* Your assessment is very important for improving the workof artificial intelligence, which forms the content of this project
Download Performance
Survey
Document related concepts
Transcript
1 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Safe Harbor Statement The following is intended to outline our general product direction. It is intended for information purposes only, and may not be incorporated into any contract. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described for Oracle’s products remains at the sole discretion of Oracle. 2 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Optimizing Your E-Business Infrastructure More Performant, better Productivity and reduced Costs 3 Didier Wojciechowski Solution Architect Copyright © 2012, Oracle and/or its affiliates. All rights reserved. About the speaker 15 years working on E-Business Suite . 5 Years in Oracle Services (Consulting) – France & Africa Appstech consultant 2 Years in Oracle Sales (Presales) – Switzerland 3 Years in Oracle OnDemand 5 Years in Oracle Sales (Presales) – Global Sales support 4 Years Oracle/IBM Joint solution Center (IBM montpellier) Oracle Apps specialist - Performance -Benchmarks Member of the Global Sales Engineered Systems Solutions Architecture Group 4 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Program Agenda The challenges when deploying EBS Performance Availability Manageability Security Product Certification Q&A 5 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Challenges when deploying EBS 6 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Challenges when deploying EBS Background: Release History 7 Release 8.3.5 1992* Release 9.3 1993* Release 9.4 1994* Release 10.5 1995* Release 10.6 1996* Release 10.7 Feb-1997 Release 11 May-1998 Release 11.5 (11i) May-2000 Release 11.5.10.2 (11i10.2) Jul-2005 Release 12 Feb-2007 Release 12.1 Apr-2009 Release 12.2 (Planned) Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Challenges when deploying EBS COMING SOON Background: Footprint Release 11i Software 26 Gb Production Database 31 Gb Vision Database 65 Gb Release 12.0.4 Software 28 Gb Production Database 45 Gb Vision Database 133 Gb Release 12.1.1 Software 35 Gb Production Database 55 Gb Vision Database 8 208 Gb Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Release 12.2 Software Production Database Vision Database FusionApps Software Production Database 60 Gb 64 Gb 175 Gb ? Gb ? Gb 1 Tb Challenges when deploying EBS Background: Trend Installation Time Features 9 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Footprint Challenges when deploying EBS • • • • 10 Performance Maximum Availability Manageability and Maintenance Security Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Challenges when deploying EBS Challenge #1: Performance • • • • • • OLTP response time to keep under the SLA OLTP peak day time Day-to-Day batch performance Nightly Batch window that are slipping during daytime Period closure that are facing delays Long running batches with auditors waiting for their reports. • SQL Plan changes 11 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Challenges when deploying EBS Challenge #2: Maximum Availability • MiddleTier response time as the number of users increase • 24/7 requirements • Service Level Agreement • Unplanned outage (hardware failure, network, power,etc) • Planned downtime (patching, upgrade) 12 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Challenges when deploying EBS Challenge #3: Maintenance and Manageability (1/3) • Ongoing patches maintenance • Service Request: Probleme reproduction, testing, deployment • Technology Stack maintenance – Database upgrade – Middle Tier upgrade ../.. 13 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Challenges when deploying EBS Challenge #3: Maintenance and Manageability (2/3) • Release updates: will there be enough hardware resource(s) available to test or evaluate EBS release updates: – – – – From 11i to R12.x From R12.0 to R12.1 From R12.1 to R12.2 To FusionApps ../.. 14 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Challenges when deploying EBS Challenge #3: Maintenance and Manageability (3/3) • Many environments to maintain (5 to 25 or more) • Environment provisioning – – – – 15 Testing requirements to be adressed Environment sharing is difficult Cloning time turnover is critical Environment management is a full time job(s) Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance 16 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance Applicative parallelism • In R12.0, most EBS critical concurrent programs now have multi-threaded capabilities: – AR Autoinvoice – XLA CreateAccounting – AP Invoice Validation […] • But most implementers leave ‘by default’ options 17 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance SQL Tuning Advisor • Built-in database feature to provide optimized plan recommendations • SQL Tuning advisor is accessible from both: – The database console – The Grid Control – Command line (SQL*Plus) using DBMS_AUTO_SQLTUNE • SQL Tuning Advisor can be used to check if there is a quickwin possible fix, waiting for a SR to be logged, or the issue to be investigated further 18 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance SQL Tuning Advisor: Grid Control 19 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance SQL Tuning Advisor: Case Study 20 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance Real Application Clusters • Real Application Cluster can be considered to increase the workload throughput. • RAC may be the only viable and scalable solution to achieve the performance • A wise setup is required with EBS 21 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance Create Accounting Performance w/ RAC – Case Study (1/7) • • • • 22 Financials Accounting Hub 15 Millions of events to process RAC 4 nodes Concurrent managers configured in load balancing mode over the 4 RAC nodes Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance Create Accounting Performance w/ RAC – Case Study (2/7) 23 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance Create Accounting Performance w/ RAC – Case Study (3/7) Night Batch Activity Daylight OLTP XLAACCPB Accounting Workers Unevenly split over all RAC nodes CE XLAACCUP CA 24 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance Create Accounting Performance w/ RAC – Case Study (4/7) • Concurrent Manager server load balancing results into into uneven database server load and unpredicable elapsed time • Solution: - Configure node affinity with one apps node per db node - Split the load over the 4 apps node 25 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance Create Accounting Performance w/ RAC – Case Study (5/7) db_prod_01 db_prod_02 ASM01 db_prod_03 ASM02 PROD01 db_prod_04 ASM03 PROD02 ASM04 PROD03 PROD04 Service BATCH_C Service BATCH_D Service OLTP_BAL Service BATCH_A Service BATCH_B server01 server02 CPMGR CPMGR appserver01 appserver02 server03 26 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Web/ Forms Web/ Forms CPMGR CPMGR appserver03 appserver04 server04 Performance Create Accounting Performance w/ RAC – Case Study (6/7) Night Batch Activity CE XLAACCPB 01 XLACCCUP 01 XLACCCUP 01 XLACCCUP 01 CE XLAACCPB 02 XLACCCUP 02 XLACCCUP 02 XLACCCUP 02 CE XLAACCPB 03 XLACCCUP 03 XLACCCUP 03 CA XLACCCUP 03 CE XLAACCPB 04 XLACCCUP 03 XLACCCUP 04 XLACCCUP 04 27 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Daylight OLTP Performance Create Accounting Performance w/ RAC – Case Study (7/7) Lessons learnt for FAH/CreateAccounting: • Understand the batchsize and workers settings • Having a smaller number of powerfull RAC nodes is better than having a high number of small RAC nodes • Define one apps server per database node • Use Instance affinity and FND specialization rules to split the workload over multiple RAC instances 28 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance LoadBalancing w/ RAC – Best Practices (1/3) • Create the following Cluster Database Services: <PROD>_FORMS <PROD>_SSA <PROD>_BATCH_A <PROD>_BATCH_B • Specify the alias in the $TNS_ADMIN ifile file <PROD>_CLIENT_FORMS= (DESCRIPTION= (ADDRESS_LIST= (LOAD_BALANCE=YES) (FAILOVER=YES) (ADDRESS=(PROTOCOL=tcp)(HOST=node1)(PORT=1531)) (ADDRESS=(PROTOCOL=tcp)(HOST=node1)(PORT=1531)) ) (CONNECT_DATA= (SERVICE_NAME=<PROD>_FORMS) )) 29 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance LoadBalancing w/ RAC – Best Practices (2/3) • Update in autoconfig on all nodes – Tools OH TWO_TASK’ (s_tools_two_task) to <PROD>_FORMS – ‘iAS OH TWO_TASK’ (s_weboh_twotask) to <PROD>_SSA – ‘Apps JDBC Connect Alias’ (s_apps_jdbc_connect_alias) to <PROD>_SSA • Update in autoconfig on first node – Concurrent Manager TWO_TASK’ (s_cp_twotask) to <PROD>_BATCH_A • Update in autoconfig on second node – Concurrent Manager TWO_TASK’ (s_cp_twotask) to <PROD>_BATCH_B 30 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance LoadBalancing w/ RAC – Best Practices (3/3) • Update APPLFSTT from all middle tier nodes to ensure that the <PROD>_CLIENT_FORMS is specified <APPLFSTT oa_var="s_applfstt"> …;<PROD>_FORMS;… </APPLFSTT> • If this step is not performed, the following error may be returned while opening the concurrent requests output and logfile IAP-CANNOT READ FIELD (FIELDNAME=PARAMETER.CONFIG) 31 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance SQL Plan Management (1/6) Usual situation: • Plan regression after patch application • Typical of R12 usage of GTT *, when the same program is run for two different workloads from different subsidiaries, depending on the order of company these program are run, the optimizer may choose and hold a path that will not be suitable for companies that are run second and typically with a bigger workload. * : Global Temporary Table 32 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance SQL Plan Management (2/6) Prior to 11g • Unpredictable changes can happen to an execution plan • Avoiding plan changes the only method to avoid performance regression – Lock Statistics to prevent them from changing – Freezing an execution plan with a Stored Outline – Hints – Code changes • No mechanism for plans to evolve 33 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance SQL Plan Management (3/6) New with 11g • SQL Plan management with 3 main components – SQL Plan baseline capture – SQL Plan baseline selection – SQL Plan evolution 34 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance SQL Plan Management (4/6) • Managed from – Command lines (SQL*Plus) using DBMS_SPM – Database console or Grid Control • Monitored from – DBA views DBA_SQL_PLAN_BASELINES – Database console or Grid Control 35 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance SQL Plan Management (5/6) 36 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance SQL Plan Management (6/6) 37 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance Partitioning: Support Note • Oracle Applications fully supports the use of custom partitioning of either Applications standard or custom tables • Custom partitioning = Changing the partitioning definition of an existing applications table as delivered out-of-thebox from the standard installation 38 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance Partitioning: Benefits (1/2) • Table availability – Significantly reduce recovery times of key transaction tables by recovering specific partitions first. • Table manageability – Backup, restore, and rebuild at the partition level. – Index rebuilds can be performed at the partition level. – Partition aware operations such as MOVE, EXCHANGE, REBUILD can be used without affecting active partitions 39 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance Partitioning: Benefits (2/2) • Performance – Improves access path of most queries since the majority of the access involves current data (as opposed to historical data) – Optimizer automatically prunes unnecessary partitions. – Analytical reports or period close jobs/reports improve by scanning the current partition as opposed to all the partitions. – Improves purge performance. – Significantly improves upgrade performance – Minimizes upgrade downtime 40 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance Partitioning: Usage in standard products • • • • • • • • 41 Subleddger Accounting Architecture Payables (Trial Balances) Advanced Planning and Scheduling Projects Resources Workflow Daily Business Intelligence HR (Employee Directory) Engineering Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance Partitioning: Constant innovation Oracle 8.0 Core functionality Performance Manageability Range partitioning Static partition pruning Basic maintenance: ADD, DROP, EXCHANGE Partition-wise joins Expanded maintenance: MERGE Global Range indexes Oracle 8i 42 Hash partitioning Range-Hash partitioning Oracle 9i List partitioning Oracle 9i R2 Range-List partitioning Oracle 10g Global Hash indexes Oracle 10g R2 1M partitions per table Oracle 11g Virtual column based partitioning More composite choices REF partitioning Oracle 11g R2 Hash-Hash partitioning Expanded REF partitioning Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Dynamic partition pruning Global index maintenance Fast partition SPLIT Local Index maintenance Multi-dimensional pruning Fast DROP TABLE Interval partitioning Partition Advisor Incremental stats mgmt “AND” pruning Multi-branch execution Performance Partitioning: Case Study 1 (Ledger) • International Bank • Data Volumes – GL_JE_LINES (1.1 Billion rows) – GL_CODE_COMBINATIONS (203 Million rows) – GL_BALANCES (1.3 Billion rows) • Partitioning Method: Range (set_of_books_id) • # of Partitions: 34 • Achieved 11.4M journal lines imported and posted per hour 43 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance Partitioning: Case Study 2 (Ledger) • Australian Bank • Data Volumes – GL_JE_LINES (650 Million rows) – GL_CODE_COMBINATIONS ( 8.5 Million rows) – GL_BALANCES (200 Million rows) • Partitioning Method: Range (period_name) • # of Partitions: 109 • Achieved 7.5M journal lines imported and posted per hour 44 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance Partitioning: Case Study 3 (Payables Trial Balance) • Data Volumes – AP_LIABILITY_BALANCE (70M rows) • Partitioning Method: Hash (org_id) • # of Partitions: 32 • Trial Balance report runtime reduced from 2 hours to 10 minutes. 45 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance Custom monitoring Scripts • Consider replacing uneffective, possibly outdated, custom scripts with more efficient Grid control monitoring. 46 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance Custom monitoring Scripts: Case Study 47 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance RUEI: Real User Experience Insight Challenge • • • • • How to accurately monitor user experience? Performance Different Locations/Geographies Transaction success/failure/abandonment How to objectively measure end-user satisfaction with an application? • Synthetic Transactions • Compare actual to planned Internet VPN Firewall Capture Point Network Switch / Tap Web Servers Solution App Servers • Capture and store ALL user activity at convergence point • Agentless - Zero performance impact • No application changes required RAC 48 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance RUEI: (Real) Case Study • • • • • A few users facing unusual performance issue FRD tracing show no issue SQL tracing show no issue Man days spent in troubleshooting End user unhappy • REUI installed for evaluation 49 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance RUEI: Case Study: Page loading time per user (2/10) 50 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance RUEI: Case Study: Page loading time satisfaction (3/10) 51 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance RUEI: Case Study: Page load and reading time (4/10) 52 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance RUEI: Case Study: Page loading time satisfaction (1/2) 53 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance RUEI: Case Study: Page loading time satisfaction (2/2) 54 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance RUEI: Case Study: Object size details 55 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance RUEI: Case Study: Object and Size 56 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance RUEI: Case Study: Traffic Size 57 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance Customisations code review (1/2) • Most e-Business suite environments are customized. • It is not unusual to see customizations listed in the 10 slots of the top 10 consumers in AWR Reports. • Have ACS or OCS review a few significant customizations. • Make sure PL/SQL programs do not implement row-byrow processing: Implement bulk collect for performance. 