1. Oracle Autonomous Health Framework User's Guide
  2. Running Compliance Checks Automatically

Running Compliance Checks Automatically

Oracle recommends that you use the daemon process to schedule recurring compliance checks at regular intervals.

Note:

Daemon mode is supported only on the Linux and Solaris operating systems.

Configure the daemon to:

  • Schedule recurring compliance checks at regular interval
  • Send email notifications when the compliance check runs complete, clearly showing any differences since the last run
  • Purge collection results after a pre-determined period
  • Check and send email notification about stale passwords
  • Store multiple profiles for automated compliance check runs
  • Restart automatically if the server or node where it is running restarts

Note:

While running, the daemon answers all the prompts required by subsequent on-demand compliance checks.

To run on-demand compliance checks, do not use the daemon process started by others. Run on-demand compliance checks within the same directory where you have started the daemon.

If you change the system configuration such as adding or removing servers or nodes, then restart the daemon.

Setting and Getting Options for the Daemon

Configure Oracle Orachk or Oracle Exachk daemon options before starting the daemon. You can also change the options after the daemon has started.

Use the -set option to configure daemon properties.

To set a single option:

orachk -set "<option_1>=<option_1_value>"

For Oracle Exachk:

exachk -set "<option_1>=<option_1_value>"

To set multiple options, specify each option in name=value format and separate the options with semicolons.

For Oracle Orachk:

orachk -set "<option_1>=<option_1_value>;<option_2>=<option_2_value>;<option_n>=<option_n_value>"

For Oracle Exachk:

exachk -set "<option_1>=<option_1_value>;<option_2>=<option_2_value>;<option_n>=<option_n_value>"

For example:

orachk -set "AUTORUN_SCHEDULE=3 * * 0;NOTIFICATION_EMAIL=some.body@example.com"

Use the corresponding -get option to view the configured daemon properties.

AUTORUN_SCHEDULE

Use the AUTORUN_SCHEDULE daemon option to schedule recurring Oracle Orachk or Oracle Exachk compliance check runs.

Specify the schedule as follows:

AUTORUN_SCHEDULE=<minute> <hour> <day> <month> <day_of_week>

The schedule fields support the following values and special characters:

FieldValid ValuesSpecial Characters
minute0–59* , - /
hour0–23* , - /
day1–31* , -
month1–12 or JAN–DEC* , -
day_of_week0–6 or SUN–SAT* , -

The minute field is optional. If you omit it, the value defaults to 0.

Use the special characters as follows:

  • Asterisk (*): Matches all valid values for a field.
  • Comma (,): Separates multiple values. For example, MON,WED,FRI in the day_of_week field schedules runs on Monday, Wednesday, and Friday.
  • Dash (-): Specifies a range of values.
  • Slash (/): Specifies step values within a range. For example, */5 in the minute field schedules a run every five minutes.

Note:

Step values provide accurate frequencies only when the step evenly divides the range of the field.

For minutes, applicable step values include /2, /3, /4, /5, /6, /10, /12, /15, /20, and /30.

For hours, applicable step values include /2, /3, /4, /6, /8, and /12.

AUTORUN_SCHEDULE Examples

ExampleResult
"AUTORUN_SCHEDULE=0,15,30,45 * * * *"Runs every 15 minutes.
"AUTORUN_SCHEDULE=* * * *"Runs every hour.
"AUTORUN_SCHEDULE=3 * * 0"Runs at 3 AM every Sunday.
"AUTORUN_SCHEDULE=2 * * 1,3,5"Runs at 2 AM every Monday, Wednesday, and Friday.
"AUTORUN_SCHEDULE=4 1 * *"Runs at 4 AM on the first day of every month.
"AUTORUN_SCHEDULE=8,20 * * 1,2,3,4,5"Runs at 8 AM and 8 PM every Monday through Friday.
"AUTORUN_SCHEDULE=*/5 2-4 * JAN 2"Runs every five minutes during the 2 AM, 3 AM, and 4 AM hours every Tuesday in January.
"AUTORUN_SCHEDULE=*/1 * * * *"Runs every minute.
"AUTORUN_SCHEDULE=*/5 0-7 * 8 *"Runs every five minutes from midnight through 7:59 AM every day in August.

