Kernel settings on Solaris 10

Actually the main change is setting of shmsys:shminfo_shmmax by project.max-shm-memory in /etc/project.
One can also add noexec_user_stack=1 to /etc/system, but it requires further reboot of a system. Other modifications can be not performed.

Script for parsing *.ora files

The script below is able to parse *.ora files - mainly tnsnames.ora or listener.ora, though it should properly deal with other files with this Oracle syntax (complex values build by nested brackets, simple ones as pairs of key and value).

It is not complete (probably list of keywords in @keywords does not exhaust all possibilities, but it is enough to rebuild it with new entries).
Data::Dumper module is not a must - it is used only for debugging purposes and can be removed.

Lately I have got a question what licensing I would apply to this script and here some rules:

• the script is free of charge
• I would like to be still presented as an author ;-)
• one can not distribute and charge for it (which does not mean it can not be added as a kind of "free" bonus to something commercial, but it must be stated so somewhere)
• one may modify the script along to the needs - it would be nice to return changes to me assuming they have a general character (so are not bound to some local environment)

The script in more edible form

#!/usr/bin/perl -w
## ----------------------------------------------------------------
## $Id: ora_tns_parser.pl,v 1.2 2012/11/22 23:16:00 rems Exp $
## @action: parses *.ora files
## $Author: Remigiusz Sokolowski <rems@wp.pl> $
## $Date: 2007/10/15 10:50:15 $
## $Revision: 1.2 $
##
## Opis
## $Log: ora_tns_parser.pl,v $
## Revision 1.1  2007/10/15 10:50:15  rems
## tool for parsing *.ora files (mainly tnsnames or listener)
##
## parses provided *.ora file and returns pairs in the form
## key:value
## ALL - default; all pairs
## CUSTOM - alias/listener pairs (i.e. no parameters)
## LISTENERS_AND_PASSWORDS - pairs listener:encoded password (relevant only for listener.ora)
## NAMES - only keys - alias/listener names
##
## Usage
## ===================
## ./ora_tns_parser.pl <format> <path>
##
## Revision 1.2 2012/11/22 23:16:00 rems
## fix for bugged behavior when specific *.ora format in use (one line entry)
## not tested yet completely 
## ----------------------------------------------------------------

## arguments
my $fmt = shift;
my $fname = shift;

## modules and constant variables
my %formats = (
'ALL'    => 1, #default
'CUSTOM' => 1,
'LISTENERS_AND_PASSWORDS' => 1,
'NAMES'  => 1
);

my @keywords = (
'INBOUND_CONNECT_TIMEOUT',
'LOG_DIRECTORY',
'LOG_FILE',
'LOGGING',
'PASSWORDS',
'SAVE_CONFIG_ON_STOP',
'SID_LIST',
'TRACE_DIRECTORY',
'TRACE_FILE',
'TRACE_LEVEL'
);

use strict;
use warnings;
use Data::Dumper;

## functions
sub trim {
my $string = shift;
$string =~ s/^\s+//;
$string =~ s/\s+$//;
return $string;
}

## counting instances of the provided x char in string tval
sub _count_chars {
my $x = shift;
my $tval = shift;
my @chars = split(//, $tval);
my $ch;
my $counter = 0;
foreach $ch (@chars) {
if ($ch eq $x) {
$counter++;
}
}
return $counter;
}

## whole algorithm depends on counting brackets
sub parse_tns_addr {
my $lines = shift;
my $i = shift;
my $tval = shift;
my $level = shift;

my $numL = _count_chars('(', $lines->[$i]);
my $numP = _count_chars(')', $lines->[$i]);
$level = $level + $numL - $numP;

if ($level <= 0) {
return ($i, $tval, 0);
} else {
$tval = $tval . trim($lines->[++$i]);
($i, $tval) = parse_tns_addr($lines, $i, $tval, $level);
}
}

## execution
my @lines;
my $line;
open(FH, "< $fname");
while (<FH>) {
chomp;
$line = trim($_);
if ($line !~ m/^#/ && $line !~ m/^\s*$/) {
push(@lines, $_);
}
}
close FH;

my $i=0;
my $pname = '';
my $pval = '';
my %params;

my @tmp;
my $trimmed = '';
for ($i=0; $i<@lines; $i++) {
## if sign '=' is not in line, it must be in the next one
if ($lines[$i] !~ m/=/) {
$lines[$i+1] = $lines[$i].$lines[$i+1];
$i++;
}
if ($lines[$i] =~ m/=/) {
## if in line there is '=', we split at first equality sign
if ((my $pos = index($lines[$i], "=")) >= 0) {
$tmp[0] = substr($lines[$i], 0, $pos);
$tmp[1] = substr($lines[$i], $pos+1);
} else {
$tmp[0] = $lines[$i];
}
$pname = trim($tmp[0]);

$trimmed = defined $tmp[1] ? trim($tmp[1]) : undef;
## if first char is '(', complex entry
if (@tmp>1 && substr($trimmed,0,1) eq '(') {
($i, $pval) = parse_tns_addr(\@lines, $i, $trimmed, 0);

## if not and entry has some not empty value, simple entry
} elsif (@tmp>1 && $trimmed ne '') {
$pval = $trimmed;

## it is possible, that value is in next line/s
} else {
$i++;
$trimmed = trim($lines[$i]);
if (substr($trimmed,0,1) ne '(') {
$pval = $trimmed;
} else {
my $level;
($i, $pval) = parse_tns_addr(\@lines, $i, $trimmed, 0);
}
}
$params{$pname} = $pval;
} else {
## if not, and we have no empty lines, probably wrong syntax in file
die "probably wrong syntax at line $i!"
}
@tmp = ();
$pname = '';
$pval  = '';
}