58 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance Customisations code review (2/2) • Make sure exception handling is properly adressed, as data corruption are a more serious matter than performance. 59 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Performance Summary • • • • • • • 60 Use applicative parallelism Use SQL Tuning Advisor for quickwin advise Consider RAC to increase the workload throughput Use partitioning (XLA, eTAX) Leverage native and lightweight Grid monitoring Use RUEI for end-user real performance analysis Have your customizations code reviewed by experts Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Q&A 61 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Maximum Availability 62 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. “Anything that can go wrong, will go wrong.” Murphy’s Law 63 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Maximum Availability The Register, January 2012 Tieto, a prominent Swedish IT service supplier, had a storage array fail on 25 November, causing five days of chaos … ...SBAB bank was heavily affected, despite having a 99.8% uptime agreement with Tieto The stoppage was caused by failures in a storage array and compounded by an inadequate disaster recovery plan involving tape backup files which could not be read. http://www.theregister.co.uk/2012/01/13/tieto_emc_crash/ http://www.channelregister.co.uk/2012/01/16/tieto_vnx5700/ 64 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Maximum Availability Requirements • Site outage due to natural disaster (fire, flood, fire, etc) • Site outage due to failure (power outage, A/C outage) • Local outage – – – – – 65 Planned maintenance (operating system or database upgrade) Faulty component (memory, CPU) Data corruption Bug Human error Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Maximum Availability Adressing both planned and unplanned downtime Automatic Storage Management MiddleWare Clustering • Server failure Recovery Manager (RMAN), Media and Oracle RAC • Instance failure • Server failure Server • Rolling Failure maintenance • Active-Active: performance scale-out Storage Oracle Secure Backup Failures ACFS • Storage failure • Data recovery • Backups 66 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Active Data Guard • Database failure • System failure • Site failure Database, • Zero data loss System, • Automatic failover Cluster, Site, • Best data protection and • Database rolling Geographic upgrade Outages • Offload read-only workload and backups Flashback • Fast point-intime recovery • Granular repair of logical corruptions Human or • Transaction Application • TableError • Database EBS 12.2 • Online Patching GoldenGate • Flexible maintenance Flexible •Maintenance Heterogeneous migrations and • Schema migration Migrations • Bi-directional and multi-master replication • Zero downtime maintenance Maximum Availability MAA Target Architecture Disaster Recovery Site Primary Site Application Tier Database Tier Oracle RAC and ASM Oracle RAC and ASM Oracle Data Guard Oracle Database 67 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. HA Storage Oracle Standby Database Maximum Availability MAA Target Architecture: Database Real Application Clusters & Clusterware Data Guard Fully Active Failover Replica Fault Tolerant Server Scale-Out Primary Site Database Servers Database Servers Storage Storage Automatic Storage Management Fault Tolerant Storage Scale-Out 68 Disaster Recovery Site Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Flashback Correct Errors by Moving Back in Time Recovery Manager & Oracle Secure Backup Low Cost High Performance Data Protection and Archival Maximum Availability MAA Target Architecture: Apps Tier Hardware Load Balancers Redundant Configuration Multiple Web Servers Application Tier Database Tier Parallel Concurrent Processing Fault tolerant batch processing Database or Application Tier 69 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Load Balanced Multiple Forms Servers Load Balanced Maximum Availability RAC One node A better alternative than other (former) cold failover (ex HACMP over GPFS) • ASM Compatible • Same tools, interface, processes than RAC multi-nodes • Not manual steps required after a failover. 70 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Maximum Availability Active DataGuard Milano Sync or Async Redo Shipping Production Database Backup Redo Apply Network Paris Copyright © 2012, Oracle and/or its affiliates. All rights reserved. DIGITAL DATA STORAGE DIGITAL DATA STORAGE Broker Transform Redo to SQL Logical Standby Database SQL Apply 71 Physical Standby Database Open for Reports Madrid Maximum Availability Active DataGuard 72 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Maximum Availability Active Dataguard vs Storage Mirroring Primary Database Data Guard Log Buffer Online Logs No data or storage type restrictions Archive Logs Strong isolation Flashback Logs Control Files Data Files SYSTEM USER TEMP UNDO 73 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. End-to-end validation Detect silent corruption Automatic block repair Real-time reporting Storage agnostic Standby Database Oracle Apply & Validation Maximum Availability Active Dataguard vs Storage Mirroring Primary Volumes Network I/O Target Volumes Log Buffer Online Logs Archive Logs Flashback Logs Control Files Data Files SYSTEM USER TEMP UNDO 74 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. 7X more network volume 27X more network I/Os No Oracle validation Poor isolation Idle standby systems Maximum Availability Active DataGuard for reporting • Its limitation in term of report types supported were so limited than it is not really usable. 