Discs / software for Oracle Apps 11i E-Business Suite : You can download it via http://edelivery.oracle.com or order it via your Metalink account . Once you got CD , please do install Apps atleast once in order to understand & to familiarize your self with Oracle Applications

3. Apps 11i File System/Software 
Once you installed applications 11i using above guide on Unix/Windows/Linux software then login as Operating System User & check directories while going through document
http://download-uk.oracle.com/docs/cd/B25516_08/current/acrobat/11iconcepts.pdf Chapter 2 Applications File System (P39- 48) very important in understanding Database Server & Application Server Tier & various tops like DATA_TOP, ORA_TOP, APPL_TOP, COMN_TOP, AD_TOP....
If you know your applications 11i File system you know where to find particular component files & logs .

Tuesday, April 28, 2009

Configure SSL to Web Server

Yesterday we looked at SSL overview in Oracle Applications 11i, you can look at that post from link

What is SSL ?
SSL stands for Secure Socket Layer which is protocol developed by Netscape. Data Transferred between Server & Client is Secured (Encrypted)

Why I need a SSL in Oracle Applications ?
Usually data transmitted between client machine & server (Web Server on http protocol & Forms Server on Sockets ) is clear text packets. Any one can put Packet Sniffer between Client machine & Server & can open & read all data transaction between your machine & Server (If he/she has network access) Hacker can get your Username/Password or any sensitive data. This become critical when you have Internet access to Oracle Applications 11i (Usually Self Service Implementation)

Where I need to configure SSL in Apps ?
Communication between Client & Oracle Applications happen via three components.
--Oracle Web Server (Initial Connection & all self service access is via Web Server/Apache). If your Form Server is in servlet Mode then Core Applications are also accessed via Web Server (Jserv Component)
--Oracle Form Server : For Core Oracle Application Access (Forms)
--Database : You access web server which in turn talks to database Server via UTL_HTTP package via dad (/pls/$SID)

So You enable SSL on particular component depending on your requirement & component which is accessible over Internet & should be secured. You can Implement across all three component or only one or any two.

What is common deployment for Internet Facing Oracle Applications ?
Though you can configure SSL for Web, Forms & database for extra Security but Usually most prone & Internet facing component is Web Server (For Self Service Applications) so common trend is to Enable SSL between Client Machine & Web Server (Apache) in Oracle Applications.

What will happen w.r.t. Data communication after enabling SSL ?
By default you access Applications over HTTP (Hyper Text Transfer Protocol) but after enabling SSL on web server you will access via HTTPS (Secure) . Data will be encrypted at one end & decrypted at other end.

Lets continue with where we left yesterday

What happens when we enable SSL in Oracle Web Server ?
I am assuming that SSL is already enabled at web server , so you type url with protocol as https (where s stands for Secure ), web server understand that this is SSL request so Web Server sends its certificates back to client stating its identity & with that its send a Public key which your browser use to encrypt & decrypt message send by Web Server . Web Server uses its private key(known to itself only, stored in either wallet or ssl directory discussed later in this post) & public key(key which is known to everyone) to encrypt & decrypt messages. SSL has build in feature which assures that data is not tempered with its from valid source . If you don't understand all this at this minute don't worry you still can configure SSL. This entire concept is called as PKI (Publick Key Infrastructure)

Myth about SSL Port in webserver ?
Do I need to only Use on port 443 for Web Server SSL Port ?? not at all , port 443 is standard port for HTTPS as port 80 for HTTP. You can use HTTPS on any port as long as port is listening for HTTPS requests .

Overview of Steps in configuring SSL over Web Server in Oracle Apps 11i ?
I am mentioning over view of configuring SSL on web server in Oracle Applications (If you wish to configure SSL for Forms Server & Database Servers ) Steps mentioned here are for Autoconfig Enabled system & Apache 1.0.2.2.2 and higher  
1. Create your SSL Certificates (I'll cover later how to generate SSL certificates for Web Server)
2. Configure SSL parameters for web server variables via OAM or by changing Context File (xml file in APPL_TOP) These parameters I'll discuss shortly.
3. Copy SSL Certificates created in step1 above, in SSL directories (Discussed Later) or Wallets (If you are using Oracle Wallets to store your certificates)
4. Run Autoconfig to take new parameters to take into effect
5. Test Applications with SSL

