A-A+
RACcheck (RAC Configuration Audit Tool)使用介绍
RACcheck (RAC Configuration Audit Tool)使用介绍
这个工具不但方便dba对rac环境进行日常检查,而且也便于一线dba在rac出现问题时,将整个rac情况提交给oracle的sr快速处理问题。该工具只要将压缩包上传并解压即可运行,开始收集OS,CRS/GI,ASM,RDBMS等数据信息,完了再进行分析得出一个汇总文件,便于dba对问题的以及当前rac的状态做出评估。但是,该工具在我的实测中发现以下问题:第一,执行时间很长(不知道是不是我虚拟机的原因),第二,太耗用主机CPU资源。当然该工具的官方建议是每三个月进行检查一次,或者在rac升级前升级后,安装前等特殊时间执行也是有原因的。而该工具执行完后,会在生成一个.zip文件和一个类似awr报告的.html文件,.zip文件便于一线dba提交给oracle sr,.html文件便于dba分析当前rac的整体情况。
当前集群状态
[grid@11grac1 ~]$ crs_stat -t Name Type Target State Host ------------------------------------------------------------ ora....SM1.asm application ONLINE ONLINE 11grac1 ora....C1.lsnr application ONLINE ONLINE 11grac1 ora....ac1.gsd application ONLINE ONLINE 11grac1 ora....ac1.ons application ONLINE ONLINE 11grac1 ora....ac1.vip ora....t1.type ONLINE ONLINE 11grac1 ora....SM2.asm application ONLINE ONLINE 11grac2 ora....C2.lsnr application ONLINE ONLINE 11grac2 ora....ac2.gsd application ONLINE ONLINE 11grac2 ora....ac2.ons application ONLINE ONLINE 11grac2 ora....ac2.vip ora....t1.type ONLINE ONLINE 11grac2 ora.DATA.dg ora....up.type ONLINE ONLINE 11grac1 ora....ER.lsnr ora....er.type ONLINE ONLINE 11grac1 ora....N1.lsnr ora....er.type ONLINE ONLINE 11grac2 ora.asm ora.asm.type ONLINE ONLINE 11grac1 ora.eons ora.eons.type ONLINE ONLINE 11grac1 ora.gsd ora.gsd.type ONLINE ONLINE 11grac1 ora....network ora....rk.type ONLINE ONLINE 11grac1 ora.oc4j ora.oc4j.type ONLINE ONLINE 11grac2 ora.ons ora.ons.type ONLINE ONLINE 11grac1 ora.racdb.db ora....se.type ONLINE ONLINE 11grac1 ora.scan1.vip ora....ip.type ONLINE ONLINE 11grac2
将压缩包上传并解压
[oracle@11grac1 ~]$ ls -l total 2652 drwxr-x--- 3 oracle oinstall 4096 Aug 28 16:45 oradiag_oracle -rw-r--r-- 1 oracle oinstall 2705532 Jan 26 23:53 raccheck.zip [oracle@11grac1 ~]$ unzip raccheck.zip Archive: raccheck.zip inflating: raccheck inflating: readme.txt creating: .cgrep/ inflating: .cgrep/lcgreps11 inflating: .cgrep/lcgrep4 inflating: .cgrep/acgrep inflating: .cgrep/exalogic_zfs_checks.aksh inflating: .cgrep/lcgrep5 inflating: .cgrep/lcgreps10 inflating: .cgrep/hiacgrep inflating: .cgrep/lcgrep6 inflating: .cgrep/utlusts.sql inflating: .cgrep/asrexacheck inflating: .cgrep/lcgreps9 inflating: .cgrep/scnhealthcheck.sql inflating: .cgrep/utlu112i.sql inflating: .cgrep/scgrep inflating: .cgrep/scgrepx86 inflating: rules.dat inflating: UserGuide.txt inflating: collections.dat [oracle@11grac1 ~]$ ls -l total 19804 -rw-rw-r-- 1 oracle oinstall 13219887 Nov 10 03:50 collections.dat drwxr-x--- 3 oracle oinstall 4096 Aug 28 16:45 oradiag_oracle -rwxr-xr-x 1 oracle oinstall 873168 Nov 10 03:50 raccheck -rw-r--r-- 1 oracle oinstall 2705532 Jan 26 23:53 raccheck.zip -rw-r--r-- 1 oracle oinstall 2220 Nov 10 03:50 readme.txt -rw-rw-r-- 1 oracle oinstall 3425695 Nov 10 03:50 rules.dat -rw-r--r-- 1 oracle oinstall 304 Nov 10 03:50 UserGuide.txt
查看版本
[oracle@11grac1 ~]$ ./raccheck -v RACCHECK VERSION: 2.2.0_20121109
(一)以交互式执行
[oracle@11grac1 ~]$ ./raccheck CRS stack is running and CRS_HOME is not set. Do you want to set CRS_HOME to /u01/11.2.0/grid?[y/n][y] --此处回车,默认其crs_home Checking ssh user equivalency settings on all nodes in cluster Node 11grac2 is configured for ssh user equivalency for oracle user Searching for running databases . . . . . . List of running databases registered in OCR 1. racdb 2. None of above Select databases from list for checking best practices. For multiple databases, select 1 for All or comma separated number like 1,2 etc [1-2][1]. --此处回车,默认其数据库 . . Checking Status of Oracle Software Stack - Clusterware, ASM, RDBMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ------------------------------------------------------------------------------------------------------- Oracle Stack Status ------------------------------------------------------------------------------------------------------- Host Name CRS Installed ASM HOME RDBMS Installed CRS UP ASM UP RDBMS UP DB Instance Name ------------------------------------------------------------------------------------------------------- 11grac1 Yes Yes Yes Yes Yes Yes racdb1 11grac2 Yes Yes Yes Yes Yes Yes racdb2 ------------------------------------------------------------------------------------------------------- 79 of the included audit checks require root privileged data collection . If sudo is not configured or the root password is not available, audit checks which require root privileged data collection can be skipped. 