|
| 1 | +# Enable Database Management for Oracle Database@Azure Cloud Databases |
| 2 | + |
| 3 | +## Introduction |
| 4 | + |
| 5 | +In this lab, you will go through the steps to set up Database Management for Oracle Database@Azure Databases. |
| 6 | + |
| 7 | +Multicloud adoption allows businesses to harness the strengths of different cloud platforms while mitigating risks. However, monitoring and managing databases in a multicloud environment introduces unique challenges, requiring specialized approaches and solutions. You can use Diagnostics & Management features to monitor and manage Oracle Databases running on the following cloud platforms: |
| 8 | + |
| 9 | + |
| 10 | + |
| 11 | +Estimated Time: 60 minutes |
| 12 | + |
| 13 | +### Objectives |
| 14 | + |
| 15 | +Set up Database Management to monitor and manage Oracle Database@Azure Cloud Databases. |
| 16 | + |
| 17 | +Here are some of the important tasks you can perform using Diagnostics & Management features: |
| 18 | +- Monitor the key performance and configuration metrics of your fleet of Oracle Databases. You can also compare and analyze database metrics over a selected period of time. |
| 19 | +- Use Performance Hub for a single-pane-of-glass view of database performance, which enables you to quickly diagnose performance issues. |
| 20 | +- Use AWR Explorer to visualize historical performance data from AWR snapshots in easy-to-interpret charts. |
| 21 | +- Use the other available Diagnostics & Management features to monitor, manage, and administer a single Oracle Database. |
| 22 | +- Use dashboards to visualize, explore and analyze database performance metrics. |
| 23 | + |
| 24 | +## Prerequisites |
| 25 | + |
| 26 | +Understand the Oracle Database@Azure compartment structure: |
| 27 | +Oracle Database@Azure Exadata Infrastructure is created in the auto-generated compartment with the name matches the Azure Subscription ID. |
| 28 | +  |
| 29 | +  |
| 30 | + |
| 31 | +### Add Required IAM Policies |
| 32 | + |
| 33 | +- From the **Oracle Cloud console navigation menu** located in the upper left, click **Identity & Security**. Under **Identity**, click **Policies**. |
| 34 | +- Click **Create Policy**. In the **Create Policy** dialog : |
| 35 | +- **Name**: Enter MulticloudLink\_ODBAA\_20240227\_DBM\_Policy |
| 36 | +- **Description**: Enter Multicloud ODBAA Database Management Service Policy |
| 37 | +- **Compartment**: Select root. |
| 38 | +- Enable **Show manual editor**. |
| 39 | +- Enter the following in **Policy Builder**: |
| 40 | +- **Policy statements** |
| 41 | + |
| 42 | + ``` |
| 43 | + <copy> |
| 44 | + Allow service dpd to read secret-family in compartment MulticloudLink_ODBAA_20240105042431 |
| 45 | + Allow service dpd to manage objects in compartment MulticloudLink_ODBAA_20240105042431 |
| 46 | + Allow group odaa_dbmgmt-group to manage dbmgmt-family in tenancy |
| 47 | + Allow group odaa_dbmgmt-group to read database-family in tenancy |
| 48 | + Allow group odaa_dbmgmt-group to manage vnics in tenancy |
| 49 | + Allow group odaa_dbmgmt-group to use subnets in tenancy |
| 50 | + Allow group odaa_dbmgmt-group to use network-security-groups in tenancy |
| 51 | + Allow group odaa_dbmgmt-group to use security-lists in tenancy |
| 52 | + Allow group odaa_dbmgmt-group to manage secret-family in compartment MulticloudLink_ODBAA_20240105042431 |
| 53 | + Allow group odaa_dbmgmt-group to read buckets in compartment MulticloudLink_ODBAA_20240105042431 |
| 54 | + Allow group odaa_dbmgmt-group to read metrics in compartment MulticloudLink_ODBAA_20240105042431 |
| 55 | + Allow group odaa_dbmgmt-group to manage alarms in compartment MulticloudLink_ODBAA_20240105042431 |
| 56 | + Allow group odaa_dbmgmt-group to manage ons-topics in compartment MulticloudLink_ODBAA_20240105042431 |
| 57 | + Allow group odaa_dbmgmt-group to manage management-dashboard-family in compartment MulticloudLink_ODBAA_20240105042431 |
| 58 | + </copy> |
| 59 | + ``` |
