What is Zero Trust Architecture?

When we talk about information security, we always refer to the CIA triad- the relationship between Confidentiality, Integrity, and Availability. 

Zero trust Architecture drastically increases the Integrity arm of the triangle; it relies on the assurance that with all the technological advances, the availability arm will catch up. 

It relies on the understanding that the IT infrastructure will require a significant investment over a period to ensure that the accessibility of the system is optimized even after the trust in the identity shifts from being implicit to Zero.

We'll look at how you can help your team understand the basic concepts, issues, and review creative solutions. We will specially focus on repurposing existing systems to adapt them to the ZTA model.  

Through the whole series I will emphasize how you can do this yourself within your organization. 

Or, if you are planning to use an outside agency or product, you can use the information to help evaluate which of these agencies and products are most likely to help your team out. 

I've got lots of information for you on how ZTA fits into business and IT processes. So, let's get started.

Sachin
Chief Architect
Oracle Apex Enthusiast
BuzzClan

Zero Trust Architecture - How does your security posture compare?

As the CISO or head of security for your organization, you are likely always on the lookout for new and innovative ways to improve your company's security posture. You have probably heard a lot about zero trust architectures in recent months and may be wondering what all the hype is about. In this blog post, we will compare zero trust architectures to traditional, perimeter-based security models and discuss the benefits of moving to a zero trust model. We will also provide tips on how you can start transitioning your organization to a zero trust architecture. read more.... 

As businesses continue to move their operations online and into the cloud, traditional security models that rely on keeping sensitive data behind locked perimeters are no longer feasible. Zero Trust Architecture is an alternate approach that eliminates the need for trusted insiders and instead focuses on verifying identities and authorizing access on a case-by-case basis. This approach can be substantially more secure than traditional security models, as it does not rely on assuming that all users are trustworthy just because they are employees or have been granted access to certain systems or data. 

In this blog post, we will compare zero trust architectures to traditional, perimeter-based security models and discuss the benefits of moving to a zero trust model. We will also provide tips on how you can start transitioning your organization to a zero trust architecture. Stay tuned!

Sachin
Chief Architect
Oracle Apex Enthusiast
BuzzClan

What should be included in every company's data breach response plan

No organization is immune from a data breach. In the past year, we've seen a significant uptick in the number of companies that have been affected by cyber-attacks. If your company doesn't have a data breach response plan in place, now is the time to develop one. This blog post will outline what should be included in every company's data breach response plan.

A data breach is the unauthorized access or theft of customer or company information. This can happen when there's a cyberattack on a company's networks or systems, or when an employee accidentally exposes data. Data breaches can have dire consequences, including identity theft, loss of revenue, and damage to reputation. 

As a result, it is important for organizations to have a plan in place for how to respond in the event of a data breach. A good response plan will help to minimize the damage caused by a breach and protect the reputation of the organization. It will also help to speed up the recovery process and get the organization back on track as quickly as possible.

There are a few key elements that should be included in every data breach response plan:

- Identify who is responsible for leading the response effort and assembling the response team. This should be someone with the authority to make decisions and access to all of the necessary resources.

- Establish protocols for quickly identifying and containing a breach. This may involve setting up systems for monitoring activity on company networks and devices, as well as employee education on spotting signs of a potential breach.

- Develop procedures for notifying individuals whose data has been compromised, as well as regulators and law enforcement if required.

- Have a plan for restoring systems and retrieving lost data. This may involve having backup systems in place so that you can quickly resume operations after a breach.

- Put procedures in place for assessing the damage caused by a breach and taking steps to prevent future breaches from occurring. This includes conducting a post-breach analysis to identify what went wrong and making changes to systems and processes accordingly. Testing your plan regularly will help to ensure that it is effective and that employees are familiar with what they need to do in the event of a breach. Training employees on how to spot signs of a potential breach and what to do if they suspect one is occurring is also important. By taking these steps, you can help to minimize the risk of experiencing a damaging data breach.

To protect your business, you need to create a data breach response plan that includes steps for identifying, containing, and recovering from a breach. You should also test your plan regularly and train employees on what to do in the event of a breach. Do you have a data protection plan in place? What kind of precautions have you taken to prevent or mitigate the effects of a potential data leak? Share your thoughts and experiences in the comments below.

Sachin
Chief Architect
BuzzClan

OCI-Oracle ATP- Import Data from on-prem

The primary method to move data to the Oracle ATP instance is by using Data Pump.