1. Enter 1 if you will enter root password for each host when prompted 2. Enter 2 if you have sudo configured for oracle user to execute root_raccheck.sh script 3. Enter 3 to skip the root privileged collections 4. Enter 4 to exit and work with the SA to configure sudo or to arrange for root access and run the tool later. Please indicate your selection from one of the above options[1-4][1]:- 2 --此处选择2,使用sudo让oracle执行root_raccheck.sh *** Checking Best Practice Recommendations (PASS/WARNING/FAIL) *** Log file for collections and audit checks are at /home/oracle/raccheck_012613_235400/raccheck.log ============================================================= Node name - 11grac1 ============================================================= Collecting - ASM DIsk I/O stats Collecting - ASM Disk Groups Collecting - ASM Diskgroup Attributes Collecting - ASM disk partnership imbalance Collecting - ASM diskgroup attributes Collecting - ASM initialization parameters Collecting - Active sessions load balance for racdb database Collecting - Archived Destination Status for racdb database Collecting - Cluster Interconnect Config for racdb database Collecting - Database Archive Destinations for racdb database Collecting - Database Files for racdb database Collecting - Database Instance Settings for racdb database Collecting - Database Parameters for racdb database Collecting - Database Properties for racdb database Collecting - Database Registry for racdb database Collecting - Database Sequences for racdb database Collecting - Database Undocumented Parameters for racdb database Collecting - Database Workload Services for racdb database Collecting - Dataguard Status for racdb database Collecting - Files not opened by ASM Collecting - Log Sequence Numbers for racdb database Collecting - Percentage of asm disk Imbalance Collecting - Process for shipping Redo to standby for racdb database Collecting - Redo Log information for racdb database Collecting - Standby redo log creation status before switchover for racdb database Collecting - CPU Information Collecting - CRS active version Collecting - CRS oifcfg Collecting - CRS software version Collecting - CSS Reboot time Collecting - CSS disktimout Collecting - Cluster interconnect (clusterware) Collecting - Clusterware OCR healthcheck Collecting - Clusterware Resource Status Collecting - Huge pages configuration Collecting - Kernel parameters Collecting - Linux module config. Collecting - Maximum number of semaphore sets on system Collecting - Maximum number of semaphores on system Collecting - Maximum number of semaphores per semaphore set Collecting - Memory Information Collecting - OS Packages Collecting - Operating system release information and kernel version Collecting - Oracle Executable Attributes Collecting - Patches for Grid Infrastructure Collecting - Patches for RDBMS Home Collecting - Shared memory segments Collecting - Table of file system defaults Collecting - Voting disks (clusterware) Collecting - number of semaphore operations per semop system call Preparing to run root privileged commands 11grac1. [sudo] password for oracle: --此处需要输入oracle用户OS的密码 Data collections completed. Checking best practices on 11grac1. -------------------------------------------------------------------------------------- WARNING => OCR is NOT being backed up daily INFO => $CRS_HOME/log/hostname/client directory has too many older log files. INFO => user_dump_dest has trace files older than 30 days for racdb INFO => background_dump_dest has files older than 30 days for racdb INFO => At some times checkpoints are not being completed for racdb WARNING => Open files limit (ulimit -n) for current user is NOT set to recommended value >= 65536 or unlimited INFO => audit_file_dest has audit files older than 30 days for racdb WARNING => One or more redo log groups are NOT multiplexed for racdb INFO => oracleasm (asmlib) module is NOT loaded WARNING => /tmp is NOT on a dedicated filesystem WARNING => kernel.shmmax parameter is NOT configured according to recommendation INFO => Number of SCAN listeners is NOT equal to the recommended number of 3. WARNING => NIC bonding is not configured for interconnect WARNING => NIC bonding is NOT configured for public network (VIP) WARNING => OSWatcher