AHF Release 26.5

• Enhanced SSH Host Key Validation for Exachk with AHF 26.5
  With AHF 26.5, Exachk performs stricter SSH host key validation when connecting to Exadata storage cells and switches. If a target host is missing from the known_hosts file or has a stale host key entry, Exachk rejects the SSH connection and skips data collection from that host.
• Automatic TFA Self-Diagnostics on diagcollect Failure
  Starting in AHF 26.5, Oracle Trace File Analyzer (TFA) automatically runs tfactl diagnosetfa whenever a tfactl diagcollect operation fails.
• Cluster-Wide Flood Control for Diagnostic Collection
  Starting in AHF 26.5, Oracle Trace File Analyzer (TFA) reduces duplicate diagnostic collections in clustered environments.
• New Oracle Orachk and Oracle Exachk Best Practice Checks
  Release 26.5 includes the following new Oracle Orachk and Oracle Exachk best practice checks.

Enhanced SSH Host Key Validation for Exachk with AHF 26.5

With AHF 26.5, Exachk performs stricter SSH host key validation when connecting to Exadata storage cells and switches. If a target host is missing from the known_hosts file or has a stale host key entry, Exachk rejects the SSH connection and skips data collection from that host.

As a result, Exachk reports might contain incomplete or missing information for affected storage cells and switches.

Note:

AHF 26.8 does not perform the stricter SSH host key validation introduced in AHF 26.5. Instead, when connecting to a host, AHF 26.8 adds the host's SSH key fingerprint to the known_hosts file, allowing subsequent SSH connections to recognize the host.

Corrective Actions

Before running Exachk with AHF 26.5:

• Verify that every Exadata storage cell and switch has a valid SSH host key entry in the user's known_hosts file.
• Remove stale or outdated host key entries by running:

  ssh-keygen -R <hostname>
  ssh-keygen -R <ip_address>

• Re-establish trust by connecting to the host or by using the appropriate SSH host key distribution process.
• Ensure that all database nodes have consistent and current known_hosts entries.
• After updating the known_hosts file, run Exachk again.

Unsupported Legacy SSH Key Algorithms

Exachk does not support legacy SSH key algorithms such as DSA (ssh-dss). If SSH key-based authentication is configured to use an unsupported legacy algorithm, reconfigure it to use a supported algorithm, such as Ed25519 or RSA with SHA-2.

When Exachk detects an unsupported legacy SSH key algorithm, it reports an error similar to the following in the logs:

Unable to handle key of type ssh-dss

Automatic TFA Self-Diagnostics on diagcollect Failure

Starting in AHF 26.5, Oracle Trace File Analyzer (TFA) automatically runs tfactl diagnosetfa whenever a tfactl diagcollect operation fails.

This enhancement helps accelerate root-cause analysis and improves support efficiency by proactively collecting relevant diagnostic data without requiring manual intervention.

For more information, see: Automatic TFA Self-Diagnostics on diagcollect Failure for Faster Issue Resolution.

Cluster-Wide Flood Control for Diagnostic Collection

Starting in AHF 26.5, Oracle Trace File Analyzer (TFA) reduces duplicate diagnostic collections in clustered environments.

During event storms or repeated alerts, TFA minimizes redundant diagnostic bundles across peer nodes, reducing diagnostic overhead and improving event handling. By eliminating unnecessary duplicate collections, this enhancement also helps conserve AHF repository storage and simplifies repository management and review.

New Oracle Orachk and Oracle Exachk Best Practice Checks

Release 26.5 includes the following new Oracle Orachk and Oracle Exachk best practice checks.

Oracle Exachk Specific Best Practice Checks

• Verify Exadata Cryptographic Policy is Enabled
• Verify Exadata Cryptographic Policy is Enabled [Storage Server]
• Exadata Critical Issue DB56
• Exadata Critical Issue DB57

All checks can be explored in more detail via the Health Check Catalogs.