You export data from your On-Prem database. Use the following parameters for faster and easier migration to ATP

exclude=cluster,db_link
parallel=n
schemas=schema_name
dumpfile=export%u.dmp

For larger data size, use parallelism. Use the number of CPU's you have in your ATP. For a 16 CPU ATP instance, here is an example of export. Other parameters like compression can also be used.

expdp sh/sh@orcl \
exclude=cluster,db_link \
parallel=16 \
schemas=sh \
dumpfile=export%u.dmp

Once the export file(s) is ready, move the files to Oracle Cloud Infrastructure Object Storage.

You can use 10 GiB of Object Storage and 10 GiB of Archive Storage for free in your home region. If you use more than 20 GiB and have not upgraded when your Free Trial ends, your data is deleted.


If You are participating in a Free Trial and can store unlimited data. When your trial ends, you are converted to an Always Free account. An Always Free account is limited to 20 GiB of combined Object Storage and Archive Storage in your home region. If you are using more than 20 GiB when your account is converted, your data is deleted. Reduce your usage to 20 GiB or less before converting to Always Free.

Storage usage is the approximate total size of all objects in the region. Usage is updated periodically. You will see a lag between what is displayed and the actual usage.

Oracle Data Pump v18.3 or above supports importing data into ATP. See (https://erpthings.blogspot.com/2019/10/oci-oracle-atp-connect-via-sqlplus-on.html) for details on how to get Oracle Instance Client.
Steps:

• Store Credential Argument so that Data Pump can authenticate to the Object Storage services

BEGIN
DBMS_CLOUD.CREATE_CREDENTIAL
  DBMS_CLOUD.CREATE_CREDENTIAL(
    credential_name => 'objectstore',
    username => <'userid'>,
    password => <'password'>
  );

  dbms_cloud.enable_credential(credential_name => 'objectstore');
  ALTER DATABASE PROPERTY SET default_credential = 'ADMIN.objectstore';
End;
  exit;

• Determine the Native URI for your dump file(s) (See this post)
• Run Data Pump import

impdp admin/password@ATPC1_high \       
     directory=data_pump_dir \       
     credential=def_cred_name \       
     dumpfile= https://objectstorage.us-ashburn-1.oraclecloud.com/n/atpc/b/atpc_user/o/export%u.dmp \
     parallel=16 \
     transform=segment_attributes:n \
     transform=dwcs_cvt_iots:y transform=constraint_use_default_index:y \
     exclude=cluster,db_link

  I got a few errors that were eluding to the fact that the user is not authenticated. To work around the issue, I used a few support documents:

How to validate Object Storage URI and Credentials Are Correctly Set for ATP (Doc ID 2468298.1)

NOTE:2113967.1 - How To Validate A DataPump Export (EXPDP) Dump File ?
NOTE:2416814.1 - ADW: Getting "ORA-17500: ODM err:ODM HTTP Unauthorized" error during import to ADW Instance
NOTE:2446550.1 - ATP : Import to ATP From Object Store Fails with 'ORA-17500: ODM Err:ODM HTTP Unauthorized'

Finally, I used a pre-authenticated url for the dmp file as discussed in the last note.
Once this was done, here is the new impdb command which imported the data:

./impdp admin@buzztaqdev_high \ dumpfile=default_credential:<pre-authenticated url > \
transform=segment_attributes:n transform=dwcs_cvt_iots:y \
transform=constraint_use_default_index:y exclude=cluster,db_link

Sachin
Chief Architect
Oracle Apex Enthusiast
BuzzClan

Oracle OCI - Object Storage - Access via Native URI

To be able to access objects in the Oracle Cloud Object Storage, we need a Uniform Resource Identifier (URI) ('a string of characters that unambiguously identifies a particular resource')

• Native URI

https://objectstorage.region.oraclecloud.com/n/object-storage-namespace/b/bucket/o/filename

Tip:

You can view the Native URI of an object (such as an uploaded file) in its Object Details dialog:

1. Go to the Bucket Details page of the bucket containing the object.
2. In the bucket's list of objects, click the  action menu icon and choose View Object Details.
   The URL Path (URI) field displays the object's Native URI value.

Sachin
Chief Architect
Oracle Apex Enthusiast
BuzzClan

OCI-Oracle ATP- Connect via SQLPlus on Linux

Continuing from my OCI series: Moving On-Premises Oracle Apex application to OCI Oracle Autonomous Transaction Processing

To connect to the ATP instance from a Linux machine, we have to do a little more leg work.

