Set Up the Destination Oracle Database Security Central Audit Vault Server for Upgrade

This step is expected to take about three minutes.

  1. Log in to the destination Audit Vault Server through SSH and switch to the root user.

  2. Run the destination setup command:

    /usr/local/dbfw/migrate_20x/avsMigrateDestination --setup

    Running --setup overwrites existing destination configurations. When prompted, enter

    • the IP address of the source Audit Vault Server

    • yes or y to continue connecting to the source Audit Vault Server

    • the password for the support user on the source Audit Vault Server

    • Enter the password for the database link that you created when setting up the source Audit Vault Server in Set Up the Source (20.x) Audit Vault Server for Upgrade. The data that is sent over this database link is encrypted using Network Native Encryption (NNE).

    • Enter the TCP port of the source database listener. The default port is 1521.

    Note: The Audit Vault Server PDB on the destination server is dropped during setup. As a result only the high availability configuration and the remote secure copy locations used for remote archiving in data retention are retained. All other existing configurations are removed.

  3. Switch to the oracle user.

    su - oracle

  4. Load the password for the autograde tool

    1. Clear any existing pluggable database session variables by running the following command:

      unset ORACLE_PDB_SID

    2. Run the autoupgrade.jar file with the -load_password option by running the following command:

      $ORACLE_HOME/jdk/bin/java -jar /var/lib/oracle/dbfw/rdbms/admin/autoupgrade.jar -config /usr/local/dbfw/migrate_20x/avs20x.cfg -load_password

    3. When prompted, create and confirm a password for the keystore.

      Note: Copy and save this password for later use.

      If successful, you should see AutoUpgrade keystore was successfully created.

    4. When prompted with TDE>, list the password status.

    5. For each database in your list, add a TDE password by running the add *`<ORACLE_SID>`* command.

      Enter and confirm the password when prompted.

    6. Run the list command again to ensure the avdfCDB TDE Password column shows Verified else the remaining steps may fail.

      Steps d-f will look something like the following:

      TDE> list

+----------+-------------------------+-----------------------+-----------+------------------+
\|ORACLE_SID\|    Action Required      \|    TDE Password      \|SEPS Status\|Active Wallet Type\|

+----------+-------------------------+-----------------------+-----------+------------------+
\| avdfCDB  \| Configure TDE Password  \| Not Set              \| Inactive  \| None             \|
\| dbfwdb   \| Configure TDE Password  \| Not Set              \| Inactive  \| None             \|

+----------+-------------------------+-----------------------+-----------+------------------+

# Add avdfCDB to the managed databases list
TDE> add avdfCDB
Enter password for avdfCDB TDE wallet: ********
Confirm password: ********

# Add dbfwdb to the managed databases list
TDE> add dbfwdb
Enter password for dbfwdb TDE wallet: ********
Confirm password: ********

# Check the status after adding and setting up passwords
TDE> list

+----------+-------------------+-------------------------+-----------+------------------+
\|ORACLE_SID\|  Action Required  \|    TDE Password         \|SEPS Status\|Active Wallet Type\|

+----------+-------------------+-------------------------+-----------+------------------+
\| avdfCDB  \|                   \| Verified                \| Inactive  \| Any              \|
\| dbfwdb   \|                   \| Keystore file not found \| Inactive  \| Open             \|

+----------+-------------------+-------------------------+-----------+------------------+

    7. Save the TDE passwords by running the save command.

    8. Enter YES when prompted to convert the AutoUpgrade keystore to auto-login.

    9. Exit the TDE password configuration by running the exit command.

Note: The destination Audit Vault Server will only be available through SSH until the upgrade is complete.

Related Topics