Configuring AUTORUN_SCHEDULE

To schedule Oracle Orachk to run at 3 AM every Sunday:

orachk -set "AUTORUN_SCHEDULE=3 * * 0"

For Oracle Exachk:

exachk -set "AUTORUN_SCHEDULE=3 * * 0"

Optionally, use -id to configure the schedule for a specific scheduler configuration. If you do not specify an ID, DEFAULT is used.

For example:

orachk -id dba -set "AUTORUN_SCHEDULE=3 * * 0"

For Oracle Exachk:

exachk -id dba -set "AUTORUN_SCHEDULE=3 * * 0"

AUTORUN_FLAGS

Use the AUTORUN_FLAGS daemon option to specify how scheduled Oracle Orachk or Oracle Exachk compliance checks run.

Set the option as follows:

AUTORUN_FLAGS=<flags>

Where <flags> can contain any combination of valid Oracle Orachk or Oracle Exachk command-line options.

AUTORUN_FLAGS Examples

ExampleResult
"AUTORUN_FLAGS=-profile dba"Runs only the checks in the dba profile.
"AUTORUN_FLAGS=-profile sysadmin -tag sysadmin"Runs only the checks in the sysadmin profile and tags the output with sysadmin.
"AUTORUN_FLAGS=-excludeprofile ebs"Runs all applicable checks except those in the ebs profile.

Configuring AUTORUN_FLAGS

For example, to run only the sysadmin profile and tag the resulting collection with sysadmin, run:

For Oracle Orachk:

orachk -set "AUTORUN_FLAGS=-profile sysadmin -tag sysadmin"

For Oracle Exachk:

exachk -set "AUTORUN_FLAGS=-profile sysadmin -tag sysadmin"

NOTIFICATION_EMAIL

Use the NOTIFICATION_EMAIL daemon option to specify recipients for Oracle Orachk or Oracle Exachk email notifications.

The daemon sends notifications when:

  • A health check run completes.
  • The daemon encounters a problem.

Configuring Email Notifications

  1. Specify the recipients as a comma-separated list of email addresses.

    For Oracle Orachk:

    orachk -set "NOTIFICATION_EMAIL=some.person@acompany.com,another.person@acompany.com"

    For Oracle Exachk:

    exachk -set "NOTIFICATION_EMAIL=some.person@acompany.com,another.person@acompany.com"

    Optionally, use the -id option to configure notification recipients for a specific scheduler configuration. If you do not specify an ID, DEFAULT is used.

    For example, for an ID named dba:

    orachk -id dba -set "NOTIFICATION_EMAIL=some.person@acompany.com,another.person@acompany.com"

    For Oracle Exachk:

    exachk -id dba -set "NOTIFICATION_EMAIL=some.person@acompany.com,another.person@acompany.com"

  2. Test the email notification configuration using the -testemail option.

    For Oracle Orachk:

    orachk -testemail all

    For Oracle Exachk:

    exachk -testemail all

Email Notifications for Health Check Runs

After the first health check run, the daemon sends an email to the configured recipients with the report output attached.

For subsequent health check runs, the daemon sends a summary of the differences between the most recent runs to all recipients specified in the NOTIFICATION_EMAIL list.

COLLECTION_RETENTION

Use the collection_retention daemon option to automatically purge scheduled health check collections that are older than a specified number of days.

Use user_collection_retention to configure retention for health check collections generated by on-demand runs.

Configuring Collection Retention

  1. Set the appropriate retention option to the number of days that you want to retain collections.

    For scheduled collections:

    collection_retention=<number_of_days>

    For on-demand collections:

    user_collection_retention=<number_of_days>

    If you do not configure a retention option, stale collections are not automatically purged.

  2. Choose an appropriate retention period based on:

    • Frequency of health check runs.
    • Size of generated collections.
    • Available disk space.
    • Length of time that you need to retain historical results.

Configuring Retention for Scheduled Collections

For example, to retain scheduled Oracle Orachk collections for 60 days:

orachk -set "collection_retention=60"

For Oracle Exachk:

exachk -set "collection_retention=60"

Configuring Retention for On-Demand Collections

To retain on-demand Oracle Orachk collections for 60 days:

orachk -set "user_collection_retention=60"

For Oracle Exachk:

exachk -set "user_collection_retention=60"

Collections older than the configured retention period are eligible for automatic purging.