Some things to review before we get started.
The client software should be 11.2.0.4 (full install) or higher to be able to connect to the ATP instance. Instant Client can be downloaded and installed from these links:

Oracle Instant Client Downloads
Instant Client Downloads for Linux x86-64 (64-bit)

Downloads

Download the appropriate version per your requirements. I have installed the 18.5 version.

• Basic Package - All files required to run OCI, OCCI, and JDBC-OCI applications
• Tools-optional Package SQL*Plus Package - The SQL*Plus command-line tool for SQL and PL/SQL queries
• Tools Package - Includes Data Pump, SQL*Loader and Workload Replay Client

I downloaded it to my local machine and then uploaded it to the Linux machine via FTP. There are ways to do "wget", but require more work as Oracle Authentication is required.

Once installed, I unzipped in the oracle user home

/home/oracle/instantClient

If you have the other client also installed on the machine, you may have to set-up things slightly different, but basic steps are the same.

Setup Wallet and configuration files

Download the client credentials (Wallet Zip) to the machine, and uninstall it to the home directory for oracle

drwxrwxr-x 2 oracle oracle  4096 Oct 13 17:28 Wallet_BuzzTAQDev
-rw-rw-r-- 1 oracle oracle 19814 Oct 13 17:25 Wallet_BuzzTAQDev.zip

Change the underlying file permissions to 600

chmod  600 *
[oracle@ip-172-30-0-39 Wallet_BuzzTAQDev]$ ll
total 36
-rw------- 1 oracle oracle 6669 Oct 12 23:21 cwallet.sso
-rw------- 1 oracle oracle 6624 Oct 12 23:21 ewallet.p12
-rw------- 1 oracle oracle 3244 Oct 12 23:21 keystore.jks
-rw------- 1 oracle oracle   87 Oct 12 23:21 ojdbc.properties
-rw------- 1 oracle oracle  114 Oct 12 23:21 sqlnet.ora
-rw------- 1 oracle oracle 1751 Oct 12 23:21 tnsnames.ora
-rw------- 1 oracle oracle 3336 Oct 12 23:21 truststore.jks

If Oracle database or client is already installed, we can put the tnsnames and sqlnet files in the current admin/network directory in ORACLE_HOME
If not, we will move the files to the instant client network/admin/ location

/home/oracle/instantClient/network/admin

Change the sqlnet.ora file :

WALLET_LOCATION = (SOURCE = (METHOD = file) (METHOD_DATA = (DIRECTORY="/home/oracle/Wallet_BuzzTAQDev")))

#SSL_SERVER_DN_MATCH=yes

Make sure that all the tnsnames in the downloaded file are in the final tnsnames.ora file

<>_high

<>_low

<>_mediom

<>_tp

<>_tpurgent

Client configuration:

Add the location of the client install in the current path variable:

export PATH=$PATH:/home/oracle/instantClient >> /home/oracle/.bash_profile

add the library path

export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/home/oracle/instantClient >> /home/oracle/.bash_profile

If you already have sql client installed, you may have to rename the key files to ensure you are running the proper version

mv sqlplus sqlplus18

Going forward, we will use the sqlplus18 instead of sqlplus to run our scripts.

Test your connection

[oracle@ip-172-30-0-39 instantClient]$  sqlplus18 admin@buzztaqdev_medium
SQL*Plus: Release 18.0.0.0.0 - Production on Tue Oct 15 18:13:44 2019
Version 18.5.0.0.0
Copyright (c) 1982, 2018, Oracle.  All rights reserved.
Enter password:
Message 1549 not found;  product=SQLPlus; facility=SP2
Connected to:
Oracle Database 18c Enterprise Edition Release 18.0.0.0.0 - Production
Version 18.4.0.0.0
SQL>

Happy testing!!

Sachin
Chief Architect
Oracle Apex Enthusiast
BuzzClan

OCI - ATP Database - Basic connectivity - SQL Developer

Continuing from my OCI series: Moving On-Premises Oracle Apex application to OCI Oracle Autonomous Transaction Processing

Once the database is provisioned, you can connect from various clients.

1. Credential Zip File

The Credential zip contains the following files:

• Wallet and keystore:
• cwallet.sso
• ewallet.p12
• keystore.jks
• truststore.jks
• Configuration
• sqlnet.ora
• tnsnames.ora

TNS entries are as follows:

• High
• Low
• Medium
• TP
• TPurgent

Connecting to SQLDeveloper

Various versions will have different options when it comes to the connection type. I am sharing a couple of things I have seen. Either way, here are a few pointers. 

