Post-update Tasks

After updating to Oracle Database Security Central (Oracle DBSecCentral), complete these tasks to confirm the update process, enable required functionality, and resolve any remaining issues.

See Also: Unable to Log in to the Oracle DBSecCentral Appliance through SSH

Confirm the Update Process

Use these steps to verify that the update process was successful.

Successful Updates of Audit Vault Servers

1. Verify that you can open the Oracle Database Security Central console without any issues.

2. Verify that you can log in to the Oracle Database Security Central console as an administrator and an auditor without any issues.

3. Verify that you can connect to the Audit Vault Server through SSH without any issues.

4. Log in to the Oracle Database Security Central console as an administrator and check the following items:

   1. Select Settings, then select System in the left navigation menu.

   2. Verify that the Audit Vault Server Version field displays the correct version of Audit Vault Server.

   3. Check the Uptime value.

   4. Ensure that Database Firewall log collection displays a green arrow pointing up.

   5. Ensure that Background Job displays a green arrow pointing up.

   6. Check the High Availability Status value.

Successful Updates of Audit Vault Agents

1. Log in to the Oracle Database Security Central console as an administrator.

2. Select Agents.

3. Verify that all Audit Vault agents have a status of RUNNING.

4. Verify that the Agent Details column displays the correct version for each Audit Vault Agent.

Successful Updates of Database Firewalls

1. Log in to the Oracle Database Security Central console as an administrator.

2. Select Database Firewalls.

3. Verify that all Database Firewalls have a status of Up.

4. Verify that the Version column displays the correct version for each Database Firewall.

5. Select the a specific Database Firewall in the Name column.

6. Verify that the Firewall Version field also displays the correct version.

7. In the Diagnostics section, select Health Indicators and verify that all the health indicators must have a green mark.

8. Close the dialog box.

9. Select Database Firewall Monitoring in the left navigation menu.

10. Verify that tall the monitoring points have a status of Up.

Unsuccessful Updates

The following symptoms indicate that an update has failed:

• You’re unable to open the Oracle Database Security Central console.

• An SSH connection to the Audit Vault Server (or the terminal) displays an error that the update has failed.

Note: Also review the system diagnostics for the current status and system log for any errors.

Enable Administrator Access to Existing Archive Locations

After updating to Oracle Database Security Central, the following new behavior applies to archive locations:

• New archive locations are owned by the user with an administrator role who created them.

• Users with the super administrator role can view all archive locations.

• Only users with the super administrator role can access existing archive locations.

To give regular users with the administrator role access to existing archive locations, perform the following steps for each archive location:

1. Log in to the Audit Vault Server through SSH and switch to the root user.

   See Logging In to Oracle DBSecCentral Appliances Through SSH.

2. Unlock the avsys user.

   See Unlocking the AVSYS User.

   Note: Remember to relock the avsys account when you’ve completed this task.

3. Exit back to root.

4. Connect as oracle.

5. Start SQL*Plus as the avsys user.

   sqlplus avsys

6. Enter the password at the prompt.

7. Run the following commands:

   update avsys.archive_host set created_by=<adminuser> where name=<archive location name>;
   commit;
   exit;

8. Exit back to root.

   exit

9. Lock the avsys user.

   See Locking the AVSYS User.

Enable Archiving Functionality for High Availability

If the Audit Vault Server is deployed in a high availability environment, you might need to enable archiving after the update.

If you have Network File System (NFS) locations and archived data files, ensure that all the data files are available in the respective NFS locations. After completing the upgrade process, archiving is disabled, so you need to enable it.

• Oracle Database Security Central supports archive and retrieve functionality with NFS server versions v3 and v4.

• If your NFS server supports and permits both v3 and v4 for archive or retrieve, then no action is required.

• If you have NFS v4 only in your environment for archive or retrieve, then set the _SHOWMOUNT_DISABLED parameter to TRUE using the following steps:

  1. Log in to the Audit Vault Server through SSH and switch to the root user.

     See Logging In to Oracle DBSecCentral Appliances Through SSH.

  2. Switch to the oracle user.

     su - oracle

  3. Start SQL*Plus without the user name or password.

     sqlplus /nolog

  4. In SQL*Plus, run the following command:

     connect <super administrator>

  5. Enter the password when prompted.

  6. Run the following command:

     exec avsys.adm.add_config_param('_SHOWMOUNT_DISABLED','TRUE');

1. Log in to the primary Audit Vault Server through SSH and switch to the root user.

   See Logging In to Oracle DBSecCentral Appliances Through SSH.

2. Switch to the oracle user.

   su - oracle

3. Create new NFS locations by using the Oracle Database Security Central console.

   These new locations consider the newly mounted NFS points for both the primary and secondary Audit Vault Servers. Ensure that there is sufficient space in the newly created NFS locations to store all the necessary data files to be archived.