Controlling Collection Retention by Size

Use the RAT_PURGE_SIZE environment variable to control the disk space consumed by health check collections.

Specify the maximum collection size in MB. When the accumulated health check collections exceed the specified size, Oracle Orachk begins purging older eligible collections to reduce the amount of disk space consumed.

Set RAT_PURGE_SIZE as follows:

export RAT_PURGE_SIZE=<size_in_MB>

For example, to set the collection size threshold to 4096 MB:

export RAT_PURGE_SIZE=4096

Oracle Orachk uses the configured value as the size threshold when determining whether older collections should be purged.

PASSWORD_CHECK_INTERVAL

Use the PASSWORD_CHECK_INTERVAL daemon option to specify how frequently the Oracle Orachk or Oracle Exachk daemon validates the passwords that were provided when the daemon was initially started.

Specify the interval in hours.

If the daemon detects an invalid password, for example, because the password has changed, the daemon:

  • Stops running.
  • Records the failure in the daemon log.
  • Sends an email notification to the recipients configured with the NOTIFICATION_EMAIL option.

Configuring the Password Validation Interval

  1. Set PASSWORD_CHECK_INTERVAL to the required number of hours: 
    PASSWORD_CHECK_INTERVAL=<number_of_hours>

    If you do not configure PASSWORD_CHECK_INTERVAL, the daemon does not proactively validate stored passwords. If a password subsequently changes, the problem is detected when a scheduled collection attempts to use the invalid password, which can result in a failed collection.

    Configuring PASSWORD_CHECK_INTERVAL enables the daemon to detect invalid passwords earlier so that you can correct the credentials and restart the daemon before a scheduled collection fails.

  2. Select an appropriate validation interval based on:

    • Frequency of scheduled health check collections.
    • Password expiration and change policies in your environment.

For example, to validate passwords every hour, run:

For Oracle Orachk:

orachk -set "PASSWORD_CHECK_INTERVAL=1"

For Oracle Exachk:

exachk -set "PASSWORD_CHECK_INTERVAL=1"

Setting Multiple Option Profiles for the Daemon

Use a single Oracle Orachk or Oracle Exachk daemon process on each server. Do not start the daemon on multiple databases in the same cluster or run multiple daemon processes on the same database.

If the daemon detects another Oracle Orachk or Oracle Exachk daemon process running locally, it does not start another daemon process.

You can define multiple option profiles for the same daemon. Each profile can have different settings, including:

  • Compliance check profiles.
  • Schedules.
  • Notification email addresses.
  • Automatic run flags.
  • Collection retention periods.

The same daemon manages all configured option profiles.

Use the -id option before the -set option to define a daemon option profile:

For Oracle Orachk:

orachk -id <id> -set "<option>=<value>"

For Oracle Exachk:

exachk -id <id> -set "<option>=<value>"

Where <id> is the unique name that identifies the daemon option profile.

For example, you can configure separate daemon option profiles for database administrators and system administrators.

Configuring a DBA Profile

  1. Create a dba option profile with its own notification address, schedule, compliance check profile, output tag, and collection retention period.

    For Oracle Orachk:

    orachk -id dba -set "NOTIFICATION_EMAIL=dba@example.com;\
AUTORUN_SCHEDULE=4,8,12,16,20 * * *;\
AUTORUN_FLAGS=-profile dba -tag dba;\
collection_retention=30"

    Example output:

    Created notification_email for ID[dba]
Created autorun_schedule for ID[dba]
Created autorun_flags for ID[dba]
Created collection_retention for ID[dba]

    For Oracle Exachk:

    exachk -id dba -set "NOTIFICATION_EMAIL=dba@example.com;\
AUTORUN_SCHEDULE=4,8,12,16,20 * * *;\
AUTORUN_FLAGS=-profile dba -tag dba;\
collection_retention=30"

    Example output:

    Created notification_email for ID[dba]
Created autorun_schedule for ID[dba]
Created autorun_flags for ID[dba]
Created collection_retention for ID[dba]

Configuring a System Administrator Profile

  1. Create a sysadmin option profile with a different notification address, schedule, compliance check profile, output tag, and retention period.