Download the latest SQL Developer. Cloud connections and secure connections are not available in older versions.

SQL Developer 19.2

SQL Developer 18.4

Open SQL Developer on your local computer. In the Connections panel, right-click Connections and select New Connection.

Note:

Depending on your version of SQL Developer, do not right-click Cloud Connection or Database Schema Service Connections. That menu selection is for connecting to a different Oracle cloud service, the Oracle Database Schema Service.

To start a new connection, start with New Connection, not the Cloud Connection.

The New/Select Database Connection dialog appears. Enter the following information:

• Connection Name - Enter the name for this cloud connection.
• Username - Enter the database username. Use the default administrator database account (admin) that is provided as part of the service.
• Password - Enter the admin user's password that you or your Autonomous Transaction Processing administrator specified when creating the service instance.
• Connection Type - Select Cloud Wallet. (or Cloud PDB)
• Configuration File - Click Browse, and select the Client Credentials zip file, downloaded from the Autonomous Transaction Processing service console by you.
• Service - In the drop-down menu, service selections are prepended with database names. Select the tpurgent, tp, high, medium, or low menu item for your database. These service levels map to the TPURGENT, TP, HIGH, MEDIUM and LOW consumer groups, which provide different levels of priority for your session. 

OR

Click Test, Save and Connect.

Link to the ObE - Connecting SQL Developer to Autonomous Transaction Processing

Next: OCI-Oracle ATP- Connect via SQLPlus on Linux

Sachin
Chief Architect
Oracle Apex Enthusiast
BuzzClan

OCI - Creating a ATP Database instance

Create Database Instance

Continuing from my OCI series: Moving On-Premises Oracle Apex application to OCI Oracle Autonomous Transaction Processing

We will provision a 'Serverless deployment' instance of the database. 

• On the navigation menu on the left, select Autonomous Transaction Processing under Database
• Click "Create Autonomous Database"

• Compartment: Use default (for new accounts, you will need to provide a name)
• Display Name: Descriptive name for the database
• Database Name
• Workload Type: Select 'Autonomous Transaction Processing'
• Deployment Type: Serverless
• Configuration: Always Free
• (OCPU:1, Storage: .02TB-2GB)
• User Name/Password
• License Type: Included
• Tags

Create Database

The Create Autonomous Transaction Processing Database dialog closes. On the console, the State field indicates that the database is Provisioning. When creation is completed, the State field changes from Provisioning to Available.

For details see the official documentation here:

Provisioning Autonomous Transaction Processing

Now that the database is ready, let's connect to it:

OCI - ATP Database - Basic connectivity - SQL Developer
OCI-Oracle ATP- Connect via SQLPlus on Linux

Next: OCI-Oracle ATP- Import Data from on-prem

Sachin

Chief Architect
Oracle Apex Enthusiast
BuzzClan

Overview of OCI services - Focus on Always Free Tier

Continuing from my OCI series:
Moving On-Premises Oracle Apex application to OCI Oracle Autonomous Transaction Processing

Once you have signed up on OCI, you can see the various links to the services being offered:

There are a lot of services available on this list. We will be introduced to the following during the course of this series:

• Database - Autonomous Transaction Processing (ATP)

This will allow us to get a serverless database instance. Oracle autonomously operates all aspects of the database life cycle from database placement to backup and updates. Here is the link to the Oracle Help Center page for ATP: Getting Started with Autonomous Transaction Processing

• Object Storage

The Oracle Cloud Infrastructure Object Storage service is an internet-scale, high-performance storage platform that offers reliable and cost-efficient data durability. The Object Storage service can store an unlimited amount of unstructured data of any content type, including analytic data and rich content, like images and videos.

As we will be migrating from an existing application, we will use the OS to import data from our existing database (expdb/impdb)

Here is the link to the official documentation: Overview of Object Storage

The Always Free limitations are:

Database:

1. 2 Database instances
2. 1 OCPU per database
3. 20 Gb Exadata storage per database
4. Doesn't support full backup and restore
5. Deactivated after 7 days of inactivity, and maybe permanently deleted after 9- days. Banner and email notifications are sent before this happens.
6. It can be upgraded to paying status, which will remove these restrictions.

Storage:

You can use 10 GiB of Object Storage and 10 GiB of Archive Storage for free in your home region. 

Next: Creating ATP Database Instance

Sachin
BuzzClan LLC

Moving On-Premises Oracle Apex application to OCI Oracle Autonomous Transaction Processing

Oracle Apex is now available on Oracle Cloud Infrastructure and is very easy to set up by itself. I will explain the various steps in the following blogs.

