Go to main content

Oracle® Advanced Support Gateway Security Guide

Exit Print View

Updated: April 2024
 
 

KVM Compute Nodes

  • Install or upgrade the Oracle Autonomous Health Framework (AHF) to a minimum version of 23.10.

    The storage requirement for AHF is 2GB of space in /opt and a minimum of 6GB (with a recommendation of 10GB) on /EXAVMIMAGES.

  • Configure Oracle Autonomous Health Framework (AHF) to auto-update from the Gateway when a new version is available.

  • Configure Oracle Autonomous Health Framework (AHF) to communicate to all KVM Nodes via socket for data collection.

The Oracle Linux 7 Server used within an Engineered System that is running the virtualized stack has strict policies that do not permit the installation of agents on the systems. These nodes will have the ILOMs configured to send traps to the Gateway for ASR. A user (orarom) will be created on the KVM Server and granted the following privileges in the sudoers file:

<user> ALL= NOPASSWD: /usr/bin/virsh list*, /usr/bin/virsh dominfo*, /usr/bin/virsh nodememstats*, /usr/bin/virsh domstats*, /usr/bin/virsh capabilities, /usr/bin/virsh domblklist*, /usr/bin/virsh domiflist*, /usr/bin/virsh domifstat*, /usr/bin/virsh vcpupin*, /bin/virsh cpu-stats*, /bin/virsh domblkstat*, /bin/virsh dommemstat*, /bin/virsh nodeinfo, /sbin/dmsetup info, /sbin/service --status-all, /usr/sbin/dmidecode, /sbin/ethtool, /usr/bin/ipmitool, /usr/sbin/imageinfo, /usr/local/bin/imageinfo, /opt/oracle/bda/bin/imageinfo, /opt/exadata_ovm/vm_maker, /usr/sbin/brctl, /sbin/fdisk -l*, /bin/virsh domblkinfo*, /usr/bin/lvs*, /usr/bin/smartctl*, /usr/sbin/ibnetdiscover, /usr/sbin/sminfo, /sbin/dmsetup info*, /bin/cat /etc/iscsi/iscsid.conf, /usr/bin/systemctl stop oracle-oasgagent.service, /usr/bin/systemctl start oracle-oasgagent.service, /usr/bin/systemctl restart oracle-oasgagent.service, /usr/bin/systemctl status oracle-oasgagent.service, /sbin/service oasgagent start, /sbin/service oasgagent stop, /sbin/service oasgagent restart, /sbin/service oasgagent status

This list of commands is used by the Oracle Enterprise Manager (OEM) targets to read information about the system, relay the information to OEM, and manage the oasg_agent.


Note -  The profile may be updated if the option for Oracle to retain sudo privilege is granted.