    For Oracle Orachk:

    orachk -id sysadmin -set "NOTIFICATION_EMAIL=sysadmin@example.com;\
AUTORUN_SCHEDULE=3 * * 1,3,5;\
AUTORUN_FLAGS=-profile sysadmin -tag sysadmin;\
collection_retention=60"

    Example output:

    Created notification_email for ID[sysadmin]
Created autorun_schedule for ID[sysadmin]
Created autorun_flags for ID[sysadmin]
Created collection_retention for ID[sysadmin]

    For Oracle Exachk:

    exachk -id sysadmin -set "NOTIFICATION_EMAIL=sysadmin@example.com;\
AUTORUN_SCHEDULE=3 * * 1,3,5;\
AUTORUN_FLAGS=-profile sysadmin -tag sysadmin;\
collection_retention=60"

    Example output:

    Created notification_email for ID[sysadmin]
Created autorun_schedule for ID[sysadmin]
Created autorun_flags for ID[sysadmin]
Created collection_retention for ID[sysadmin]

The daemon manages both option profiles independently, running each set of compliance checks according to its configured schedule and options.

Starting and Stopping the Daemon

Start or stop the Oracle Orachk or Oracle Exachk daemon, and configure an execution-time window for the default scheduled compliance checks.

Starting the Daemon

To start the Oracle Orachk daemon:

orachk -autostart

To start Oracle Orachk and load the default schedulers:

orachk -autostart reset

To start the Oracle Exachk daemon:

exachk -autostart

To start Oracle Exachk and load the default schedulers:

exachk -autostart reset

The tools prompt for any required information during startup.

Stopping the Daemon

To stop the Oracle Orachk daemon:

orachk -autostop

To stop the daemon and remove all unmodified default Oracle Orachk schedulers:

orachk -autostop unset

For Oracle Exachk:

exachk -autostop

To stop the daemon and remove all unmodified default Oracle Exachk schedulers:

exachk -autostop unset

If a compliance check is running when you attempt to stop the daemon, the daemon indicates that a run is in progress and continues running until the compliance check is stopped or completes.

Configuring an Automatic Run Window

Use the automatic run window to randomize the hour and minute assigned to the default daemon schedules when the scheduler entries are created.

By default, Oracle Exachk schedules:

  • The exatier1 profile at approximately 2 AM.
  • The full compliance check at approximately 3 AM.

When you configure an automatic run window, AHF selects a schedule within the specified number of hours before or after the default hour. It also selects a random minute between 0 and 59.

For example, with an automatic run window of 5, a default 2 AM schedule can be assigned any hour from 9 PM through 7 AM.

With a window of 1, a default 2 AM schedule can be assigned to 1 AM, 2 AM, or 3 AM.

Note:

The automatic run window is applied only when the scheduler entry is created. It does not define a different execution window for each scheduled run.

For example, if AHF assigns a scheduler entry to 4:15 AM, subsequent runs occur at 4:15 AM on the configured days.

You can configure the automatic run window in the following ways:

  • Set the RAT_AUTORUN_WINDOW environment variable before installing AHF.
  • Specify -autorun_window when installing AHF.
  • Configure RAT_AUTORUN_WINDOW in the Oracle Orachk or Oracle Exachk environment file.
  • Specify -autorun_window when running orachk -autostart or exachk -autostart.

Setting RAT_AUTORUN_WINDOW Before Installing AHF

Set RAT_AUTORUN_WINDOW before running ahf_setup.

For example:

export RAT_AUTORUN_WINDOW=5
./ahf_setup -ahf_loc /opt/oracle.ahf -data_dir /opt/oracle.ahf -silent

After installation, view the generated Oracle Orachk schedules:

orachk -get all

Example:

------------------------------------------------------------
ID: orachk.autostart_client_oratier1
------------------------------------------------------------
AUTORUN_FLAGS = -usediscovery -profile oratier1 -dball -showpass -tag autostart_client_oratier1 -readenvconfig
COLLECTION_RETENTION = 7
AUTORUN_SCHEDULE = 20 1 * * 1,2,3,4,5,6
------------------------------------------------------------

------------------------------------------------------------
ID: orachk.autostart_client
------------------------------------------------------------
AUTORUN_FLAGS = -usediscovery -tag autostart_client -readenvconfig
COLLECTION_RETENTION = 14
AUTORUN_SCHEDULE = 15 3 * * 0
------------------------------------------------------------