As we progress, I will also document the process to migrate an application I have which is currently on a compute node in AWS.

The current architecture is as follows:
AWS - EC2 compute node with AWS Linux
Oracle 11g XE
APEX 18.1

My goal is to migrate the application on this server to OCI cloud Autonomous database.

Oracle is promising the following 'Always Free Tier'
New Always Free Services you can use for an unlimited time.

• Two Oracle Autonomous Databases with powerful tools like Oracle Application Express (APEX) and Oracle SQL Developer
• Two Oracle Cloud Infrastructure Compute VMs; Block, Object, and Archive Storage; Load Balancer and data egress; Monitoring and Notifications
• Object Storage: You can use 10 GiB of Object Storage and 10 GiB of Archive Storage for free in your home region.

We plan to take benefit of the Oracle Autonomous Database instance and provision APEX on it to migrate our application.

So here is your link to signup:
Sign Up for Oracle Cloud

It will need your credit card so be prepared to provide that. Oracle does not charge anything 'just yet'.

Let's come back when you have signed up so we can follow through creating our database instance.

Next Blog: Overview of OCI Services

Sachin
Chief Architect
BuzzClan LLC

OBIEE Tuning - Under the hood

 Monitoring what to tune:

• Monitor performance using Enterprise Manager,
• OBIEE Admin/Session tool
• Usage Tracking
• Fiddler browser based client developer add-on's - see where is most of the time being taken for a page load and plan accordingly.
• Use Oracle Application Testing Suite (OATS) for Load Testing using a test strategy reflecting the load and type of usage.

Understanding Monitoring is very important  because Oracle's documentation is not very clear on how the settings effect the overall performance. They at best provide two values - default, and suggested, without much explanation. So if we want to customize these for the situation at hand, we should be able to monitor the effects of changes and tweak it to the what best applies to our situation.

Apply latest patches

• Upgrade to the latest patch set - follow Support documentation (Upgrade advisory) to plan major upgrades.
• Stay on approved Java version

Delegate work away from OBIEE server

Reverse Proxy/OHS Cache: OBIEE prevents the browsers from caching its content. This is a desired tract to ensure fresh reports data, but overloads the BI Presentation server/OHS as all the static content now needs to be served for each and every request.

This can be mitigated by implementing a Reverse Proxy server or enabling caching on Web server.

Optimized connections

The Connection Pools to the underlying databases should be enough to be able to reasonably service the expected number of concurrent users. Pools also exists for network connection and here, the timeout should be reduced so that they can be freed more often and made available for subsequent calls. There are various parameter based on the underlying OS to achieve this:

• Database Connection Pools for these should be reviewed:
• Database connection in the physical layer:
• Init-Block Connection Pools
• Physical DB Connection Pools
• BIP/MDS Connection Pools (others if Essbase/ODI are installed)
• Inter-Process connection pool:increase the bridge connection pool for Presentation server to sufficient level
• Enable compression at web server to ensure high throughput
• Ensure sufficient search depth within the AD of choice. This can be result in additional complexity if there is a cyclic membership.

Thread Management

•     Manage Stuck thread trigger time: 
• Account for long running queries from the usage tracking parameters 
• Ensure that the system doesn't flag threads as stuck in that time frame.  
•     Increase thread pool for charting engine, job manager

Turn Off Debugging features on production:

•     Log levels
•     Wrap Data Type (JDBC)
•     Lock down production RPD to read only mode
•     Database client libraries - disable signal handling

JVM - Memory

• Increase Heap
• Compressed Reference
• Thread Local sizes based on available physical memory for OBIEE

Cache management:

• Move cache and temp directories(javaHost/BIP/BIPS) to RAM disk (~256 GB)
• Use cache seeding. Automate using SASeedQuery after ETL process.
• Adjust maximum cache size based on frequently used/first page reports
• Increase number of open files limit in OS to allow for multiple concurrent processing of cache/sort/logs etc.

Aggregate data

Reduce Database's processing cycles, and the network bandwidth needs.

Hardware Optimization

• Maximize Memory and Networking capability of each server. 
• OBIEE licensing is core based. Addition servers will result in added licensing cost. So maximize the memory and network capacity on the serve before scaling out.
• Throw in more hardware, vertically scale the system for performance, get high availability as an added benefit.