Please note that above steps are for implementing SSL only on Web Server there are additional steps if you want to configure SSL on Form Server & Database Server . (I am not mentioning them here as this is not common)

What is meant by creating SSL Certificates ?
You remember above I discussed that server sends its certificates (public) to browser & uses private key to encrypt & decrypt messages . So steps in creating Certificates are
1. Create Private key using openssl
2. Create certificate request using private key created above
3. Submit request file to Certifying Authority like verisign
4. Get Certificates from certifying Authority (CA)
If you are testing SSL you can use test certificates supplied with Web Server

What are various parameters in XML file (CONTEXT File) w.r.t. SSL ?
s_web_ssl_directory - Directory where SSL certificates are stored
s_url_protocol - https means you are using ssl (Default is http)
s_local_url_protocol - change it to https for SSL
s_webssl_port - Apache SSL port
s_active_webport - same as s_webssl_port
s_webport - same as s_webssl_port

Lot more coming in next post on configure SSL with Oracle Apps 11i...

SSL Overview in Apps

Today I am going to cover overview of SSL & various components of oracle Apps in which you can configure SSL.


What is SSL ?
SSL stands for Secure Socket Layer which is protocol developed by Netscape. Data Transferred between Server & Client is Secured (Encrypted)

Why I need a SSL in Oracle Applications ?
Usually data transmitted between client machine & server (Web Server on http protocol & Forms Server on Sockets ) is clear text packets. Any one can put Packet Sniffer between Client machine & Server & can open & read all data transaction between your machine & Server (If he/she has network access) Hacker can get your Username/Password or any sensitive data. This become critical when you have Internet access to Oracle Applications 11i (Usually Self Service Implementation)

Where I need to configure SSL in Apps ?
Communication between Client & Oracle Applications happen via three components.
--Oracle Web Server (Initial Connection & all self service access is via Web Server/Apache). If your Form Server is in servlet Mode then Core Applications are also accessed via Web Server (Jserv Component)
--Oracle Form Server : For Core Oracle Application Access (Forms)
--Database : You access web server which in turn talks to database Server via UTL_HTTP package via dad (/pls/$SID)

So You enable SSL on particular component depending on your requirement & component which is accessible over Internet & should be secured. You can Implement across all three component or only one or any two.

What is common deployment for Internet Facing Oracle Applications ?
Though you can configure SSL for Web, Forms & database for extra Security but Usually most prone & Internet facing component is Web Server (For Self Service Applications) so common trend is to Enable SSL between Client Machine & Web Server (Apache) in Oracle Applications.

What will happen w.r.t. Data communication after enabling SSL ?
By default you access Applications over HTTP (Hyper Text Transfer Protocol) but after enabling SSL on web server you will access via HTTPS (Secure) . Data will be encrypted at one end & decrypted at other end.

More on
How Data Encryption Happens ....
Is there any performance overheads ....
What is openssl & oracle Wallets ...
How to configure SSL in Oracle Apps 11i ...
and lot more on SSL coming in Next Post

How to change Hostname on Apps Instance

You sometime have to change hostname or domainname of your Apps Instance , today's post list various options & things you need to note while changing hostname on your existing Apps Instance.

Use cloning for changing hostname or domainname
I am sure you might be surprised to see how cloning can change hostname or domainname , yes you are right cloning will not change host or domain name but cloning can be used to change pointers to old hostname or domainname in Apps Instance after changing hostname/domainname by operating system commands. Steps you have to do is

Run adpreclone on Instance where you want to change hostname/domainname
Release Unix/Linux machine to sysadmin for changing hostname
Run postclone with new hostname/domain with same SID to change new name into effect

Above method is easy & best which I can think .

Use Autoconfig to change hostname or domainname of machine hosting apps Instance
If Machine on which you want to change hostname/domainname is on application tier then you just change entries in $CONTEXT_NAME.xml
Change hostname or domainname using operating system commands
execute autoconfig on that Instance so that application tier register new hostname/domainname

If machine on which you want to change host/domain name also host Database Tier then you also need to Deregister database tier from Net Service Topology Model & Reregister it with new hostname settings.
If you want to learn more about Net Service Topology Model follow Metalink Note # 218089.1 Autoconfig FAQ Under Section Net Services Question 28 to 41

For exact steps on how to change hostname using Autoconfig follow Metalink Note # 338003.1 How to change the hostname and/or port of the Database Tier using AutoConfig

I recently completed OCA for Application Server Exam 1Z0-311 and will be sharing my experience with Oracle Certification for Application Server with you all. Stay tuned on Oracle Application Server Certification 1Z0-311 & lot more things.