75 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Maximum Availability Active DataGuard and Snapshot Standby • Use DataGuard/Snapshot Standy to keep fresh d – 1 pre-prod environmnent to reproduce production issues. 76 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Maximum Availability GoldenGate • Deploying Oracle GoldenGate to Achieve Operational Reporting for Oracle E-Business Suite.(Doc ID 1112325.1) 77 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Maximum Availability R12.2 w/ Online Patching • R12.2 is around the corner with hot patching capabilities • This was the missing piece for a full MAA capabilities 78 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Maximum Availability Don’t forget Monitoring Be the first to know 79 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Availability Summary Consider … • RAC for hardware failure • Active DataGuard for – site outage – reporting or pivot • Flashback for human or application error • Moving to R12.2 to benefits from online patching • Goldengate for database migration 80 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability 81 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Automatic Storage Management • Automatic Storage Management (ASM) has been introduced with 10gR2 to simplify the database files management • Can be administered from – – – – 82 Grid Control asmca (GUI interface) asmcmd (command line interface) SQL*Plus Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Automatic Storage Management: ORA-01653 • ORA-1653 cannot allocate extent of size x in tablespace y • The number of occurrence of this error means it is time to move on to Automatic Management with easier to maintain syntax and lower maintenance cost: SQL> CREATE TABLESPACE apps_ts_data DATAFILE ‘+DG_DATA’ SIZE 200G ; 83 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Automatic Storage Management: Datafiles management • Still creating 2Gb datafile? • Specify your datafiles bigfile, autoextend, and monitor the expansion growth of your ASM datagroup using the Cloud Control SQL> 84 CREATE BIGFILE TABLESPACE apps_ts_index DATAFILE ‘+DG_DATA‘ SIZE 100G EXTENT MANAGEMENT LOCAL SEGMENT SPACE MANAGEMENT AUTO AUTOEXTEND ON; Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Automatic Storage Management: Disk Management (1/2) • Need disk space? • Expose a new LUN to the disk group. • ASM will automatically balance the existing datafiles to take into account the newly added disk group members 85 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Automatic Storage Management: Disk Management (2/2) • Need to replace storage? • • • • • 86 Connect the new storage Expose the new LUNs to the disk group Delete the old LUNs from the disk group Wait for the ASM load balancing to finish Remove the old storage Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Automatic Storage Management: Grid Control View (1/2) 87 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Automatic Storage Management: Grid Control View (2/2) 88 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Advanced Compression • Noticable storage increase from 11i to R12.x – Subledger Accounting Architecture – E-Business Tax • Government Regulations (Sarbanes-Oxley, etc) with requirements to keep online years of accounting or transactional data 89 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Advanced Compression: Background • • • • • 90 Index Compression (8i) Table Compression (9iR2) Advanced Compression (11gR1) Advanced Compression further enhancements (11gR2) Hybrid Columnar Compression (11gR2 w/Exadata) Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Advanced Compression: Background Also new with Advanced Compression • DataGuard network compression • Datapump compression • RMAN backup compression • SecureFiles compression 91 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Advanced Compression: Index Compression (1/2) • Works by eliminating duplicate column values in leaf index blocks • Limitation: – Does not work on single-column unique indexes 92 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Advanced Compression: Index Compression (2/2) SQL> ALTER INDEX gl.gl_balances_n3 REBUILD NOCOMPRESS; Index altered. SQL> SELECT bytes/1024 FROM dba_segments WHERE segment_name='GL_BALANCES_N3'; BYTES/1024 ---------172416 SQL> VALIDATE INDEX gl.gl_balances_n3; Index analyzed. SQL> SELECT name, blocks, lf_blks, br_blks, opt_cmpr_count, opt_cmpr_pctsave FROM index_stats; NAME BLOCKS LF_BLKS BR_BLKS OPT_CMPR_COUNT OPT_CMPR_PCTSAVE ------------------------------ ---------- ---------- ---------- -------------- ---------------GL_BALANCES_N3 21552 21293 54 2 38 SQL> ALTER INDEX gl.gl_balances_n3 REBUILD COMPRESS; Index altered. SQL> SELECT bytes/1024 FROM dba_segments WHERE segment_name='GL_BALANCES_N3'; BYTES/1024 ---------106240 Reduction from 172Mb to 106Mb (39%) 93 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Advanced Compression: Table Compression (1/2) • Data is compressed at the database block level • 2 methods of compression (11gR2) – BASIC (or “DIRECT_LOAD OPERATIONS”) • Compression during bulk load operations (Direct Load, Create Table as Select) • Data modified using conventional DML not compressed – OLTP (or “FOR ALL OPERATIONS”) 94 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Advanced Compression: Table Compression (2/2) SQL> SELECT FROM WHERE AND BYTES/1024 ---------727424 bytes/1024 dba_segments segment_name = 'XLA_DISTRIBUTION_LINKS' partition_name = 'AP'; SQL>ALTER TABLE xla.xla_distribution_links MOVE PARTITION ap COMPRESS