Sizing of Server

Factors used to determine the capacity of a server:

•     Total Named user vs Concurrent users
•     SSL turned on or not.
•     complexity of the Report formats
•     Underlying database and the connection between the two servers

BI Publisher

•     Ensure appropriate JDK/JVM
•     Optimal memory and disk space allocation
•     Use BI Publisher's XSLT processor (Enable scalable feature of XSLT processor)
•     Divide optimization efforts by
• Online/Concurrent Usage
• Report size - Small(~10 Pages)/Medium(~50 Pages)/Large(> 100 pages)/ Extremely large (> 100,000 rows)
• Bursting - Total number of report vs. time window
•     Run-time optimization
• Enable XSLT Processor, enable scalable features
• Enable Muti-Threading
• Increase Thread Count
• Increase FO Buffer size
• Increase Pages in Caches setting
• Enable Run-Time Cache
• Disable Autorun
•     Use JNDI over JDBC
•     Push database functions like Joins to Database (Use OBIEE models)
•     XML
• Use short names (smaller overall XML)
• Use Unique names across structures
• Avoid XML attributes
• Use Absolute paths for Searches rather than Relative paths
•      Scale out
•     Configure debug settings to minimal for production

Finally some functional optimization

• Rearrange dashboards so that the smaller/faster reports are rendered first
• Show summary reports (from aggregates) first
• Force users to put appropriate filters in prompts
• Partition database
• Index appropriately
• Run Statistics and keep them current

Moniter, Adjust, Repeat!

Sachin
Architect - Oracle Engineered Systems
Exalytics/Exalogic/Exadata
BuzzClan LLC

BuzzClan is a business consulting company collaborating to provide Oracle software advisory services & implementation services. BuzzClan LLC is committed to providing substantive business value on each and every client engagement. We do this through a combination of industry-specific business expertise, technical skills, proven project management methods and our “onsite - off site - offshore” delivery model. We strive to work in partnership with our customers to build high-performance teams and create business solutions that will last.

Exalytics - Patch Set 5 ( Exalytics PS5)

Oracle released the PatchSet 5 for Exalytics last week.

Here are some highlights:

Base Image upgrade

Majority of the patch is confined to the Base Image.

New base image - 1.0.0.7 to include kernel upgrade to 2.6.39-400. additional drivers and firmware upgrade for X4-4 machines.

It comes with an Upgrade utility which will allow for patching a PS4 machine to PS5.

Virtual Deployments Upgrade

 VM server upgrade to 3.2.8, and guest kernel to 2.6.39-400

Additional software certification

Oracle Database In-Memory: 

Oracle database 12c EE (rel 12.1.0.2) with in-memory edition is now certified with Exalytics when run in Data Warehouse mode. (No OLTP support)

Does this mark the end of TT on Exalytics?

I will update this as we upgrade a client's machine to PS5!

Sachin
Architect - Oracle Engineered Systems
Exalytics/Exalogic/Exadata
BuzzClan LLC

BuzzClan is a business consulting company collaborating to provide Oracle software advisory services & implementation services. BuzzClan LLC is committed to providing substantive business value on each and every client engagement. We do this through a combination of industry-specific business expertise, technical skills, proven project management methods and our “onsite - off site - offshore” delivery model. We strive to work in partnership with our customers to build high-performance teams and create business solutions that will last.

Engineered Systems VS. NIST Definition of Cloud Computing

According to the NIST,

Cloud computing is a model for enabling ubiquitous, convenient, on-demand network access to a shared pool of configurable computing resources (e.g., networks, servers, storage, applications, and services) that can be rapidly provisioned and released with minimal management effort or service provider interaction. This cloud model is composed of five essential characteristics, three service models, and four deployment models.(http://csrc.nist.gov/publications/nistpubs/800-145/SP800-145.pdf)

In this blog, I will examine how each of the five essential characteristics defined by NIST (in bold/italics) applies to the engineered systems - Exalogic, Exadata, and Exalytics.

On-Demand Self-Service:  

A consumer can unilaterally provision computing capabilities, such as server time and network storage, as needed automatically without requiring human interaction with each service provider.

This refers to the ability of cloud services consumers to configure and maintain the landscape presented to them. This allows for distributed administration capabilities. While the centralized team concentrates on managing the infrastructure tasks like initial setup, capacity planning and resource quota allocation, backup, disaster recovery, patching, libraries of Virtual Machine (VM) templates, middleware code, etc., the application-level administration is delegated to the consumers. They can create VMs from the template library and extend them according to their needs.

To enable the consumers to do this, several administration consoles are provided by the Cloud Infrastructure to allow for GUI, Command Line Interface (CLI) or scripted interaction with the system.