For Oracle Exachk:

exachk -get all

Example:

------------------------------------------------------------
ID: exachk.autostart_client_exatier1
------------------------------------------------------------
AUTORUN_FLAGS = -usediscovery -profile exatier1 -dball -showpass -tag autostart_client_exatier1 -readenvconfig
COLLECTION_RETENTION = 7
AUTORUN_SCHEDULE = 20 1 * * 1,2,3,4,5,6
------------------------------------------------------------

------------------------------------------------------------
ID: exachk.autostart_client
------------------------------------------------------------
AUTORUN_FLAGS = -usediscovery -tag autostart_client -readenvconfig
COLLECTION_RETENTION = 14
AUTORUN_SCHEDULE = 15 3 * * 0
------------------------------------------------------------

The generated hour falls within the configured window, and the minute is randomized between 0 and 59.

Setting the Automatic Run Window During AHF Installation

Specify the -autorun_window option when running ahf_setup.

For example:

./ahf_setup -ahf_loc /opt/oracle.ahf \
            -data_dir /opt/oracle.ahf \
            -silent \
            -autorun_window 5

View the generated schedule:

orachk -get all

Example:

------------------------------------------------------------
ID: orachk.autostart_client_oratier1
------------------------------------------------------------
AUTORUN_FLAGS = -usediscovery -profile oratier1 -dball -showpass -tag autostart_client_oratier1 -readenvconfig
COLLECTION_RETENTION = 7
AUTORUN_SCHEDULE = 24 6 * * 1,2,3,4,5,6
------------------------------------------------------------

------------------------------------------------------------
ID: orachk.autostart_client
------------------------------------------------------------
AUTORUN_FLAGS = -usediscovery -tag autostart_client -readenvconfig
COLLECTION_RETENTION = 14
AUTORUN_SCHEDULE = 29 6 * * 0
------------------------------------------------------------

The same option applies to the Oracle Exachk default scheduler entries.

Note:

If both RAT_AUTORUN_WINDOW and -autorun_window are specified, the -autorun_window command-line value takes precedence.

When the automatic run window is configured during installation, AHF stores the value in the Oracle Orachk and Oracle Exachk environment files.

To view the Oracle Orachk environment file:

cat `orachk -showenvfile`

For example:

RAT_AUTORUN_WINDOW=5

For Oracle Exachk:

cat `exachk -showenvfile`

For example:

RAT_AUTORUN_WINDOW=5

Subsequent -autostop and -autostart operations use the value stored in the environment file. You can remove the entry from the environment file when it is no longer required.

Using RAT_AUTORUN_WINDOW from the Environment File

If RAT_AUTORUN_WINDOW is already defined in the Oracle Orachk or Oracle Exachk environment file, -autostart automatically reads and applies the configured window.

For example:

orachk -autostart

Example output:

Applying execution time window of (+/-) 5 hours
Applying execution time window of (+/-) 5 hours
Successfully copied Daemon Store to Remote Nodes

orachk is using TFA Scheduler. TFA PID: 3964931

View the resulting schedules:

orachk -get all

Example:

------------------------------------------------------------
ID: orachk.autostart_client_oratier1
------------------------------------------------------------
AUTORUN_FLAGS = -usediscovery -profile oratier1 -dball -showpass -tag autostart_client_oratier1 -readenvconfig
COLLECTION_RETENTION = 7
AUTORUN_SCHEDULE = 42 23 * * 1,2,3,4,5,6
------------------------------------------------------------

------------------------------------------------------------
ID: orachk.autostart_client
------------------------------------------------------------
AUTORUN_FLAGS = -usediscovery -tag autostart_client -readenvconfig
COLLECTION_RETENTION = 14
AUTORUN_SCHEDULE = 31 0 * * 0
------------------------------------------------------------

Oracle Exachk uses the same behavior:

exachk -autostart

Specifying the Automatic Run Window with autostart

Specify -autorun_window directly when starting the daemon.

For Oracle Orachk:

orachk -autostart -autorun_window 4

For Oracle Exachk:

exachk -autostart -autorun_window 4

For example:

Applying execution time window of (+/-) 4 hours
Applying execution time window of (+/-) 4 hours
Successfully copied Daemon Store to Remote Nodes

exachk is using TFA Scheduler. TFA PID: 3964931

AHF generates the scheduler entries using an hour within the specified window and a random minute between 0 and 59.