## for debugging purposes
#print "++++++++++++++++++++++++++\n";
#print Dumper(%params);
#print "++++++++++++++++++++++++++\n";

## we parse our list to throw away not needed entries
my $keyword;

## trimming output according to format
my $flg_del = 0;
if (defined $formats{$fmt} && $fmt ne 'ALL') {
foreach $pname (keys %params) {
foreach $keyword (@keywords) {
if (substr($pname, 0, length $keyword) eq $keyword) {
$flg_del = 1;
if ($fmt eq 'LISTENERS_AND_PASSWORDS' && $keyword eq 'PASSWORDS') {
$params{substr($pname, 1 + length 'PASSWORDS')} = $params{$pname};
}
}
}
if ($flg_del == 1) {
delete($params{$pname});
$flg_del = 0;
} elsif ($fmt eq 'LISTENERS_AND_PASSWORDS' && substr($params{$pname}, 0, 1) eq '(') {
## a little ugly hack, assuming that entries without keywords
## with values starting with "(" are certainly custom names
## i.e. listener names
$params{$pname} = '';
}
}
}

## output
my $format = (defined $formats{$fmt} && $fmt eq 'NAMES') ? "%s\n" : "%s:%s\n";
foreach $pname (keys %params) {
printf $format, $pname, $params{$pname};
}

Joining Grid Control with SNMP framework

I realize it would be fine to connect our Grid Control (GC) installation with another monitoring tool our sysadmins use to control whole infrastructure.
With GC it is possible in two ways:

1. just monitor all databases, their listeners and their hosts with GC and allow for generating traps by GC
   
   This way is fairly simple and requires almost no work. The first thing is to add to GC notification methods on the "Setup" page yet another method as SNMP trap. As we need to cooperate with snmptrapd deamon fired somewhere (being for us a gateway to SNMP management framework), we just provide 4 parameters to it. The next step is to check in the "Preferences" page in which areas a GC installation should generate SNMP traps. That is all - of course we need some software behind snmptrapd which takes the trap in order to service it.
   
   
2. start SNMP agents responsible for communication with SNMP management framework and a "bridge" between GC agents and SNMP agent
   

Licences

The Grid Control fascilities are provided for free for properly licensed products. It means that the database used for the repository does not require additional licences as well as the used application server as far as the Grid Control is the only thing on the database.

Well, I am not quite right - there can be installed for example also RMAN repository and other additional software provided for free by Oracle for monitoring and maintaining Your other properly licenced Oracle software installations.

In general however the Oracle licensing is very misty and incomprehensible. Oracle Enterprise Manager Licensing does not clear about OEM itself, focusing on available packs, plugins, etc

Starting and stopping Grid Control up

To start the Grid Control services one need to run the following sequence of activities:

1. run database (first way)
• sh# export ORACLE_SID={sid}
• sh# sqlplus / as sysdba
• SQL# startup
• SQL# exit
• sh# lsnrctl start {listener_name}
2. run database (second way; one needs properly configured /etc/oratab)
• sh# ORACLE_HOME/bin/dbstart
3. run management services
• sh# OMS_HOME/opmnctl startall
4. optionally run agent to monitor also management repository and services
• sh# AGENT_HOME/bin/emctl start agent

To stop the Grid Control services one need to do all the stuff above in reverse way:

1. stop agent to monitor also management repository and services
• sh# AGENT_HOME/bin/emctl stop agent
2. stop management services
• sh# OMS_HOME/opmnctl stopall
3. stop database (first way)
• sh# export ORACLE_SID={sid}
• sh# sqlplus / as sysdba
• SQL# shutdown immediate
• SQL# exit
• sh# lsnrctl stop {listener_name}
4. stop database (second way; one needs properly configured /etc/oratab)
• sh# ORACLE_HOME/bin/dbshut

Policies used

Grid Control starts with quite high number of different policies (generally they have something to do with security issues). Of course it is recommended to apply all of them, though in general it is a little complicated. For example on one hand one should revoke EXECUTE privilege to let's say UTL_FILE from PUBLIC, while at the same time invalidating some synonyms within PUBLIC schema.

Here is shortcut of those policies toward database targets:

• Parameter SQL92_SECURITY should be set to true. The parameter enforces having SELECT privilege to run UPDATE or DELETE with SET or WHERE clauses (and usage of column values)
• Parameter GLOBAL_NAMES should be set to true. The parameter enforces a database link to have the same name as the database it connects to.
• Checks whether UTL_FILE_DIR is not used with Oracle RDBMS version 9i and later (instead should be used directories of course)
  
• Checks PUBLIC access to packages such as UTL_FILE, UTL_HTTP, UTL_SMTP, UTL_TCP, DBMS_LOB, DBMS_JOB, etc.
  
• Checks if all objects are VALID, so on start one should compile all invalid objects and possibly remove those, which do not compile properly.
  
• The password related settings for profiles in use should have non default values (default values mean usually UNLIMITED period). It particularly relates to PASSWORD_LIFE_TIME, PASSWORD_REUSE_TIME, PASSWORD_REUSE_MAX and PASSWORD_GRACE_TIME.

Glossary

• AGENT_HOME - location of the agent installed on target
• OMS_HOME - location of the Management Service
  
• ORACLE_HOME - location of the database