4. Start SQL*Plus without the user name or password.

   sqlplus /nolog

5. In SQL*Plus run the following command:

   connect super administrator

6. Enter the password when prompted.

7. Enable the archiving functionality by running the following command:

   exec management.ar.run_hailm_job('<NFS location name defined>');

   This command initiates a background job. You can view the status on the Jobs page. The name of the job is HAILM POST UPGRADE JOB.

   After you enable this functionality , all the archived data files are moved to the new NFS location and archiving is enabled after the job completes successfully.

Configure Audit Vault Server Backups

The Audit Vault Server backup configuration file is release-specific and works on the same release for which it was created. Oracle recommends that you run the avbackup config command to create a new configuration file before performing the backup operation after updating Oracle Database Security Central.

Schedule Maintenance Jobs

Oracle Database Security Central (Oracle DBSecCentral) runs some jobs on the Audit Vault Server for proper and effective functioning of the system.

Oracle recommends that you run these jobs during a period when the Audit Vault Server usage is low, such as at night. You can schedule these jobs based on your time zone.

1. Log in to the Oracle DBSecCentral console as an administrator.

2. Select Settings.

3. Select System in the left navigation menu.

4. In the Configuration section, select Maintenance:

5. To schedule a new maintenance job, enter the start time in hours and minutes.

   The time that you specify here is the time on the browser.

6. In the Time Out (In hours) field, enter the duration of the maintenance job in hours.

   If the job doesn’t complete in the specified duration, it times out.

   Note: The job runs at the specified start time daily. You can’t change the repeat frequency.

7. Select Save.

Preserve File Customizations

Preserve customizations that have been applied to configuration files after upgrading to Oracle Database Security Central (Oracle DBSecCentral).

The upgrade does not transfer any custom changes that have been made to system configuration files from the source to destination servers. Oracle recommends that you back up any required changes that you need to transfer to the upgraded system.

To preserve file customizations:

• Create your own custom configuration file. See the Oracle Linux documentation for details.

• Move any rules to a custom configuration file before performing the upgrade process.

• Synchronize the time between the Database Firewalls and Audit Vault Servers.

  If the system clocks for the Database Firewalls and Audit Vault Servers are not synchronized, then you may see a certificate error after the upgrade. After the upgrade, check the appliance diagnostics output to ensure that everything is marked OK in green. The diagnostic failures are marked FAILED in red.

  • To configure the time for Audit Vault Servers, see Specifying the Server Date, Time, and Keyboard Settings.

• To configure the time for Database Firewalls, see Setting the Date and Time in Oracle Database Firewall.

If the Host Monitoring Agent Fails to Update, Open Port 7447 on the Audit Vault Server

1. If the host monitoring agent fails to update, open port 7447 on the Audit Vault Server to allow the Audit Vault Agent to connect. See Ports for Services Provided by Audit Vault Server in the Oracle Database Security Central Administrator’s Guide.

2. Log in to the Audit Vault Server through SSH and switch to the root user.

   See Logging In to Oracle DBSecCentral Appliances Through SSH.

3. Run the following on the AVS:

   /usr/local/dbfw/bin/priv/send_agent_update_signal.sh

Retrieving Audit Policies After the Upgrade

After upgrading to Oracle DBSecCentral, audit policies are retrieved automatically by a scheduled post-upgrade process. If the automatic retrieval does not complete successfully, re-grant the required privileges and manually retrieve the audit policies before viewing or managing audit policies.

Retrieving the Security Assessment and Resetting the Baseline to a DBSAT 4.2 Assessment

After upgrading to Oracle DBSecCentral, as a post-upgrade maintenance task, rerun the privilege script, retrieve a new security assessment, and reset the baseline to one generated by DBSAT 4.2. This process ensures that the security posture of the environment is aligned with the latest assessment data, enabling more accurate monitoring and auditing of potential vulnerabilities.

See Confirm the Update Process for more information.

Running Sensitive Data Discovery post upgrade

After upgrading to Oracle DBSecCentral, as a post-upgrade maintenance task, rerun the privilege script, and run the Sensitive data discovery job on all targets. This helps maintain the latest inventory of sensitive data across the environment and improves the accuracy of auditing and security assessments to mitigate vulnerabilities.

Configure Mutual Authentication on the Host Monitor Agent

After upgrading to Oracle DBSecCentral, reconfigure the certificates that are already installed on Host Monitor Agents to ensure that there is mutual authentication between the Database Firewall and Host Monitor Agent. For instructions on configuring mutual authentication certificates, follow the steps in Using Mutual Authentication for Communication Between the Database Firewall and the Host Monitor Agent.