Update a Pair of Database Firewalls That Are Configured for High Availability

Use this procedure to update a pair of Database Firewalls in a high availability environment.

Follow this process:

Update the standby Database Firewall.
After the standby Database Firewall has fully restarted, swap the standby Database Firewall so that it becomes the primary Database Firewall.
Update the original primary (now standby) Database Firewall.
(Optional) After the original primary Database Firewall has fully restarted, swap the Database Firewalls so they return to their original primary and standby roles.

Update the Standby Database Firewall

Use this procedure to update the standby Database Firewall in a high availability environment. Update the standby Database Firewall first, then swap this Database Firewall so that it becomes the primary Database Firewall. Then update the original primary (now standby) Database Firewall.

Follow this process:

Stop all Database Firewall monitoring points.
Run the pre-upgrade RPM.
Transfer the ISO file to the appliance.
Start the update script.
Restart the appliance.

Note: When the appliance restarts, the update process continues. This takes several minutes to complete on Database Firewalls. Don’t restart the system while this is in progress.

Stop All Database Firewall Monitoring Points

Stop all monitoring points before updating the Database Firewall.

Log in to Oracle Database Security Central Console as an administrator.
Select Database Firewalls.
Select Database Firewall Monitoring in the left navigation menu.
Select all monitoring points.
Select Stop.

Run the Pre-upgrade RPM

Run the pre-upgrade RPM to check for the required space in the file system and prepare the system for updating.

The pre-upgrade RPM performs the following tasks to prepare the system for updating:

Rearranges free space on the appliance so that there’s enough room to copy the patch files to the appliance and start the installation. After the update, the space for the patch files is returned to the file system.
Verifies that other prerequisites and platform conditions are met before the update.
Prepares the system for updating by creating the /var/dbfw/upgrade directory with enough space to hold the main ISO file for the update.

To run the pre-upgrade RPM, follow these steps:

Log in to the appliance through SSH and switch to the root user.
Run the tmux command as the root user.

The tmux command prevents network disconnections from interrupting the update. If the session terminates, resume by switching to the root user and then running the tmux -r command.
Change to the root directory.
```
cd /root
```
Run the following command to copy the pre-upgrade RPM file from the downloaded location to the appliance:
```
scp remote_host:/path/to/dbsec-central-dbfw-pre-upgrade-2.26.0.0.0.zip /root
```
Verify the download by using a shasum of the dbsec-central-dbfw-pre-upgrade-2.26.0.0.0.zip file.
```
sha256sum /root/dbsec-central-dbfw-pre-upgrade-2.26.0.0.0.zip
```

Unzip the bundle.

unzip /root/dbsec-central-dbfw-pre-upgrade-2.26.0.0.0.zip

Run the following command to install the dbsec-central-dbfw-pre-upgrade-2.26.0.0.0-0_NNNNNN.NNNN.x86_64.rpm file:

rpm -i /root/dbsec-central-dbfw-pre-upgrade-2.26.0.0.0.zip-0_NNNNNN.NNNN.x86_64.rpm

The following message appears:

SUCCESS: The upgrade media can now be copied to '/var/dbfw/upgrade'.
The upgrade can then be started by running: /usr/bin/dbsec-central-dbfw-upgrade

If you receive any errors instead of a SUCCESS message, resolve them before proceeding.

Related Topics

Transfer the ISO File to the Appliance

Transfer the dbsec-central-dbfw-upgrade-2.26.0.0.0.iso file to the appliance that you’re updating.

Log in to the appliance through SSH and switch to the root user.
Copy the dbsec-central-dbfw-upgrade-2.26.0.0.0.iso file by using the following command:
```
scp remote_host:/path/to/dbsec-central-dbfw-upgrade-2.26.0.0.0.iso /var/dbfw/upgrade
```

Start the Update Script

The update script mounts the ISO, changes to the correct working directory, runs the update process, and unmounts the ISO after the upgrade process is complete.

