Oracle orachk Assessment Report

System Health Score is 92 out of 100 (detail)

 
Benefit / Impact:

Core dumps are sometimes needed for debugging purposes



Risk:

Improper setting of COREDUMPSIZE could prevent or prolong troubleshooting if the maximum core file size is too small.


Action / Repair:

The system may not have an adequate COREDUMPSISZE. It is recommended to set the OS core file size to 2GB or greater to aid in troubleshooting issues that generate core dumps (i.e. ORA-7445 errors).
 

1. Note: 567524.1 - Setting Shell Limits For The User "oracle" In Case Of 10gR2 And 11gR1 RDBMS Software

 Recommended value for File size user limit (ulimit -f) is either unlimited or -1
 

 Recommended value for CPU time user limit (ulimit -t) is either unlimited or -1
 

 OS Kernel Parameter tcp_largest_anon_port recommended value is 65500

Use following links to verify that tcp_largest_anon_port is configured as per its recommendation.
 

 Recommended value for Data segment size user limit (ulimit -d) is either unlimited or 1048576 
 

 Use following links to verify that udp_largest_anon_port is configured as per its recommendation.
 

 Recommended value for stack size user limit (ulimit -Hs) is either unlimited or 32768
 

1. Configuring Shell Limits for Oracle Solaris

 OS Kernel Parameter tcp_smallest_anon_port recommended value is 9000.


 

 Recommended value for virtual memory user limit (ulimit -s) is either unlimited or 4194304
 

 OS Kernel Parameter udp_smallest_anon_port recommended value is 9000.

Use following links to verify that udp_smallest_anon_port is configured as per its recommendation.
 

 Please review MOS Note 169706.1 - Oracle Database on Unix AIX,HP-UX,Linux,Mac OS X,Solaris,Tru64 Unix Operating Systems Installation and Configuration Requirements Quick Reference (8.0.5 to 11.2)
 

1. Note: 68304.1 - WHAT IS UMASK
2. Configuring the oracle User's Environment

 
Benefit / Impact:

Documented value, cluster stability

The soft nofile shell limit for the Oracle DB software install owner as defined in /etc/security/limits.conf should be >= 1024.



Risk:

Resource starvation leading to node instability



Action / Repair:

Change DB software install owner soft nofile shell limit
 

 
Benefit / Impact:

Documented value, cluster stability

The hard nproc shell limit for the Oracle DB software install owner as defined in /etc/security/limits.conf should be >= 16384.



Risk:

Resource starvation (processes) leading to node instability



Action / Repair:

Change DB software install owner hard nproc shell limit

 

 
Benefit / Impact:

OSWatcher is used to collect and archive operating system and network metrics to aid support in diagnosing performance issues. Checking OSWatcher status helps to ensure critical data is available for analysis when system occurring issues. 
 
There is no impact from verifying the OSWatcher status. 

Risk:

When OSWatcher is not running, data is not gathered on a regular basis. System engineers may not be able to monitor system health, to analyze and resolve issues, which may result in much longer maintenance windows. 

Action / Repair: 
To check the current status of OSWatcher, run the command: 

# ps -elf | grep OSWatcher  | grep -v grep 
 
To start, stop or reset the OSWatcher utility, please reference the latest OSWatcher User's Guide (Doc ID 1531223.1) : 
 

1. Note: 1531223.1 - OS Watcher User's Guide
2. Note: 301137.1 - OS Watcher User Guide

 
Benefit / Impact:

/tmp directory contains mostly files that are required temporarily. Many  programs use this to create files and then to use them while running. It is  also used for temporary storage of data. Enough space for /tmp directory  avoids the risks of running failure of certain programs. 

Risk:

The /tmp directory must be made available for programs that require temporary  files. A low free space of /tmp directory may result in program failure, or even system crash. 

Action / Repair:

To get just the free space available of /tmp directory, run command: 

 # df -Ph /tmp | tail -1 | awk '{print $4}' 

and compare it with the recommendation of minimum 1GB
 

1. Disk Space Requirements

 
Benefit / Impact:

The soft nproc shell limit for the Oracle DB software install owner as defined in /etc/security/limits.conf should be >= 2047.