is not running as is recommended. INFO => Jumbo frames (MTU ~9000) are not configured for interconnect FAIL => Database parameter DB_BLOCK_CHECKSUM is NOT set to recommended value on racdb1 instance FAIL => Database parameter DB_LOST_WRITE_PROTECT is NOT set to recommended value on racdb1 instance WARNING => Database parameter DB_BLOCK_CHECKING on PRIMARY is NOT set to the recommended value. for racdb FAIL => Flashback on PRIMARY is not configured for racdb FAIL => No one high redundancy diskgroup configured for racdb INFO => Operational Best Practices INFO => Consolidation Database Practices INFO => Network failure prevention best practices INFO => Computer failure prevention best practices INFO => Data corruption prevention best practices INFO => Logical corruption prevention best practices INFO => Storage failures prevention best practices INFO => Database/Cluster/Site failure prevention best practices INFO => Client failover operational best practices WARNING => fast_start_mttr_target has NOT been changed from default on racdb1 instance INFO => IMPORTANT: Oracle Database SCN Headroom. See Details for More Info /u01/app/oracle/product/11.2.0/db_1 INFO => Information about hanganalyze and systemstate dump FAIL => Your Configuration is NOT in Compliance with Oracle Security Alert for CVE-2012-1675 /u01/11.2.0/grid FAIL => Your Configuration is NOT in Compliance with Oracle Security Alert for CVE-2012-1675 /u01/app/oracle/product/11.2.0/db_1 INFO => Software maintenance best practices INFO => Database failure prevention best practices WARNING => Database Archivelog Mode should be set to ARCHIVELOG for racdb FAIL => Primary database is NOT protected with Data Guard (standby database) for real-time data protection and availability for racdb WARNING => avahi-daemon process is running Best Practice checking completed.Checking recommended patches on 11grac1. --------------------------------------------------------------------------------- Collecting patch inventory on CRS HOME /u01/11.2.0/grid Collecting patch inventory on ORACLE_HOME /u01/app/oracle/product/11.2.0/db_1 --------------------------------------------------------------------------------- 1 Recommended CRS patches for 112010 from /u01/11.2.0/grid on 11grac1 --------------------------------------------------------------------------------- Patch# CRS ASM RDBMS RDBMS_HOME Patch-Description --------------------------------------------------------------------------------- 9655006 no no /u01/app/oracle/product/11.2.0/db_1GI PSU 11.2.0.1.2 (INCLUDES DATABASE PS --------------------------------------------------------------------------------- --------------------------------------------------------------------------------- 26 Recommended RDBMS patches for 112010 from /u01/app/oracle/product/11.2.0/db_1 on 11grac1 --------------------------------------------------------------------------------- Patch# RDBMS ASM type Patch-Description --------------------------------------------------------------------------------- 9218789 no N-APPLY N-APPLY BUNDLE PATCH FOR RDBMS 11.2.0.1 --------------------------------------------------------------------------------- --------------------------------------------------------------------------------- --------------------------------------------------------------------------------- Clusterware patches summary report --------------------------------------------------------------------------------- Total patches Applied on CRS Applied on RDBMS Applied on ASM --------------------------------------------------------------------------------- 1 0 0 0 --------------------------------------------------------------------------------- --------------------------------------------------------------------------------- RDBMS homes patches summary report --------------------------------------------------------------------------------- Total patches Applied on RDBMS Applied on ASM ORACLE_HOME --------------------------------------------------------------------------------- 26 0 0 /u01/app/oracle/product/11.2.0/db_1 --------------------------------------------------------------------------------- ============================================================= Node name - 11grac2 ============================================================= Collecting - CPU Information Collecting - CRS active version Collecting - CRS