Your feedback/comment is quite important for improving this blog so feel free to leave your comments & suggestions

Standby Site for Apps 11i

Lets continue from last two post on Dataguard which are at

 

Today I am going to cover Dataguard which is used for business continuity for Oracle Applications 11i including fusion middleware (Using AS Guard). There are two types of standby databases Physical Standby Database & Logical Standby database. Since oracle applications currently support only physical standby database , I am going to cover only physical standby databases.

Overview of Dataguard & Dataguard Broker
Dataguard consist of one primary database & one or more standby database where primary & standby databases are connected by sqlnet (How to configure this check in coming posts). These primary & standby database can be monitored by command line (sql) as well from GUI (Graphical User Interface) Tool called as Dataguard broker.

Important Services in Dataguard configuration
Two very important services in dataguard configuration are Redo Transport Service & Log Apply Services. In order to keep standby database in synch with primary database ; redo transport service transfer(Pull/Push) redo logs from primary to standby database & Log apply service applies that redo logs to standby database.

Switchover & Failover
These are basically two kind of roles in dataguard Failover & Switchover; In Switchover Primary database becomes standby database & one of (If there are more than one standby) standby database becomes primary database for ex. during server maintenance. Failover is used in scenarion in which your primary database is not available and you want to convert role of one of standby database to primary database for ex. during primary database failure.

Data Protection Mode
Standby database in dataguard configuration can be configured in any of three protection mode which can be changed later as well depending on your requirement . These protection modes are Maximum Protection Mode , Maximum Availability Mode & Maximum Performance Mode.

Maximum Protection Mode
In maximum protection mode as name suggest no data loss will occur if primary database fails. This is achieved by oracle by ensuring that redo data must be written to both local online redo log location & standby redo log location before transaction commits. This standby redo log will ensure full data protection. For full protection mode atleast one standby database should have standby redo log and LGWR, SYNC, and AFFIRM attribute should be used with LOG_ARCHIVE_DEST_n parameter. (I am going to discuss about these parameters in next post)
Here your primary database will shutdown if it is unable to write redo records to atleast one standby location.

Maximum Availability Mode
This is similar to Maximum protection mode except that it will not shutdown primary database if primary database is not able to write standby redo logs to atleast one standby location but in that case Maximum Availability will act in Maximum Performance Mode until fault is corrected and all gaps in redo logs are resolved. Once all gaps are resolved primary database will automatically goes into Maximum Availability Mode.

Maximum Performance Mode
This is default mode in which redo stream is written asynchronously with respect to the commitment of the transactions that create the redo data. You can use LGWR and ASYNC attribute or ARCH attribute in LOG_ARCHIVE_DEST_n

You can check your database mode as

SQL> select PROTECTION_LEVEL from v$database;
PROTECTION_LEVEL
----------------------------
MAXIMUM PERFORMANCE
 
Today I am going to cover step by step configuration for Oracle Dataguard & may be in next or future posts I will discuss on common mistakes which you can do while configure dataguard / standby database.

Below steps are based on assumptions that Primary Database is on Machine1.domain.com & Standby database is on Machine2.domain.com . Database Instance Name is PROD and database listener is listening on port 1525. Mount point on primary & standby database are same (If they are not you need to set parameter db_file_convert)

Assumptions
I am assuming using LGWR, ASYNC option with log shipping service which means ,
LGWR (Log Writer process will be used to write to standby site instead of ARC archiver process)
ASYNC (Redo logs to standby is asynchronous to primary site)

You may have to change options with log shipping service (LOG_ARCHIVE_DEST_n) depending on data protection mode you wish to choose. (I am using Maximum Performance Mode - Default Mode)

Enable Archive log
For standby database configuration your primary database should be running in achieve log mode. In order to convert your primary database into archive log mode follow these steps

SQL> SHUTDOWN
SQL> STARTUP MOUNT
SQL> ALTER DATABASE ARCHIVELOG;
SQL> ALTER DATABASE OPEN;

SQL> alter system set LOG_ARCHIVE_DEST_1 ='LOCATION=/u01/oracle/data/arch' scope=spfile; (I am assuming that you are using spfile here , if you are using pfile skip scope=spfile)