Note:

Specify -autorun_window 0 to disable the automatic run window, even if RAT_AUTORUN_WINDOW is defined in the current environment or in the Oracle Orachk or Oracle Exachk environment file.

Querying the Status and Next Planned Daemon Run

Use the -autostatus option to view the status of the Oracle Orachk or Oracle Exachk daemon and determine when the next scheduled compliance check will run.

Checking the Daemon Status

To check the status of the Oracle Orachk daemon, run:

orachk -autostatus

For Oracle Exachk:

exachk -autostatus

If the daemon is running, the output confirms its status and displays the process ID (PID).

Viewing Daemon Details

The -autostatus option also displays detailed information about the running daemon, including:

  • Node on which the daemon is running.
  • Oracle Orachk or Oracle Exachk version.
  • Installation location.
  • Time when the daemon was started.
  • Scheduler type.
  • Scheduler process ID.
  • Configured scheduler entries.

For Oracle Orachk:

orachk -autostatus

For Oracle Exachk:

exachk -autostatus

Viewing the Next Scheduled Compliance Check

Use the same -autostatus option to determine when the next automatic compliance check is scheduled to run.

For Oracle Orachk:

orachk -autostatus

For Oracle Exachk:

exachk -autostatus

The output identifies the next scheduled run and the scheduler ID associated with it.

If you have configured multiple daemon option profiles, -autostatus displays the profile whose compliance check is scheduled to run next.

Configuring the Daemon for Automatic Start

Installing Oracle Autonomous Health Framework (AHF) as root on Linux or Solaris automatically configures and starts the Oracle Orachk or Oracle Exachk daemon.

Run the following commands as the root user to manage automatic startup.

Removing Automatic Start

To remove the automatic start configuration for Oracle Orachk:

orachk -autostop

For Oracle Exachk:

exachk -autostop

To remove all unmodified default schedulers for Oracle Orachk:

orachk -autostop unset

For Oracle Exachk:

exachk -autostop unset

Configuring Automatic Start

To configure the Oracle Orachk daemon to start automatically:

orachk -autostart

For Oracle Exachk:

exachk -autostart

To start the daemon and load the default schedulers, use the reset option.

For Oracle Orachk:

orachk -autostart reset

For Oracle Exachk:

exachk -autostart reset

By default, the daemon schedules:

  • A full local compliance check once a week at 3 AM.
  • A partial run of the most impactful checks at 2 AM each day using the oratier1 profile for Oracle Orachk or the exatier1 profile for Oracle Exachk.
  • Automatic purging of daily oratier1 or exatier1 collections after one week.
  • Automatic purging of full local compliance check collections after two weeks.

You can modify the daemon configuration after enabling automatic startup.

Configuring Monthly Full Compliance Checks

Use the -monthly option to schedule the full local compliance check once a month instead of once a week.

For Oracle Orachk:

orachk -autostart -monthly

For Oracle Exachk:

exachk -autostart -monthly

With the monthly configuration, the daemon:

  • Runs a full local compliance check once a month.
  • Continues to run the most impactful checks daily at 2 AM using the oratier1 or exatier1 profile.

Configuring the Daemon for Automatic Restart

By default, you must manually restart the Oracle Orachk or Oracle Exachk daemon after restarting the server or node on which the daemon runs.

Configure automatic restart to have the daemon restart automatically after a server or node reboot.

Run the automatic restart configuration commands as the root user.

Configuring Automatic Restart

  1. Stop the daemon if it is currently running.

    Note:

    You must stop the daemon before running the -initsetup command.

  2. Configure the daemon to restart automatically.

    For Oracle Orachk:

    orachk -initsetup

    For Oracle Exachk:

    exachk -initsetup

    The tool prompts you for any information required to configure automatic restart.

Checking Automatic Restart Status

To check whether automatic restart is configured for Oracle Orachk:

orachk -initcheck

For Oracle Exachk:

exachk -initcheck

Removing Automatic Restart Configuration

To remove the automatic restart configuration for Oracle Orachk:

orachk -initrmsetup

For Oracle Exachk:

exachk -initrmsetup

After removing the configuration, the daemon does not automatically restart when the server or node is rebooted.