FOR ALL OPERATIONS; Table altered. SQL>SELECT FROM WHERE AND BYTES/1024 ---------142976 bytes/1024 dba_segments segment_name = 'XLA_DISTRIBUTION_LINKS' partition_name = 'AP'; Reduction fron 727M to 142Mb (divide by 5) 95 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Advanced Compression: Other benefits • Reduces storage consumption by a 2-3 factor – Savings cascades into pre-prod, test, uat, dev • • • • 96 Enhances Memory and Network Efficiency db sequentiel reads reduction Full table scan performance improvement Moderate variation in CPU consumption (from -7% to +6%) Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Advanced Compression: Best practices (1/3) • Use advisor to estimate space saving – dbms_comp_advisor.getratio (9i to 11gR1) – dbms_compression.get_compression_ratio (11gR2) • Focus tables compression first on largest tables or tables that contributes the most on I/O, eg: – – – – 97 XLA_DISTRIBUTION_LINES XLA_AE_LINES GL_JE_LINES GL_IMPORT_REFERENCES Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Advanced Compression: Best practices (2/3) • Exclude heavily accessed tables – FND_CONCURRENT_REQUESTS • Focus index compression on largest indexes first • Indexes with repeating keys will offer the best compression ratio • Do not compress all indexes from a given table – Validate indexes to check both the optimum number of columns to compress and the compression ratio – Compress the index that show the most significant ratio 98 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Advanced Compression: Best practices (3/3) • Index partitions are good candidates • Consider increasing INITRANS if significant ITL Waits are observed in v$waitstat or in AWR • Establish SQL Plan baseline to anticipate on possible SQL Plan regressions 99 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Advanced Compression: Case Study Global Internal Instance (1/2) • Compressed ~260 tables, ~1600 indexes, ~28 LOBS using 11g SecureFiles • Average overall storage saving: 3x – Table compression – Index compression – LOB compression 4x 2x 2.3x • Reduced database size from 18Tb to 11Tb 100 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Advanced Compression: Case Study Global Internal Instance (2/2) • • • • 101 11 environments (primary, standby, tests, etc) 7 Tb saved per environment 3-ways storage (online, mirror, backup) Total saving: 11*7*3 = 231Tb Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Advanced Compression: Higlas – OOW (11i) 102 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability Hybrid Columnar Compression • Data is grouped by column and then compressed using specified mode. • Query Mode for data warehousing – Optimized for speed – 10X compression is typical – Full scans improved proportionally • Archival Mode for infrequently accessed data – Optimized to reduce space – 15X compression is typical – Up to 50x performance 103 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Manageability • OLTP Compression Overall 3.6 Largest Table 4x • Query High Size Reduction Factor by Table Hybrid Columnar Compression: Global Internal Instance 50 45 40 35 30 25 20 15 10 5 0 OLTP Compression (avg=3.3) 43 Query Compression (avg=14.6) Archive Compression (avg=22.6) 10 10 10 11 29 16 Overall 15x Largest Table x35 • Archive High Overall 23x Largest Table x52 Up to 52x reduction in table size 104 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. 19 19 19 20 21 Manageability ApplicationsTesting Suite • Covered by Jean Baptiste M 105 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security 106 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. “If you spend more on coffee than on IT security, then you will be hacked… …what's more, you deserve to be hacked!.” Richard Clarke Special Advisor to the President Cyberspace Security 107 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security What, where are the sensitive EBS data • CreditCard Data • Standard tables • Bank account number • Flexfields • Compensation • Backup tables • Employment details • Interface tables • Nationality / Citizenship • Interface files • Health Information • Customized tables • Personal information • Logfiles • Passwords • Audit and session tables • etc… 108 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Target of data breaches Type Category % Breaches % Records Database Server Servers & Applications 25% 92% Desktop Computer End-User Devices 21% 1% 2010 Data Breach Investigations Report 109 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Existing protection is not enough! Key Loggers Malware Phishing SQL Injection Botware Espionage Social Engineering Web Users Application Users Application Database Administrators MustBe Be Protected Protected in in depth DataData Must depth 110 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Oracle Database Security: Continus Innovation Database Firewall Oracle Database 11g Data Masking TDE Tablespace Encryption Audit Vault Oracle Database 10g Database Vault Transparent Data Encryption Proxy Authentication Oracle Database 9i Fine Grained Auditing Oracle Label Security Enterprise User Security Oracle8i Virtual Private Database (VPD) Database Encryption API Strong Authentication Oracle7 Native Network Encryption Database Auditing 111 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Maximum Security Architecture Audit consolidation Audit Monitoring SQL Control Access Allow Financials Sensitive Log HR Confidential Alert Substitute Applications Block Network SQL Monitoring and Blocking 112 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Public iStore Unauthorized Local Activity