The Oracle Trace File Analyzer daemons in a cluster communicate securely using the SSL/TLS protocols.

1. To view the available and restricted protocols:

   tfactl print protocols

   For example:

   $ tfactl print protocols
   .---------------------------------------.
   |                 node1                 |
   +---------------------------------------+
   | Protocols                             |
   +---------------------------------------+
   | Available : [TLSv1, TLSv1.2, TLSv1.1] |
   | Restricted : [SSLv3, SSLv2Hello]      |
   '---------------------------------------'
   

2. To restrict the use of certain protocols:

   tfactl restrictprotocol [-force] protocol

   For example:

   $ tfactl restrictprotocol TLSv1

Use Java keytool to replace self-signed SSL certificates with personal self-signed certificates.

1. Create a private key and keystore file containing the self-signed certificate for the server:

   $ keytool -genkey -alias server_full -keyalg RSA -keysize 2048 -validity 18263 -keystore myserver.jks

2. Create a private key and keystore file containing the private key and self signed-certificate for the client:

   $ keytool -genkey -alias client_full -keyalg RSA -keysize 2048 -validity 18263 -keystore myclient.jks

3. Export the server public key certificate from the server keystore:

   $ keytool -export -alias server_full -file myserver_pub.crt -keystore myserver.jks -storepass password

4. Export the client public key certificate from the server keystore:

   $ keytool -export -alias client_full -file myclient_pub.crt -keystore myclient.jks -storepass password

5. Import the server public key certificate into the client keystore:

   $ keytool -import -alias server_pub -file myserver_pub.crt -keystore myclient.jks -storepass password

6. Import the client public key certificate into the server keystore:

   $ keytool -import -alias client_pub -file myclient_pub.crt  -keystore myserver.jks -storepass password

7. Restrict the permissions on the keystores to root  read-only.

   $ chmod 400 myclient.jks myserver.jks

8. Copy the keystores (jks files) to each node.
9. Configure Oracle Trace File Analyzer to use the new certificates:

   $ tfactl set sslconfig

10. Restart the Oracle Trace File Analyzer process to start using new certificates:

    $ tfactl stop 
    $ tfactl start

Use Java keytool and openssl to replace self-signed SSL certificates with the Certificate Authority (CA) signed certificates.

1. Create a private key for the server request:

   $ openssl genrsa -aes256 -out myserver.key 2048

2. Create a private key for the client request:

   $ openssl genrsa -aes256 -out myclient.key 2048

3. Create a Certificate Signing Request (CSR) for the server:

   $ openssl req -key myserver.key -new -sha256 -out myserver.csr

4. Create a Certificate Signing Request (CSR) for the client:

   $ openssl req -key myclient.key -new -sha256 -out myclient.csr

5. Send the resulting CSR for the client and the server to the relevant signing authority.

   The signing authority sends back the signed certificates:

   • myserver.cert

   • myclient.cert

   • CA root certificate

6. Convert the certificates to JKS format for the server and the client:

   $ openssl pkcs12 -export -out serverCert.pkcs12 -in myserver.cert -inkey myserver.key

   $ keytool -v -importkeystore -srckeystore serverCert.pkcs12 -srcstoretype PKCS12 -destkeystore myserver.jks -deststoretype JKS

   $ openssl pkcs12 -export -out clientCert.pkcs12 -in myclient.cert -inkey myclient.key

   $ keytool -v -importkeystore -srckeystore clientCert.pkcs12 -srcstoretype PKCS12 -destkeystore myclient.jks -deststoretype JKS

7. Import the server public key into to the client jks file:

   $ keytool -import -v -alias server-ca -file myserver.cert -keystore myclient.jks

8. Import the client public key to the server jks file:

   $ keytool -import -v -alias client-ca -file myclient.cert -keystore myserver.jks

9. Import the CA root certificate from the signing authority into the Oracle Trace File Analyzer server certificate:

   $ keytool -importcert -trustcacerts -alias inter -file caroot.cert -keystore myserver.jks

10. Restrict the permissions on the keystores to root  read-only:

    $ chmod 400 myclient.jks myserver.jks

11. Copy the keystores (jks files) to each node.
12. Configure Oracle Trace File Analyzer to use the new certificates:

    $ tfactl set sslconfig

13. Restart the Oracle Trace File Analyzer process to start using the new certificates.

    $ tfactl stop 
    $ tfactl start

Add directories to the Oracle Trace File Analyzer configuration to include the directories in diagnostic collections.

1. To view the current directories configured in Oracle Trace File Analyzer

   tfactl print directories [ -node all | local | n1,n2,... ] 
   [ -comp component_name1,component_name2,.. ] 
   [ -policy  exclusions | noexclusions ] 
   [ -permission public | private ]

2. To add directories:

   tfactl directory add dir 
   [ -public ] 
   [ -exclusions | -noexclusions | -collectall ] 
   [ -node all | n1,n2,... ]

3. To remove a directory from being collected:

   tfactl directory remove dir [ -node all | n1,n2,... ]

Use the Oracle Trace File Analyzer configuration options trimfiles, maxcorefilesize, maxcorecollectionsize, and diagcollect -nocores to reduce the size of collections.

1. To trim files during diagnostic collection:

   tfactl set trimfiles=ON|OFF

   • When set to ON (default), Oracle Trace File Analyzer trims files to include data around the time of the event

   • When set to OFF, any file that was written to at the time of the event is collected in its entirety

2. To set the maximum size of core file to n MB (default 20 MB):

   tfactl set maxcorefilesize=n

   Oracle Trace File Analyzer skips core files that are greater than maxcorefilesize.

3. To set the maximum collection size of core files to n MB (default 200 MB):

   tfactl set maxcorecollectionsize=n

   Oracle Trace File Analyzer skips collecting core files after maxcorecollectionsize is reached.

4. To prevent the collection of core files with diagnostic collections:

   tfactl diagcollect -nocores

1. To change the minimum age to purge:

   set minagetopurge=number of hours

   For example:

   $ tfactl set minagetopurge=48

   Purging the repository automatically is enabled by default.

2. To disable or enable automatic purging:

   set autopurge=ON|OFF

   For example:

   $ tfactl set autopurge=ON

3. To change the location of the repository:

   set repositorydir=dir

   For example:

   $ tfactl set repositorydir=/opt/mypath

4. To change the size of the repository:

   set reposizeMB

   For example:

   $ tfactl set reposizeMB=20480

1. To view the status of the Oracle Trace File Analyzer repository:

   tfactl print repository

2. To view statistics about collections:

   tfactl print collections

3. To manually purge collections that are older than a specific time:

   tfactl purge -older number[h|d] [-force]