oifcfg Collecting - CRS software version Collecting - Cluster interconnect (clusterware) Collecting - Huge pages configuration Collecting - Kernel parameters Collecting - Linux module config. Collecting - Maximum number of semaphore sets on system Collecting - Maximum number of semaphores on system Collecting - Maximum number of semaphores per semaphore set Collecting - Memory Information Collecting - OS Packages Collecting - Operating system release information and kernel version Collecting - Oracle Executable Attributes Collecting - Patches for Grid Infrastructure Collecting - Patches for RDBMS Home Collecting - Shared memory segments Collecting - Table of file system defaults Collecting - number of semaphore operations per semop system call Preparing to run root privileged commands 11grac2. We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things: #1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility. [sudo] password for oracle: Data collections completed. Checking best practices on 11grac2. -------------------------------------------------------------------------------------- INFO => $CRS_HOME/log/hostname/client directory has too many older log files. INFO => user_dump_dest has trace files older than 30 days for racdb INFO => background_dump_dest has files older than 30 days for racdb INFO => At some times checkpoints are not being completed for racdb INFO => audit_file_dest has audit files older than 30 days for racdb INFO => oracleasm (asmlib) module is NOT loaded WARNING => /tmp is NOT on a dedicated filesystem WARNING => kernel.shmmax parameter is NOT configured according to recommendation INFO => Number of SCAN listeners is NOT equal to the recommended number of 3. WARNING => NIC bonding is not configured for interconnect WARNING => NIC bonding is NOT configured for public network (VIP) WARNING => OSWatcher is not running as is recommended. INFO => Jumbo frames (MTU ~9000) are not configured for interconnect FAIL => Database parameter DB_BLOCK_CHECKSUM is NOT set to recommended value on racdb2 instance FAIL => Database parameter DB_LOST_WRITE_PROTECT is NOT set to recommended value on racdb2 instance WARNING => Database parameter DB_BLOCK_CHECKING on PRIMARY is NOT set to the recommended value. for racdb WARNING => fast_start_mttr_target has NOT been changed from default on racdb2 instance INFO => IMPORTANT: Oracle Database SCN Headroom. See Details for More Info /u01/app/oracle/product/11.2.0/db_1 FAIL => Your Configuration is NOT in Compliance with Oracle Security Alert for CVE-2012-1675 /u01/11.2.0/grid FAIL => Your Configuration is NOT in Compliance with Oracle Security Alert for CVE-2012-1675 /u01/app/oracle/product/11.2.0/db_1 WARNING => avahi-daemon process is running Best Practice checking completed.Checking recommended patches on 11grac2. --------------------------------------------------------------------------------- Collecting patch inventory on CRS HOME /u01/11.2.0/grid Collecting patch inventory on ORACLE_HOME /u01/app/oracle/product/11.2.0/db_1 --------------------------------------------------------------------------------- 1 Recommended CRS patches for 112010 from /u01/11.2.0/grid on 11grac2 --------------------------------------------------------------------------------- Patch# CRS ASM RDBMS RDBMS_HOME Patch-Description --------------------------------------------------------------------------------- 9655006 no no /u01/app/oracle/product/11.2.0/db_1GI PSU 11.2.0.1.2 (INCLUDES DATABASE PS --------------------------------------------------------------------------------- --------------------------------------------------------------------------------- 26 Recommended RDBMS patches for 112010 from /u01/app/oracle/product/11.2.0/db_1 on 11grac2 --------------------------------------------------------------------------------- Patch# RDBMS ASM type Patch-Description --------------------------------------------------------------------------------- 9218789 no N-APPLY N-APPLY BUNDLE PATCH FOR RDBMS 11.2.0.1 --------------------------------------------------------------------------------- --------------------------------------------------------------------------------- --------------------------------------------------------------------------------- Clusterware patches summary report --------------------------------------------------------------------------------- Total