Installing Oracle Autonomous Health Framework on Linux

Install Oracle Autonomous Health Framework as root to obtain the fullest capabilities. Oracle Autonomous Health Framework has reduced capabilities when you install it as a non-root user.

(Recommended) Installing on Linux or UNIX as `root` User in Daemon Mode

To obtain the fullest capabilities of Oracle Autonomous Health Framework (AHF), install AHF as the root user.

Note:

Perl version 5.10 or later is required to install Oracle Autonomous Health Framework.

AHF maintains Access Control Lists (ACLs) to determine which users are allowed to access diagnostics. By default, the GRID_HOME owner and ORACLE_HOME owners have access to their respective diagnostics. No other users can perform diagnostic collections unless they are explicitly granted access.

If AHF is already installed, reinstalling AHF performs an upgrade to the existing installation location.

Installing AHF as `root`

Download the Oracle Autonomous Health Framework ZIP file, copy it to the required machine, and extract the contents.
Verify that the environment is configured correctly.

Run:
```
umask
env | more
```
Verify that the umask command returns one of the following values:
```
22
022
0022
```
Run the AHF installer:
```
ahf_setup
```
If you plan to run only Oracle Orachk or Oracle Exachk and do not want to run Oracle Trace File Analyzer processes, use:
```
ahf_setup -extract -notfasetup
```
The installation prompts you to choose between a local and cluster installation.
A cluster installation requires passwordless SSH user equivalency for root across all cluster nodes. If passwordless SSH user equivalency is not already configured, the installer can optionally configure it for the installation and remove it after the installation completes.

If you do not want to use passwordless SSH, install AHF separately on each host using a local installation.

After a local installation, run:
```
tfactl syncnodes
```
This command generates and deploys the required SSL certificates.

Note:

Oracle Clusterware does not manage Oracle Autonomous Health Framework because AHF must remain available even when Oracle Clusterware stops working.

Automatic Startup and Compliance Check Daemon

The AHF installation configures AHF for automatic startup. The auto-start implementation is platform-dependent:

Linux uses init or an init replacement such as upstart or systemd.
Microsoft Windows uses a Windows service.

Installing AHF as root on Linux or Solaris automatically configures and runs the Oracle Orachk or Oracle Exachk daemon.

By default, the daemon:

Runs a full local Oracle Orachk check once a week at 3 AM.
Runs a partial check of the most impactful checks every day at 2 AM using the oratier1 or exatier1 profile.
Automatically purges the daily oratier1 or exatier1 profile run after one week.
Automatically purges the full local run after two weeks.

You can change the daemon settings after enabling auto-start.

To remove automatic startup:

For Oracle Orachk:

orachk -autostop

For Oracle Exachk:

exachk -autostop

To remove all default, unmodified schedulers:

For Oracle Orachk:

orachk -autostop unset

For Oracle Exachk:

exachk -autostop unset

To start automatic scheduling:

For Oracle Orachk:

orachk -autostart

For Oracle Exachk:

exachk -autostart

During installation, AHF prompts you to specify one or more email addresses for recipients of diagnostic notifications.

AHF sends notifications to the configured recipients when:

Oracle Orachk or Oracle Exachk compliance checks complete.
Oracle Autonomous Health Framework detects significant faults.

To start the daemon and load the default schedulers:

For Oracle Orachk:

orachk -autostart reset

For Oracle Exachk:

exachk -autostart reset

Installing Oracle Trace File Analyzer in Standalone Mode

If you installed AHF in extract mode using the -extract -notfasetup option, Oracle Trace File Analyzer (TFA) is not initially configured.

When you run tfactl, AHF prompts you to configure TFA in standalone mode with a message similar to:

# tfactl status

Please run '/scratch/oradb/oracle.ahf/tfa/bin/tfactl -standalone' to configure TFA in Standalone Mode

Run:

tfactl -standalone

Example output:

# tfactl -standalone

[ INFO] : Writing to log file : /tmp/ahf_install_standalone_3962255.log
[DEBUG] : DEBUG :1
[DEBUG] : Debug Level : 5
[DEBUG] : Reading TFA Directories from AHF

Configuring TFA in Standalone Mode...