| 60 | +
|
| 61 | +## Task 1: Create Database Monitor User |
| 62 | +
|
| 63 | +Set database monitoring user credentials in the **Oracle Database@Azure**. You must grant a database user, for example, **DBSNMP**, the privileges required to monitor and manage the Oracle Database@Azure Databases. |
| 64 | +
|
| 65 | + Connect to DBCS database as **SYSDBA** and execute the following : |
| 66 | +
|
| 67 | + ``` |
| 68 | + <copy> |
| 69 | + GRANT CREATE PROCEDURE TO dbsnmp; |
| 70 | + GRANT SELECT ANY DICTIONARY, SELECT_CATALOG_ROLE TO dbsnmp; |
| 71 | + GRANT ALTER SYSTEM TO dbsnmp; |
| 72 | + GRANT ADVISOR TO dbsnmp; |
| 73 | + GRANT EXECUTE ON DBMS_WORKLOAD_REPOSITORY TO dbsnmp; |
| 74 | + alter user dbsnmp account unlock; |
| 75 | + alter user dbsnmp identified by "<password>"; |
| 76 | + </copy> |
| 77 | + ``` |
| 78 | +
|
| 79 | +The database user password checks in Database Management require the password to be Federal Information Processing Standards (FIPS) compliant: |
| 80 | +
|
| 81 | +- Password length must be between 14 to 127 characters. |
| 82 | +- Password must have at least one lowercase, one uppercase, one digit, and one special character. |
| 83 | +
|
| 84 | +## Task 2: Create OCI Vault and Secret to Store Database Monitoring User Credentials |
| 85 | +
|
| 86 | +- From the Oracle Cloud Console **Navigation Menu** located in the upper left, click Identity & Security and click Vault. |
| 87 | +- On the **OCI Vaults** page, click **Create Vault**. |
| 88 | +- Create in **Compartment**: Select the name of compartment. |
| 89 | +- **Name**: Enter OnM_vault. |
| 90 | +- Click **Create Vault**. |
| 91 | +
|
| 92 | +  |
| 93 | +
|
| 94 | +- Click the vault **OnM_vault** |
| 95 | +- On the Vault Details page, click **Create Key**. |
| 96 | +- On the **Create Key** page, select all the defaults |
| 97 | +- Enter **Name** : **OnM_key**. |
| 98 | +
|
| 99 | +  |
| 100 | +
|
| 101 | +* On the **Vault Details** page, confirm the State of key is Enabled. |
| 102 | +* In the left pane, click **Secrets**. |
| 103 | +
|
| 104 | +Click Create **Secret**. On the **Create Secret** page, enter the following : |
| 105 | +
|
| 106 | +* **Compartment**: Select Compartment Name |
| 107 | +* **Name**: <dbname\>_secret |
| 108 | +* **Description**: Monitoring user password |
| 109 | +* **Encryption Key**: Select OnM_key |
| 110 | +* **Select Manual secret generation** |
| 111 | +* **Secret Contents**: Enter the DBSNMP user password |
| 112 | +* Click **Create Secret**. |
| 113 | +
|
| 114 | + Confirm the Status of <dbname\>_secret is Active. |
| 115 | + |
| 116 | +  |
| 117 | +
|
| 118 | +
|
| 119 | +## Task 3: Create a Database Management Private Endpoint |
| 120 | +
|
| 121 | +- **Database Management Private Endpoint** is required to enable communication between Database Management and your Oracle Database@Azure in a Virtual Cloud Network (VCN). |
| 122 | +- Private endpoints are needed to connect to Oracle Database@Azure running in a private VCN. |
| 123 | +- **Database Management Private Endpoint** is its network point of presence in the Oracle Database@Azure’s VCN. |
| 124 | +- The private endpoint need not be on the same subnet as the Oracle Database@Azure, although, it must be on a subnet that can communicate with the Oracle Database@Azure. |
| 125 | +- Private End point must be on a subnet in the customer VCN that can communicate with the Oracle Cloud Database |
| 126 | +
|
| 127 | +Refer Create a Database Management Private Endpoint for best practices. |
| 128 | +
|
| 129 | +- Go to **Navigation menu**, click **Observability & Management**. Under **Database Management**, click **Administration**. |
| 130 | +- On the left pane on the **Administration** page, click **Private Endpoint** and select the compartment in which you want to create the private endpoint. |
| 131 | +- On the **Private Endpoints** page, click **Create Private Endpoint**. |
| 132 | +- In the **Create Private Endpoint** dialog: |