DB Consolidation Security Local DBA Privilege Mis-Use Encrypt Encrypted Database Encrypted Encrypted Backups Exports Data Masking Security Database Vault Procurement DBA HR Application Finance select * from iby.iby_ext_bank_accounts • Allow security Administrator to restrict areas from users, including priviledged users • Prevent application by-pass • Enforce who, where, when, and how using rules and factors 113 User Factors: Name, Authentication type, Proxy Enterprise Identity Network Factors: Machine name, IP, Network Protocols Database Factors: IP, Instance, Hostname, SID Runtime Factors: Date, Time Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Database Vault • Administration, monitoring and reporting provided from – – – – 114 Database control Grid Control with restrictions Database Vault Administrator console PL/SQL API (dbms_macadm) Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Database Vault: My Oracle Support - Oracle Support Document 1091083.1 (Integrating Oracle E-Business Suite Release 12 with Oracle Database Vault 11gR2). - Oracle Database Vault Administrator’s Guide 11gR2 E23090-04 115 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Database Firewall: What is SQL Injection (1/4) SELECT * from stock where catalog-no = 'PHE8131' Good and location = 1 Application 116 SELECT * from stock Bad where catalog-no = '' union select cardNo, customerId, 0 from Orders --' and location = 1 • (Mis)users subvert the application to access to the database • (Custom) Applications not designed defensively • (Custom) Applications are given high levels of privilege Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Database Firewall: What is SQL Injection (2/4) Parameters for SQL come from user input, for example from web browser. The application layer accepts the values for catalog-no and location (‘PHE8131’, PHE8131 ‘1’) 1 and pastes them into the pre-canned query template. SELECT * from stock where catalog-no = ' ' and location = Output: Description Star Trek - The Next Generation Season 2 Star Trek - The Next Generation Season 3 Star Trek - The Next Generation Season 4 Star Trek - The Next Generation Season 5 117 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Price # in Stock 39.35 39.35 39.35 39.35 15 12 13 17 Security Database Firewall: What is SQL Injection (3/4) Instead of inputting a normal value for catalog-no, the user enters ' union select cardNo, customerId, 0 from Orders -- The database receives the following query SELECT * from stock where catalog-no = ' ' and location = Output Payment Card details 118 Description 4511222233334444 4612345678901234 4675883388338833 4514861356415750 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. . Price 11853 11853 11588 11204 0 0 0 0 # in Stock Security Database Firewall: What is SQL Injection (4/4) Payment Card details exposed! 119 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. ' union select cardNo, customerId, 0 from Orders -- Security Database Firewall: First line of defense Allow Log Alert Applications Substitute Block • Monitor database activity on the network • Prevent • SQL Injection • Unauthorized database activity, • Miuse of database privilege • Capture and log database interactions for forensic analysis and compliance reporting 120 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Database Firewall: Policies based model enforcement White List Allow Block Applications • Black-list and White-list based policies enforce normal or expected behavior • Policies evaluate factors such as time, day, network, and application • Easily generate white-lists for any application • Out of policy SQL statements can be logged, alerted, blocked or substituted 121 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Database Firewall: Compliance Reporting • • • • • Full Activity Report Database Administration Active Users Differential Audit Data Modification Detail and much more 122 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Transparent Data Encryption • Anyone having access at the OS level to the database files can read any unencrypted data • Oracle Advanced Security proposes two methods to protect data at rest: – Column encryption – Tablespace Encryption • TDE can also be used with Oracle RMAN to encrypt entire database backups to disk. • Transparent for all applications 123 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Transparent Data Encryption: My Oracle Support - Oracle Support Document 828229.1 (Using TDE Tablespace Encryption with Oracle E-Business Suite Release 12) - Oracle Database Advanced Security Administrator’s Guide 11gR2 E10746-03 124 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Data Masking: What is this? Production LAST_NAME SSN SALARY Non-Production LAST_NAME SSN SALARY DUPONT 203-33-3234 40,000 ANEL 111-23-1111 70,000 DURANT 323-22-2943 60,000 BEBEL 222-34-1345 40,000 • The act of anonymizing customer, financial, or company-confidential data to create new, legible data that retains the data's properties, such as its width, type, and format • To protect confidential data in non-production environments when the data is shared with non-production users without revealing sensitive information 125 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Data Masking: Using EM Clone Mask Clone Production Staging Test • Used in conjunction with cloning • Create irreversibly scrambled versions of your production DB for testing & development 126 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Data Masking: EBS Masking templates • E-Business Suite Masking Template – Metadata for the EM Masking tool – Columns, Relationships, and