Build Version : 2406000  Build Date : 202406112235

[DEBUG] : Moving TFA Directories to TFA Data Directory
[DEBUG] : Creating /scratch/oradb/.tfa/tfa.install.properties
[DEBUG] : Creating /scratch/oradb/oracle.ahf/data/testnode/tfa/tfa_setup.txt
[DEBUG] : CRS HOME in AHF :
[DEBUG] : Calling tfactlshare_check_trace()
[DEBUG] : Calling tfactlshare_setup_alltool_dir_for_user()
[DEBUG] : Creating Non-Root Directories for user : oradb

[DEBUG] : Common Data Dir : /scratch/oradb/oracle.ahf/data/testnode/common
[DEBUG] : Orachk Data Dir : /scratch/oradb/oracle.ahf/data/testnode/orachk
[DEBUG] : User Wallet Dir : /scratch/oradb/oracle.ahf/data/testnode/common/wallet/user_oradb
[DEBUG] : User Config Dir : /scratch/oradb/oracle.ahf/data/testnode/common/config/user_oradb
[DEBUG] : Orachk User Dir : /scratch/oradb/oracle.ahf/data/testnode/orachk/user_oradb
[DEBUG] : Orachk Output Dir : /scratch/oradb/oracle.ahf/data/testnode/orachk/user_oradb/output
[DEBUG] : Orachk Work Dir : /scratch/oradb/oracle.ahf/data/testnode/orachk/user_oradb/work

[DEBUG] : AHF Diag Directory : /scratch/oradb/oracle.ahf/data/testnode/diag
[DEBUG] : AHF Insights User Diag Dir : /scratch/oradb/oracle.ahf/data/testnode/diag/ahf_insights/user_oradb

[DEBUG] : ACR Directory : /scratch/oradb/oracle.ahf/data/testnode/acr
[DEBUG] : ACR User Dir : /scratch/oradb/oracle.ahf/data/testnode/acr/user_oradb
[DEBUG] : ACR User Diag Dir : /scratch/oradb/oracle.ahf/data/testnode/diag/acr/user_oradb

[DEBUG] : AHF Scope User Diag Dir : /scratch/oradb/oracle.ahf/data/testnode/diag/ahfscope/user_oradb

[DEBUG] : AHF CLI Dir : /scratch/oradb/oracle.ahf/data/testnode/diag/ahf/cli
[DEBUG] : AHF CLI User Dir : /scratch/oradb/oracle.ahf/data/testnode/diag/ahf/cli/user_oradb

[DEBUG] : AHF Usage User Dir : /scratch/oradb/oracle.ahf/data/testnode/diag/../ahf/usage/user_oradb

[DEBUG] : Balance User Dir : /scratch/oradb/oracle.ahf/data/testnode/balance/user_oradb
[DEBUG] : Balance User Diag Dir : /scratch/oradb/oracle.ahf/data/testnode/diag/balance/user_oradb

[DEBUG] : Completed creating Non-Root directories for user : oradb
[DEBUG] : Running Local Discovery

Discovering Nodes and Oracle Resources

[DEBUG] : Calling confirmDiscovery()
[DEBUG] : Completed updating tfa_directories.txt
[DEBUG] : Generating tfa_database_configs.txt file
[DEBUG] : Running TFA Full Rediscovery Script
[DEBUG] : DATABASE_CLIENT_DIR is
[DEBUG] : Updated DATABASE_CLIENT_DIR successfully in install.properties file
[DEBUG] : Running TFA Inventory
[DEBUG] : Completed TFA Inventory

.-----------------------------------------------------------------------.
|                      Summary of TFA Configuration                     |
+----------------+------------------------------------------------------+
| Parameter      | Value                                                |
+----------------+------------------------------------------------------+
| TFA Location   | /scratch/oradb/oracle.ahf/tfa                        |
| Data Directory | /scratch/oradb/oracle.ahf/data/testnode/tfa          |
| Repository     | /scratch/oradb/oracle.ahf/data/repository            |
| Diag Directory | /scratch/oradb/oracle.ahf/data/testnode/diag/tfa     |
| Java Home      | /scratch/oradb/oracle.ahf/jre                        |
'----------------+------------------------------------------------------+

.------------------------------------------------------------------------------------------------------.
| Host         | Status of TFA | PID | Port    | Version    | Build ID              | Inventory Status |
+--------------+---------------+-----+---------+------------+-----------------------+------------------+
| testnode     | RUNNING       | -   | OFFLINE | 24.6.0.0.0 | 240600020240611223545 | COMPLETED        |
'--------------+---------------+-----+---------+------------+-----------------------+------------------+