Oracle’s engineered systems provide the following self-service capabilities:
 •  Cloud admin account access
• Enterprise Manager Operations Center (EMOC) access 
• Virtual Data Center (vDC) Management tab with access to pre-built Virtual Machine templates for frequently used functions
• Base VM templates to build upon
• Command Line Interfaces (CLI and dCLI) access to most of these tasks for automation and one-touch unilateral provisioning

Broad Network Access:  

Capabilities are available over the network and accessed through standard mechanisms that promote use by heterogeneous thin or thick client platforms (e.g., mobile phones, tablets, laptops, and workstations).

Oracle’s engineered systems are generally used for private cloud offerings within secured corporate or public sector settings. Therefore, access to these is not required on a mobile device. The systems provide the access over SSL/SSH using the following: 

• Browser-based interfaces (EMOC/VM Manager/ZFSManager)
• CLI interface over SSH

Resource Pooling:  

The provider’s computing resources are pooled to serve multiple consumers using a multi-tenant model, with different physical and virtual resources dynamically assigned and reassigned according to consumer demand. There is a sense of location independence in that the customer generally has no control or knowledge over the exact location of the provided resources but may be able to specify location at a higher level of abstraction (e.g., country, state, or datacenter). Examples of resources include storage,  processing, memory, and network bandwidth.

This, I believe, is the most important characteristic of a cloud offering. With commodity servers running independently, we have seen that there is often a heterogeneous usage of resources. Most of the servers are underutilized while some can never have enough resources to service the load, creating a bottleneck referred to as 'underutilized server sprawl'. With an IaaS scenario, this can be fixed by dynamically rearranging the load on a particular resource. The engineered systems allow for resource quota for the users/accounts (Account Resource Limit).

• Oracle Virtual Machine Server - Virtualizer
• Virtual CPU/CPU oversubscription
• Common memory pool
• Common storage
• Shared network access  

Rapid Elasticity: 

Capabilities can be elastically provisioned and released, in some cases automatically, to scale rapidly outward and inward commensurate with demand. To the consumer, the capabilities available for provisioning often appear to be unlimited and can be appropriated in any quantity at any time.

We currently follow these steps in order to change the memory, vCPU, and/or the Network resource allocation for an existing guest vServer (Reference - Exalogic: Changing the Memory, vCPU and Network Resources for an existing guest vServer (Doc ID 1586296.1)):

1. Stop the vServer
2. Create a template
3. Create a vServer type with the required memory and vCPU resources
4. Delete the old server
5. Create a new vServer by using the template in step #2 and the vServer type created in step #3

I am hopeful that upcoming releases will make this process more streamlined and easier to manage.
Ideally, to ensure elasticity, the virtual servers should have memory, vCPU, network bandwidth, and storage quotas within a range. The servers should also have a priority definition which will help mitigate resource contention issue in case multiple vServers are trying. The vServer should be able to negotiate the resources based on its priority among other servers, the current load on the vServer, and the Virtual Server as a whole.
The disk space is shared among all the compute nodes and virtual machines.  Shares and projects can be created by the cloud admins to be mounted on the VMs. These shares can also be shared among multiple VMs.
Resource quotas are established at a cloud-account level. Any VM created within the account has access to the resources allocated to the account.
What’s missing?

• Networking quota
• Prioritization (if a resource is oversubscribed, which account/VM/process gets access to the resource if the physical limit is reached)
• Time slot-based allocation   

Measured service:

Cloud systems automatically control and optimize resource use by leveraging a metering capability at some level of abstraction appropriate to the type of service (e.g., storage, processing, bandwidth, and active user accounts). Resource usage can be monitored, controlled, and reported, providing transparency for both the provider and consumer of the utilized service.

Enterprise Manager 12c provides the capability to meter the usage and calculate chargeback of different resources (targets).  A universal charge plan contains rates for CPU, Memory and storage. Extended charge plans can be used across various target types. Details can be found in the OEM - Chargeback Administration.

What’s missing? 

• This functionality is not available for Exalytics servers yet. However, in an OBIEE implementation, certain Usage Tracking reports can be configured to provide this functionality.

Tech Term of the Day 

NIST - National Institute of Standards and Technology


Sachin
Architect - Oracle Engineered Systems
Exalytics/Exalogic/Exadata
BuzzClan LLC

BuzzClan is a business consulting company collaborating to provide Oracle software advisory services & implementation services. BuzzClan LLC is committed to providing substantive business value on each and every client engagement. We do this through a combination of industry-specific business expertise, technical skills, proven project management methods and our “onsite - off site - offshore” delivery model. We strive to work in partnership with our customers to build high-performance teams and create business solutions that will last.