patches Applied on CRS Applied on RDBMS Applied on ASM --------------------------------------------------------------------------------- 1 0 0 0 --------------------------------------------------------------------------------- --------------------------------------------------------------------------------- RDBMS homes patches summary report --------------------------------------------------------------------------------- Total patches Applied on RDBMS Applied on ASM ORACLE_HOME --------------------------------------------------------------------------------- 26 0 0 /u01/app/oracle/product/11.2.0/db_1 --------------------------------------------------------------------------------- --------------------------------------------------------------------------------- CLUSTERWIDE CHECKS --------------------------------------------------------------------------------- --------------------------------------------------------------------------------- Detailed report (html) - /home/oracle/raccheck_racdb_012613_235400/raccheck_racdb_012613_235400.html UPLOAD(if required) - /home/oracle/raccheck_racdb_012613_235400.zip
(二)静默执行,也就是非交互式执行。
配置所有节点rdbms的用户oracle的sudo
[root@11grac1 ~]# cat /etc/sudoers | grep oracle oracle ALL=(root) NOPASSWD:/tmp/root_raccheck.sh [root@11grac2 ~]# cat /etc/sudoers | grep oracle oracle ALL=(root) NOPASSWD:/tmp/root_raccheck.sh [oracle@11grac1 ~]$ ./raccheck -s Checking ssh user equivalency settings on all nodes in cluster Node 11grac2 is configured for ssh user equivalency for oracle user Searching for running databases . . . . . . List of running databases registered in OCR 1. racdb 2. None of above . . Checking Status of Oracle Software Stack - Clusterware, ASM, RDBMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ------------------------------------------------------------------------------------------------------- Oracle Stack Status ------------------------------------------------------------------------------------------------------- Host Name CRS Installed ASM HOME RDBMS Installed CRS UP ASM UP RDBMS UP DB Instance Name ------------------------------------------------------------------------------------------------------- 11grac1 Yes Yes Yes Yes Yes Yes racdb1 11grac2 Yes Yes Yes Yes Yes Yes racdb2 ------------------------------------------------------------------------------------------------------- *** Checking Best Practice Recommendations (PASS/WARNING/FAIL) *** Log file for collections and audit checks are at /home/oracle/raccheck_012713_093333/raccheck.log ============================================================= Node name - 11grac1 ============================================================= Collecting - ASM DIsk I/O stats Collecting - ASM Disk Groups Collecting - ASM Diskgroup Attributes Collecting - ASM disk partnership imbalance Collecting - ASM diskgroup attributes Collecting - ASM initialization parameters Collecting - Active sessions load balance for racdb database Collecting - Archived Destination Status for racdb database Collecting - Cluster Interconnect Config for racdb database Collecting - Database Archive Destinations for racdb database Collecting - Database Files for racdb database Collecting - Database Instance Settings for racdb database Collecting - Database Parameters for racdb database Collecting - Database Properties for racdb database Collecting - Database Registry for racdb database Collecting - Database Sequences for racdb database Collecting - Database Undocumented Parameters for racdb database Collecting - Database Workload Services for racdb database Collecting - Dataguard Status for racdb database Collecting - Files not opened by ASM Collecting - Log Sequence Numbers for racdb database Collecting - Percentage of asm disk Imbalance Collecting - Process for shipping Redo to standby for racdb database Collecting - Redo Log information for racdb database Collecting - Standby redo log creation status before switchover for racdb database Collecting - CPU Information Collecting - CRS active version Collecting - CRS oifcfg Collecting - CRS software version Collecting - CSS Reboot time Collecting - CSS disktimout Collecting - Cluster interconnect (clusterware) Collecting - Clusterware OCR healthcheck Collecting - Clusterware Resource Status Collecting - Huge pages configuration Collecting - Kernel