Risk:

The soft nproc shell limit for the Oracle DB software install owner as defined in /etc/security/limits.conf should be >= 2047.  As long as the soft nproc limit is 2047 or above then the configuration should be OK.



Action / Repair:

Change DB software install owner soft nproc shell limit

$ ulimit -Su
2047


 

1. Note: 788480.1 - Resource Limits Using /etc/security/limits.conf and /etc/profile
2. Note: 169706.1 - Oracle Database OS Installation and Configuration Requirements Quick Reference

 Please review MOS Note 169706.1 - Oracle Database on Unix AIX,HP-UX,Linux,Mac OS X,Solaris,Tru64 Unix Operating Systems Installation and Configuration Requirements Quick Reference (8.0.5 to 11.2)
 

 Please review MOS Note 169706.1 - Oracle Database on Unix AIX,HP-UX,Linux,Mac OS X,Solaris,Tru64 Unix Operating Systems Installation and Configuration Requirements Quick Reference (8.0.5 to 11.2)
 

 Please review MOS Note 169706.1 - Oracle Database on Unix AIX,HP-UX,Linux,Mac OS X,Solaris,Tru64 Unix Operating Systems Installation and Configuration Requirements Quick Reference (8.0.5 to 11.2)
 

 Please review MOS Note 169706.1 - Oracle Database on Unix AIX,HP-UX,Linux,Mac OS X,Solaris,Tru64 Unix Operating Systems Installation and Configuration Requirements Quick Reference (8.0.5 to 11.2)
 

 Please review MOS Note 169706.1 - Oracle Database on Unix AIX,HP-UX,Linux,Mac OS X,Solaris,Tru64 Unix Operating Systems Installation and Configuration Requirements Quick Reference (8.0.5 to 11.2)
 

 Please review MOS Note 169706.1 - Oracle Database on Unix AIX,HP-UX,Linux,Mac OS X,Solaris,Tru64 Unix Operating Systems Installation and Configuration Requirements Quick Reference (8.0.5 to 11.2)
 

 Please review MOS Note 169706.1 - Oracle Database on Unix AIX,HP-UX,Linux,Mac OS X,Solaris,Tru64 Unix Operating Systems Installation and Configuration Requirements Quick Reference (8.0.5 to 11.2)
 

 To view the current values of the resource control, enter the following commands:

$ id -p // to verify the project id
uid=100(oracle) gid=100(dba) projid=1 (group.dba)
$ prctl -n project.max-shm-memory -i project group.dba
$ prctl -n project.max-sem-ids -i project group.dba
If you must change any of the current values, then:

To modify the value of max-shm-memory to 6 GB:

# prctl -n project.max-shm-memory -v 6gb -r -i project group.dba 
To modify the value of max-sem-ids to 256:

# prctl -n project.max-sem-ids -v 256 -r -i project group.dba
Note:
When you use the command prctl (Resource Control) to change system parameters, you do not need to restart the system for these parameter changes to take effect. However, the changed parameters do not persist after a system restart.
Use the following procedure to modify the resource control project settings, so that they persist after a system restart:

By default, Oracle instances are run as the oracle user of the dba group. A project with the name group.dba is created to serve as the default project for the oracle user. Run the command id to verify the default project for the oracle user:

# su - oracle
$ id -p
uid=100(oracle) gid=100(dba) projid=100(group.dba)
$ exit
To set the maximum shared memory size to 2 GB, run the projmod command:

# projmod -sK "project.max-shm-memory=(privileged,2G,deny)" group.dba
Alternatively, add the resource control value project.max-shm-memory=(privileged,2147483648,deny) to the last field of the project entries for the Oracle project.