[DEBUG] : Inside function tfactlshare_delete_ssl_args

Check the status of Oracle Trace File Analyzer:

tfactl status

Example output:

.------------------------------------------------------------------------------------------------------.
| Host         | Status of TFA | PID | Port    | Version    | Build ID              | Inventory Status |
+--------------+---------------+-----+---------+------------+-----------------------+------------------+
| testnode     | RUNNING       | -   | OFFLINE | 24.6.0.0.0 | 240600020240611223545 | COMPLETED        |
'--------------+---------------+-----+---------+------------+-----------------------+------------------+

Installing on Linux or UNIX as Non-root User in Non-Daemon Mode

If you cannot install Oracle Autonomous Health Framework (AHF) as the root user, install AHF as the Oracle home owner.

Note:

Perl version 5.10 or later is required to install Oracle Autonomous Health Framework.
Cluster-wide installation is not supported when AHF is installed as a non-root user.

AHF has reduced capabilities when installed as a non-root user in non-daemon mode. As a result, you cannot perform the following operations:

Automate diagnostic collections.
Collect diagnostics from remote hosts.
Collect files that are not readable by the Oracle home owner, such as /var/log/messages or certain Oracle Grid Infrastructure logs.

To install AHF as the Oracle home owner, use the -ahf_loc option. Optionally, use the -notfasetup option to prevent Oracle Trace File Analyzer processes from being configured or started.

ahf_setup -ahf_loc <install_dir> [-notfasetup]

Where:

<install_dir> specifies the directory in which AHF is installed.
-notfasetup prevents Oracle Trace File Analyzer from being configured during installation.

For additional installation options, run:

ahf_setup -h

Running AHF on SELinux-Enabled Systems

Oracle Autonomous Health Framework (AHF) supports systems on which Security-Enhanced Linux (SELinux) is enabled.

SELinux Modes

SELinux can operate in the following modes:

Disabled: SELinux is disabled.
Permissive: SELinux reports policy violations but does not enforce the security policy.
Enforcing: SELinux enforces the configured security policy.

When SELinux is enabled, it can run in either Permissive or Enforcing mode.

To determine the current SELinux mode, run either the getenforce or sestatus command.

Run:

/usr/sbin/getenforce

The command returns one of the following values:

Enforcing
Permissive
Disabled

For example:

$ /usr/sbin/getenforce
Permissive

To display detailed SELinux status and policy information, run:

/usr/sbin/sestatus

For example:

SELinux status:                 enabled
SELinuxfs mount:                /sys/fs/selinux
SELinux root directory:         /etc/selinux
Loaded policy name:             targeted
Current mode:                   permissive
Mode from config file:          permissive
Policy MLS status:              enabled
Policy deny_unknown status:     allowed
Memory protection checking:     actual (secure)
Max kernel policy version:      31

Installing AHF in Permissive or Enforcing Mode

When you install AHF while SELinux is running in Permissive or Enforcing mode, the AHF installer loads the required SELinux policy and sets the appropriate security contexts.

No additional configuration is required.

Installing AHF in Disabled Mode

AHF installs successfully when SELinux is Disabled.

However, if you subsequently change SELinux to Permissive or Enforcing mode, SELinux can block AHF processes because the required AHF SELinux policy was not loaded during installation.

To load the AHF SELinux policy, run:

ahfctl loadpolicy

Example output:

Checking if policy exists
Please wait while the policy is being loaded, it might take couple of minutes.
Successfully loaded SELinux policy
Restarting TFA...

To verify that the SELinux policy was loaded successfully, run:

/usr/sbin/semodule -l | grep inittfa-policy

Unloading the AHF SELinux Policy

To remove the AHF SELinux policy and associated security contexts, run:

ahfctl unloadpolicy

Example output:

Please wait while the policy is being removed, it might take couple of minutes.
Successfully removed Contexts and Policy

Installing Oracle Autonomous Health Framework on Linux

(Recommended) Installing on Linux or UNIX as root User in Daemon Mode

Installing AHF as root

Automatic Startup and Compliance Check Daemon

Installing Oracle Trace File Analyzer in Standalone Mode

Installing on Linux or UNIX as Non-root User in Non-Daemon Mode

Running AHF on SELinux-Enabled Systems

SELinux Modes

Installing AHF in Permissive or Enforcing Mode

Installing AHF in Disabled Mode

Unloading the AHF SELinux Policy

(Recommended) Installing on Linux or UNIX as `root` User in Daemon Mode

Installing AHF as `root`