parameters Collecting - Linux module config. Collecting - Maximum number of semaphore sets on system Collecting - Maximum number of semaphores on system Collecting - Maximum number of semaphores per semaphore set Collecting - Memory Information Collecting - OS Packages Collecting - Operating system release information and kernel version Collecting - Oracle Executable Attributes Collecting - Patches for Grid Infrastructure Collecting - Patches for RDBMS Home Collecting - Shared memory segments Collecting - Table of file system defaults Collecting - Voting disks (clusterware) Collecting - number of semaphore operations per semop system call Preparing to run root privileged commands 11grac1. Collecting - CRS user limits configuration Collecting - CRS user time zone check Collecting - Custom rc init scripts (rc.local) Collecting - Interconnect interface config Collecting - Network interface stats Collecting - Number of RDBMS LMS running in real time Collecting - OCFS2 disks Collecting - Root Open File Limit Collecting - ocsf status Collecting - root time zone check Data collections completed. Checking best practices on 11grac1. -------------------------------------------------------------------------------------- INFO => $CRS_HOME/log/hostname/client directory has too many older log files. INFO => user_dump_dest has trace files older than 30 days for racdb INFO => background_dump_dest has files older than 30 days for racdb 至后输出省略... ...
当然这个输出也是一个.zip和一个.html文件。
其他raccheck相关命令参数可见oracle RACcheck User Guide.
基本从上边的概览图首先就可以看出我当然rac的得分还算可以,然后可以发现我的rac安全方面不达标,需要安装补丁包,还有就是一些参数设置,旧文件没有及时清除等一些的warning。整体来说,我的这个rac环境基本还是可以的。
以下是我在10grac中使用raccheck新功能检查HA的过程(此处为静默收集)
[oracle@rac1 ~]$ ./raccheck -c hacheck -s Checking ssh user equivalency settings on all nodes in cluster Node rac2 is configured for ssh user equivalency for oracle user Searching for running databases . . . . . . List of running databases registered in OCR 1. racdb 2. None of above . . Checking Status of Oracle Software Stack - Clusterware, ASM, RDBMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ------------------------------------------------------------------------------------------------------- Oracle Stack Status ------------------------------------------------------------------------------------------------------- Host Name CRS Installed ASM HOME RDBMS Installed CRS UP ASM UP RDBMS UP DB Instance Name ------------------------------------------------------------------------------------------------------- rac1 Yes Yes Yes Yes Yes Yes racdb1 rac2 Yes Yes Yes Yes Yes Yes racdb2 ------------------------------------------------------------------------------------------------------- *** Checking Best Practice Recommendations (PASS/WARNING/FAIL) *** Log file for collections and audit checks are at /home/oracle/raccheck_012813_161936/raccheck.log ============================================================= Node name - rac1 ============================================================= Collecting - Database Parameters for racdb database Collecting - Database Undocumented Parameters for racdb database Preparing to run root privileged commands rac1. Data collections completed. Checking best practices on rac1. -------------------------------------------------------------------------------------- FAIL => Database parameter DB_BLOCK_CHECKSUM is NOT set to recommended value on racdb1 instance FAIL => Flashback on PRIMARY is not configured for racdb WARNING => RMAN configuration for controlfile autobackup is NOT configured for racdb FAIL => Consider configuring an archivelog deletion policy. Erroneous deletion of archivelog files will affect database recovery. for racdb ============================================================= Node name - rac2 ============================================================= Preparing to run root privileged commands rac2. Data collections completed. Checking best practices on rac2. -------------------------------------------------------------------------------------- FAIL => Database parameter DB_BLOCK_CHECKSUM is NOT set to recommended value on racdb2 instance --------------------------------------------------------------------------------- Detailed report (html) - /home/oracle/raccheck_racdb_012813_161936/raccheck_racdb_012813_161936.html UPLOAD(if required) - /home/oracle/raccheck_racdb_012813_161936.zip