After these steps are complete, check the values for the /etc/project file using the following command:

# cat /etc/project
The output should be similar to the following:

system:0::::
user.root:1::::
noproject:2::::
default:3::::
group.staff:10::::
group.dba:100:Oracle default
project:::project.max-shmmemory=(privileged,2147483648,deny)
To verify that the resource control is active, check process ownership, and run the commands id and prctl, as in the following example:

# su - oracle
$ id -p
uid=100(oracle) gid=100(dba) projid=100(group.dba)
$ prctl -n project.max-shm-memory -i process $$
process: 5754: -bash
NAME     PRIVILEGE     VALUE     FLAG     ACTION    RECIPIENT
project.max-shm-memory
privileged         2.00GB     -             deny
 

 $ prctl -n project.max-shm-ids -i project group.oinstall
project: 100: group.oinstall
NAME    PRIVILEGE       VALUE    FLAG   ACTION                       RECIPIENT
project.max-shm-ids
        privileged      4.10K       -   deny                                 -
        system          16.8M     max   deny                                 -

 

 Recommendation - process.max-sem-nsems = 256

"$ prctl -n process.max-sem-nsems $$

process: 100186: -bash
NAME    PRIVILEGE       VALUE    FLAG   ACTION                       RECIPIENT
process.max-sem-nsems
        privileged      1.02K       -   deny                                 -
        system          32.8K     max   deny                                 -

 

 Recommendation - project.max-sem-ids = 100
 

 
Benefit / Impact:

Documented value is the /etc/security/limits.conf file as documented in 11gR2 Grid Infrastructure  Installation Guide, section 2.15.3 Setting Resource Limits for the Oracle Software Installation Users.  

If the /etc/security/limits.conf file is not configured as described in the documentation then log in to the system as the database software owner (e.g., oracle) and check the soft stack configuration as described below.

Risk:

The soft stack shell limit for the Oracle DB software install owner as defined in /etc/security/limits.conf should be >= 10240.  As long as the soft stack limit is 10240 or above then the configuration should be OK.



Action / Repair:

Change DB software install owner soft stack shell limit

$ ulimit -Ss
10240


 

 
Benefit / Impact:

DNS setup is incorrect. Check the recommended configuration to ensure DNS works to avoid potential failures when installing Fusion Middleware, for example OBIEE.

Risk:

There might be failure when installing OBIEE or other Fusion Middleware if DNS setup is incorrect

Action / Repair:

See MOS notes and referenced documents for details.
 

1. Note: 1305993.1 - OBIEE 11g: Error: "failed to start a managed process after the maximum retry limit" OPMN Fails to Start When

 
Benefit / Impact:

The following table describes the relationship between installed RAM and the configured swap space requirement: 
Swap space is used when the amount of physical memory (RAM) is full. If the system needs more memory resources and the RAM is full, inactive pages in memory are moved to the swap space. While swap space can help machines with a small amount of RAM, it should not be considered a replacement for more RAM. Swap space is located on hard drives, which have a slower access time than physical memory.

The following table describes the relationship between installed RAM and the configured swap space requirement: 

Available RAM --  Swap Space Required
============= -- ====================
Between 4 GB and 16 GB -- Equal to RAM
More than 16 GB -- 16 GB of RAM

Risk:

If the system needs more memory resources and the RAM is full, inactive pages in memory are moved to the swap space.   If the swap space is not adequate, then the application using the memory could fail.

It is recommended to  have swap enabled unless there are exceptions such as  no disks available or only network disks are present. Swap is useful when Oracle applications consume more memory than available physical RAM. The main incentive for swap is to make more efficient use of the physical RAM.

Action / Repair:

Set the swap size according to the recommendataion.

Refer to the document referenced provided below for guidelines.
 

1. Solaris Memory Requirements - 12c
2. Note: 1587357.1 - Oracle Database (RDBMS) on Unix AIX,HP-UX,Linux,Solaris and MS Windows Operating Systems Installation and Configuration

 Please ensure that the server is started with runlevel 3.
 

1. Solaris System configurations for Database Installation

 
Benefit / Impact:

Fixing bash code injection vulnerability will fix security issues.

Risk:

With this bash code injection vulnerability, system is open to security risks

Action / Repair:

Please see following link for more information about CVE-2014-6271 and to fix bash code injection vulnerability
 

1. Vulnerability Summary for CVE-2014-6271
2. Note: 1930090.1 - CVE-2014-6271 and CVE-2014-7169 Patch Availability Document for Oracle Solaris
3. Note: 1930120.1 - CVE-2014-6271 and CVE-2014-7169 Patch Availability Document for Oracle Linux
4. Oracle Security Alert for CVE-2014-7169