| 133 | +- **Name**: Enter DBM_PE. |
| 134 | +- **Description**: Enter Database Management Private Endpoint. |
| 135 | +- **Choose Compartment**: Select the compartment in which you want the private endpoint to reside. |
| 136 | +- **Use this private endpoint for RAC databases**: Select this check box if you want to create a Database Management private endpoint for Oracle Database@Azures RAC databases. |
| 137 | +- **Virtual Cloud Network**: Select the VCN in which the Oracle Database@Azure can be accessed. |
| 138 | +- **Subnet**: Select a subnet within the selected VCN. |
| 139 | +- **Network Security Group**: Optionally, select an NSG |
| 140 | +- Click **Create Private Endpoint**. |
| 141 | +
|
| 142 | +## Task 4: (Optional) Add Security Rules to enable communications |
| 143 | +
|
| 144 | +- Add ingress and egress security rules to Security Lists or Network Security Groups (NSGs) |
| 145 | +- You must have the required permissions to add the ingress and egress rules to Security Lists or Network Security Groups (NSGs) |
| 146 | +- For databases running on RAC and Exadata Cloud Service, use SCAN IP for communicating with Database Management service |
| 147 | + |
| 148 | +  |
| 149 | +
|
| 150 | +- Add stateful security rules to a Security List to enable communication between a Database Management private endpoint and Oracle Database@Azure in the same subnet in the VCN. |
| 151 | +- Ingress rule for the Oracle Database@Azure's VCN: The Oracle Database@Azure's VCN (on port 1521) can receive incoming traffic from the Database Management private IP address from any port. |
| 152 | + |
| 153 | +  |
| 154 | +
|
| 155 | +- Egress rule for the Database Management private endpoint: The Database Management private IP address (from any port) can send requests to the Oracle Database@Azure's VCN on port 1521. |
| 156 | + |
| 157 | +  |
| 158 | +
|
| 159 | +## Task 5: Enable Database Management Service for Oracle Database@Azure Databases |
| 160 | +
|
| 161 | +- Navigate to the **Oracle Database@Azure Exadata VM Cluster Details** page |
| 162 | +- Click the related Database to enable the **Database Management Service** |
| 163 | +- On the **Database details** page, find **Associated services** section and click **Enable for Database Management**. |
| 164 | +
|
| 165 | +  |
| 166 | +
|
| 167 | +After the Enable Database Management page is redirected and fully loaded, verify the following database information on the page. |
| 168 | +- VM cluster |
| 169 | +- Database home |
| 170 | +- Database name |
| 171 | +- Service name |
| 172 | +- Protocol |
| 173 | +- Port |
| 174 | +
|
| 175 | +  |
| 176 | +
|
| 177 | +Provide the credentials for the database connection |
| 178 | +- **Database username**: Enter dbsnmp |
| 179 | +- **User password secret**: Select the secret from the drop down menu |
| 180 | +- Click **Add policy** to create the policy for Database Management service to read the secret. |
| 181 | +- Select **Connection Mode**: select Private Endpoint from the drop-down menu |
| 182 | +- Select **Management options**: select Full management |
| 183 | +- Click **Enable Database Management** |
| 184 | + |
| 185 | +  |
| 186 | +
|
| 187 | +## Conclusion |
| 188 | +
|
| 189 | +In this lab, you learned the steps to enable **OCI Database Management Service** for **Oracle Database@Azure** to monitor the key performance and configuration metrics of the fleet of **Oracle Database@Azure** cloud databases. In addition, all the database performance and management tools such as **Performance Hub** and **AWR Explorer** are at your finger tips to support DBAs for their day to day database operations. |
| 190 | +
|
| 191 | +## Acknowledgements |
| 192 | +
|
| 193 | +- **Author** - Royce Fu, Master Principal Cloud Architect, North America Cloud Infrastructure Engineering |
| 194 | +- **Contributors** - Royce Fu, Derik Harlow, Murtaza Husain, Sriram Vrinda |
| 195 | +- **Last Updated By/Date** - Royce Fu, January 2025 |
0 commit comments