Masking rules for PII and Sensitive attributes for E-Business Suite products • 950 Columns – 65% HCM - Payroll, Employment Details, Personal Info • Also TCA, ATG, Financials, Projects… • Not split out by product or family – De-identification needs to be done across the database 127 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Data Masking: What is being masked • De-Identify the data – Scramble identifiers of individuals (PII) – Name, account, address, location, drivers license… • Mask sensitive data that, if associated with PII, would cause privacy concerns • Compensation • Health • Employment Information • Maintain Data Validity not to break applications 128 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Data Masking: What is not being masked • Financial data – Results – Forecasts • Unstructured data – Descriptive Flex Fields (user extensible content) – Except where we know the content • Notes • Attachments 129 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Audit Vault: The need for auditing • Key Drivers – Regulatory Compliance (SOX, PCI, Privacy, …) • Risk assessment and compensating controls • Demonstrate controls for compliance – Security • Detect misuse of privileges • Key Requirements – – – – Collect Audit trail data from many audit silos Automate review of the audit trail logs, and raise alerts Centralize audit policy management Secure the audit trail (Priviledged account may be mis-used to manipulate native audit trail or syslog) – Minimize performance impact on production systems 130 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Audit Vault • Automates the collection and consolidation of audit data to support regulatory compliance and reduce security risks. • Provides – compliance and entitle reports, – alert notifications, – centralized audit policy management. • Works out of the box with e-Business Suite and other packaged applications: no setup required 131 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Audit Vault: EBS Integration ! HR Data CRM Data ERP Data Audit Data Databases Two components: • One central and standalone Audit Vault server • A set of Audit Vault collection agents 132 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Alerts Built-in Reports Custom Reports Policies Auditor Security Audit Vault: Out of the box Audit Reports 135 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Audit Vault: Out of the box Audit Reports • Out-of-the-box reports – – – – – Privileged user activity Access to sensitive data Role grants DDL activity Login/logout • User-defined reports – What privileged users did on the financial database? – What user ‘A’ did across multiple databases? – Who accessed sensitive data? • Custom reports 136 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Audit Vault: Manageability • Audit Vault Dashboard – – – – Enterprise overview Alerts and Reports Administration Audit Policies • Audit Vault Policies – – – – 137 Provision database audit settings centrally for compliance policies Collection of audit settings on the databases Compare against existing audit settings on source Demonstrate compliance Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Audit Vault: My Oracle Support - Oracle Support Document 1199033.1 Master Note for Oracle Audit Vault) - Oracle Audit Vault Administrator’s Guide 10.3 E23571-05 138 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Network Security - Consider implementing the Oracle Net valid node checking in sqlnet.ora from your database server: tcp.invited_nodes = ebs-ap01, ebsap02 - Implement Oracle Advanced Security to encrypt the network traffic between the app tier(s) and the database servers - Benefits from hardware acceleration on some platforms 139 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Network Security: My Oracle Support - Oracle Database Advanced Security Administrator’s Guide 11gR2 E10746-03 140 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Apps schema protection: Case study Anything wrong here? 141 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Apps schema protection: Best practices • Restrict the use of APPS schema to the Application DBA only • Create read-only schema for query and troubleshooting 142 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security DMZ Setup • See Oracle E-Business Suite R12 Configuration in a DMZ (Doc ID 380490.1) 143 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Summary (1/2) • Lock down your apps account • Create a read-only schema • Consider Database Firewall to protect against SQL injection (and more) • Leverage Database Vault for separation of duties • Scramble your data during cloning • Encrypt your data, not only in the data but in all directions 144 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Security Summary (2/2) • Consider Audit Vault for reporting • Consider Oracle Advanced Security to encrypt the network traffic 145 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Product Certification 146 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Certification EBS Certification to date • • • • 147 11i.10.2 is certified with database up to 11.2.0.3 R12.0.6 is certified with database to 11.2.0.3 R12.1.3 is certified with database to 11.2.0.3 R12.2 may ship with 11.2.0.3 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Certification Database Roadmap 148 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. Q&A 149 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. 150 Copyright © 2012, Oracle and/or its affiliates. All rights reserved. 151 Copyright © 2012, Oracle and/or its affiliates. All rights reserved.