Note: The system may take some time to complete the commands. Don’t interrupt the update or the system may be left in an inconsistent state. For this reason, it is important to use a reliable and uninterruptible shell, such as a direct console login (or ILOM equivalent), or use the tmux command to prevent network disconnections from interrupting the update.

Log in to the appliance through SSH and switch to the root user.
Run the tmux command as the root user.

The tmux command prevents network disconnections from interrupting the update. If the session terminates, resume by switching to the root user and then running the tmux -r command.
Run the following command to perform the appropriate checks before updating:
```
/usr/bin/dbsec-central-dbfw-upgrade
```

Follow the system prompt, warning, and instruction to proceed with the update accordingly.

You should see output like the following:

Please wait while validating SHA256 checksum for /var/dbfw/upgrade/dbsec-central-dbfw-upgrade-2.26.0.0.0.iso
Checksum validation successful for /var/dbfw/upgrade/dbsec-central-dbfw-upgrade-2.26.0.0.0.iso
Mounting /var/dbfw/upgrade/dbsec-central-dbfw-upgrade-2.26.0.0.0.iso on /images
mount: /dev/loop0 is write-protected, mounting read-only
Successfully mounted /var/dbfw/upgrade/dbsec-central-dbfw-upgrade-2.26.0.0.0.iso on /images

The following messages have important information about the upgrade process.

Power loss during upgrade may cause data loss. Do not power off during upgrade. Please review Note ID 2235931.1 for a current list of known issues.

The upgrade process is irreversible, please confirm 'y' to continue or 'n' to abort. [y/N]?

Enter y to proceed.

You should see output like the following:

The Oracle base has been set to /var/lib/oracle
Error: ORA-01034: ORACLE not available
ORA-27101: shared memory realm does not exist
Linux-x86_64 Error: 2: No such file or directory
Additional information: 4475
Additional information: 1990413931
The Oracle base has been set to /var/lib/oracle
Error: ORA-01034: ORACLE not available
ORA-27101: shared memory realm does not exist
Linux-x86_64 Error: 2: No such file or directory
Additional information: 4475
Additional information: 1990413931
Verifying upgrade preconditions
1/11: Mounting filesystems (1)
2/11: Cleaning yum configuration
3/11: Cleaning old packages and files
4/11: Upgrading kernel
5/11: Upgrading system
6/11: Cleaning platform packages repo
7/11: Adding required platform packages
8/11: Cleaning DBSecCentral packages repo
9/11: Installing DBSecCentral packages
10/11: Setting boot title
11/11: Setting final system status
Reboot now to continue the upgrade process.
Unmounted /var/dbfw/upgrade/dbsec-central-dbfw-upgrade-2.26.0.0.0.iso on /images

Note: The preceding output varies depending on the base installation level, appliance type, and configuration.

Restart the Appliance

After updating, restart the appliance and continue the update process.

Log in to the appliance through SSH and switch to the root user.
Restart the appliance. For example:
```
reboot
```
Note: When the appliance restarts, the update process continues. This takes several minutes to complete on Database Firewalls. Don’t restart the system while this is in progress.
If you’ve updated a Database Firewall, it may have regenerated the appliance certificate. In this scenario, you need to update the certificate. To check this:
1. Log in to the Oracle Database Security Central console as an administrator.
2. Select Database Firewalls.
  
  In the left navigation menu, Database Firewalls is selected by default and the page displays a list of configured Database Firewall instances.
3. Select the Database Firewall instance that indicates a certificate error after the update.
4. Select Update Certificate.
See Also: Registering a Database Firewall in the Audit Vault Server

Swap the Standby and Primary Database Firewalls

After updating the standby Database Firewall, swap the standby Database Firewall so that it becomes the primary Database Firewall. You can also swap the Database Firewalls back to their original roles after updating them both.

Log into the Oracle Database Security Central console as an administrator.
Select Database Firewalls.
Select High Availability in the left navigation menu.
Select this resilient pair of Database Firewall instances.
Select Swap.

Update the Original Primary (Now Standby) Database Firewall

To update the original primary (now standby) Database Firewall in a high availability environment, follow the same process that you used to update the original standby Database Firewall.