SQL> alter system set LOG_ARCHIVE_DEST_2 ='SERVICE=PROD_remote1.domain.com LGWR ASYNC REOPEN=60' scope=spfile; (We will create above TNS Alias in next step)
SQL> alter system log_archive_dest_2='DEFER' (Defer this until you have standby system Up)

SQL> shutdown immediate
SQL> startup

You should see archive logs generated after this on standby site

Enable Force Logging
You should enable Force logging in primary database else if some transaction which doesn't generate redo log can corrupt your standby database. (Careful in OLTP transactions or long running requests in Apps)
SQL> ALTER DATABASE FORCE LOGGING;

Set Initialization Parameter
SQL> alter system set fal_client = Â’PROD.domainname.comÂ’ scope=both;
SQL> alter system set fal_server = Â’PROD_remote1.domainnameÂ’ scope=both;
(Here FAL, Fetch Archive Log is used to fetch archives in case gap in archives arises because of any reason)

SQL> alter system set STANDBY_FILE_MANAGEMENT=AUTO scope=both; (This is used to automatically generate file in standby site like if you add a datafile, this will create one in standby site as well)

Create Standby Control file & copy datafile including oracle_home
Create standby control file as
SQL> alter DATABASE CREATE STANDBY CONTROLFILE AS '/u01/oracle/home/standby.ctl'

You can installed New Database on standby site or Use ORACLE_HOME software from primary site on standby site.
Copy datafiles, redologs, initializations file, tnsnames.ora, listener.ora & control file from primary site to standby site.
 

Today lets conclude dataguard/standby configuration & look at Metalink note on Dataguard configuration in Apps 11i with database 9i & 10g.

After creating standby control file and moving datafiles, redo log, control file,tnsnames.ora to standby site , start standby database as mentioned below using standby control file.

SQL> startup mount

In order to put standby database in managed recovery you can use

SQL> ALTER DATABASE RECOVER MANAGED STANDBY DATABASE DISCONNECT FROM SESSION; (On standby site)

To Cancel recovery you can use
SQL> ALTER DATABASE RECOVER MANAGED STANDBY DATABASE CANCEL;

All these sql's are available in Standby Configuration guide so your can refer guide mentioned in my first post on standby database.

Failover/Switchover
Failover is used if you loose your primary database or wish to break relationship between primary & standby database & convert standby database in to primary database.
Switchover is used to change role of primary to standby & vice versa.

For configuring Dataguard as Disaster Recovery solution in Oracle Applications 11i use Metalink Note # 216212.1 Business Continuity for Oracle Applications Release 11i, Database Releases 9i and 10g

Next level of Business Continuity is Application Server Guard (Currently for Standalone Application Server only) which includes middle tier recovery including database. AS Guard (Application Server Guard) also called as DSA is used for seamless Integration of Disaster Recovery solution for both Middle Tier & Database Tier. I am going to cover how to configure AS Guard in future.

Stay tuned to learn how to configure Single Sign On (SSO) access to HTMLDB / Apex Applications ......