Certified - Exalytics In-Memory Machine X3-4 Implementation Essentials

Hurrey!!

Today I got the result of the Exam I gave back in Dec. 

I have cleared the "Exalytics In-Memory Machine X3-4 Implementation Essentials" exam!, earning a OPN Certified Specialist designation in this field.

Together with the  "Exalogic Elastic Cloud X2-2 Certified Implementation Specialist" certification, it helps me differentiate myself as a proven expert in the field of Oracle Engineered Systems implementations.

Getting ready to crack the Exadata certification next!

Sachin
Architect - Oracle Engineered Systems
Exalytics/Exalogic/Exadata
BuzzClan LLC

BuzzClan is a business consulting company collaborating to provide Oracle software advisory services & implementation services. BuzzClan LLC is committed to providing substantive business value on each and every client engagement. We do this through a combination of industry-specific business expertise, technical skills, proven project management methods and our “onsite - off site - offshore” delivery model. We strive to work in partnership with our customers to build high-performance teams and create business solutions that will last.

OBIEE - Multi-tenancy User Authentication and Authorization

To facilitate Multi-Tenancy in OBIEE, a few new roles have been introduced in OBIEE. A new layer has been added which allows for administration at a tenant level, and another one to define users/authors at the tenant.

• BI Global Administrator
• Tenant Administrator
• Tenant User

Earlier posts in this series:
 OBIEE - Multi-Tenancy implementations - What is it
 OBIEE - Multi-Tenancy - Presentation Catalog

When OBIEE is configured for Multi-tenancy, there are two administration are available to configure the application. BI Global Administrator role (BIGlobalAdministrator) is used for overall global administration. This administrator controls privileges for all tenants and can access the Presentation Services Administration page, Oracle BI Administration Tool, Job Manager, Catalog Manager, and all content. This administrator is not associated with a specific tenant.

The new role, BITenantAdministrator have specific privileges that are granted in the Oracle BI Presentation Catalog for administering a tenant. Users in this role can perform. 

This role enables users to perform self-service administration tasks on one tenant. These administrators cannot access overall Presentation Services Administration page or the Privileges page. These administrators organize content for tenant users within the catalog by granting access to, creating, moving, and copying objects and folders.

Another User role, Tenant User, are equivalent to the BIAuthor and BIConsumer roles, but gives access to the artifacts within a particular tenant. 

Each Tenant in the system is assigned a GUID, and the users assigned to the tenant are also assigned GUID's to ensure that OBIEE sees them as distinct users and is shielded from name clashes and name changes. The user is based on the Tenant GUID. This GUID is also available as a session variable.

This way the user maintenance tasks are delegated to Administrators within each Tenant. Persons taking on this role should understand the OBIEE artifacts and the authorizations available 

Not all the features are Currently - multi-tenant - enabled. Here are a few:

• Catalog groups
• KPIs, scorecards, 
• BI Mobile, 
• BI Composer, 
• Oracle BI for Microsoft Office, 
• Act As functionality, 
• Direct database requests.
• Oracle RTD, BI Publisher, and Marketing Segmentation.
• Full-text catalog search with Oracle SES and Oracle Endeca Server. The basic catalog search is available.
• Oracle Essbase Components (including Financial Reporting, Calculation Manager, and Workspace).

These features are not available for BIGlobalAdminstrator for administration:

• Oracle BI Administration Tool
• Catalog Manager
• Job Manager.
• Usage tracking 
• MapViewer

Other limitations:

• Application Roles are defined system wide, and not tenant specific. Any roles defined will be available to all the tenants for selection through the dialogues.
• There are no 'Tenant' Specific configurations in the instanceconfig.xml file. These changes include privileges in the catalog, skins, and front-end customization.

Multi-Tenancy is disabled by default. A few entries needs to be added to the configuration files and domain configuration files.

A detailed documentation can be found at: Configuring for Multiple Tenants


Sachin
Architect - Oracle Engineered Systems
Exalytics/Exalogic/Exadata
BuzzClan LLC

BuzzClan is a business consulting company collaborating to provide Oracle software advisory services & implementation services. BuzzClan LLC is committed to providing substantive business value on each and every client engagement. We do this through a combination of industry-specific business expertise, technical skills, proven project management methods and our “onsite - off site - offshore” delivery model. We strive to work in partnership with our customers to build high-performance teams and create business solutions that will last.