Configure Dataguard / Standby database

Yesterday we looked at Data Guard overview in Oracle Database  
Today I am going to cover Dataguard which is used for business continuity for Oracle Applications 11i including fusion middleware (Using AS Guard). There are two types of standby databases Physical Standby Database & Logical Standby database. Since oracle applications currently support only physical standby database , I am going to cover only physical standby databases. Overview of Dataguard & Dataguard BrokerDataguard consist of one primary database & one or more standby database where primary & standby databases are connected by sqlnet (How to configure this check in coming posts). These primary & standby database can be monitored by command line (sql) as well from GUI (Graphical User Interface) Tool called as Dataguard broker.Important Services in Dataguard configurationTwo very important services in dataguard configuration are Redo Transport Service & Log Apply Services. In order to keep standby database in synch with primary database ; redo transport service transfer(Pull/Push) redo logs from primary to standby database & Log apply service applies that redo logs to standby database.Switchover & FailoverThese are basically two kind of roles in dataguard Failover & Switchover; In Switchover Primary database becomes standby database & one of (If there are more than one standby) standby database becomes primary database for ex. during server maintenance. Failover is used in scenarion in which your primary database is not available and you want to convert role of one of standby database to primary database for ex. during primary database failure.Data Protection Mode Standby database in dataguard configuration can be configured in any of three protection mode which can be changed later as well depending on your requirement . These protection modes are Maximum Protection Mode , Maximum Availability Mode & Maximum Performance Mode. Maximum Protection Mode In maximum protection mode as name suggest no data loss will occur if primary database fails. This is achieved by oracle by ensuring that redo data must be written to both local online redo log location & standby redo log location before transaction commits. This standby redo log will ensure full data protection. For full protection mode atleast one standby database should have standby redo log and LGWR, SYNC, and AFFIRM attribute should be used with LOG_ARCHIVE_DEST_n parameter. (I am going to discuss about these parameters in next post)Here your primary database will shutdown if it is unable to write redo records to atleast one standby location.Maximum Availability ModeThis is similar to Maximum protection mode except that it will not shutdown primary database if primary database is not able to write standby redo logs to atleast one standby location but in that case Maximum Availability will act in Maximum Performance Mode until fault is corrected and all gaps in redo logs are resolved. Once all gaps are resolved primary database will automatically goes into Maximum Availability Mode.Maximum Performance ModeThis is default mode in which redo stream is written asynchronously with respect to the commitment of the transactions that create the redo data. You can use LGWR and ASYNC attribute or ARCH attribute in LOG_ARCHIVE_DEST_nYou can check your database mode asSQL> select PROTECTION_LEVEL from v$database;PROTECTION_LEVEL----------------------------MAXIMUM PERFORMANCE

Today I am going to cover step by step configuration for Oracle Dataguard & may be in next or future posts I will discuss on common mistakes which you can do while configure dataguard / standby database.


Below steps are based on assumptions that Primary Database is on Machine1.domain.com & Standby database is on Machine2.domain.com . Database Instance Name is PROD and database listener is listening on port 1525. Mount point on primary & standby database are same (If they are not you need to set parameter db_file_convert)

Assumptions
I am assuming using LGWR, ASYNC option with log shipping service which means ,
LGWR (Log Writer process will be used to write to standby site instead of ARC archiver process)
ASYNC (Redo logs to standby is asynchronous to primary site)

You may have to change options with log shipping service (LOG_ARCHIVE_DEST_n) depending on data protection mode you wish to choose. (I am using Maximum Performance Mode - Default Mode)

Enable Archive log
For standby database configuration your primary database should be running in achieve log mode. In order to convert your primary database into archive log mode follow these steps

SQL> SHUTDOWN
SQL> STARTUP MOUNT
SQL> ALTER DATABASE ARCHIVELOG;
SQL> ALTER DATABASE OPEN;

SQL> alter system set LOG_ARCHIVE_DEST_1 ='LOCATION=/u01/oracle/data/arch' scope=spfile; (I am assuming that you are using spfile here , if you are using pfile skip scope=spfile)

SQL> alter system set LOG_ARCHIVE_DEST_2 ='SERVICE=PROD_remote1.domain.com LGWR ASYNC REOPEN=60' scope=spfile; (We will create above TNS Alias in next step)
SQL> alter system log_archive_dest_2='DEFER' (Defer this until you have standby system Up)

SQL> shutdown immediate
SQL> startup

You should see archive logs generated after this on standby site

Enable Force Logging
You should enable Force logging in primary database else if some transaction which doesn't generate redo log can corrupt your standby database. (Careful in OLTP transactions or long running requests in Apps)
SQL> ALTER DATABASE FORCE LOGGING;

Set Initialization Parameter
SQL> alter system set fal_client = Â’PROD.domainname.comÂ’ scope=both;
SQL> alter system set fal_server = Â’PROD_remote1.domainnameÂ’ scope=both;
(Here FAL, Fetch Archive Log is used to fetch archives in case gap in archives arises because of any reason)

SQL> alter system set STANDBY_FILE_MANAGEMENT=AUTO scope=both; (This is used to automatically generate file in standby site like if you add a datafile, this will create one in standby site as well)

Create Standby Control file & copy datafile including oracle_home
Create standby control file as
SQL> alter DATABASE CREATE STANDBY CONTROLFILE AS '/u01/oracle/home/standby.ctl'

You can installed New Database on standby site or Use ORACLE_HOME software from primary site on standby site.
Copy datafiles, redologs, initializations file, tnsnames.ora, listener.ora & control file from primary site to standby site.

Other steps & few important things w.r.t. dataguard coming in Next Post...