2 Installing the Enterprise Manager Management Agent
This chapter provides the instructions for installing the Enterprise Manager (EM) Management Agent onto the Audit Vault Server and Database Firewall Appliance.
Prerequisites to Installing Enterprise Manager Agent
There are multiple prerequisites that need to be done in the Audit Vault console before installing the Enterprise Manager agent.
Unblock the EM Agent Network Port
- Log in to the operating system of the Audit Vault Server or Database Firewall appliance as the root user.
- Unblock the network port through which the EM Management Agent and the Enterprise Manager server communicate:
- Edit the file
/usr/local/dbfw/templates/template-iptables.
By default, the permissions for this file is read-only. You must change the permissions to allow editing. As root, change the permissions:
Edit the line as described below. There may be similar entries in this file for database listener ports. Make your entry below these. For AVDF Server version earlier than 20.1, add a line as shown:chmod 644 template-iptables
For AVDF Server version 20.1 and above, add a line as shown:-A RH-Firewall-1-INPUT -p tcp -m state --state NEW --dport <EM agent port number> -j ACCEPT
Where:-A INPUT -p tcp -m state --state NEW --dport <EM agent port number> -j ACCEPT
--dport
is the port number for your EM Agent. Typically, the default port number used by the EM agent is 3872.- An optional “-s” option limits the IP range to specific OMS. The best practice is to add the additional optional switch: "-s ip1,ip2" and limit the IP ranges.
template-iptables
file. Any editing mistakes could make the system inoperable. Change the permissions of thetemplate-iptables
file back to read-only:chmod 444 template-iptables
- Run the following command as
root
:/usr/local/dbfw/bin/priv/configure-networking
- Test your change. If your agent port number is the default value 3872, which is officially registered with IANA by Oracle under
oem-agent
, use:
If another port was used, use:iptables -L | grep oem
iptables -L n | grep <EM agent port number>
- Edit the file
Note:
Changes made here to the template-iptables file might be rolled back by a subsequent Oracle Audit Vault and Database Firewall patch or upgrade. If you notice after applying the next patch or upgrade that Enterprise Manager is no longer collecting information about AV Server correctly, then repeat steps a and b above.
The next step is to install and configure an EM Management Agent on each server where an AVDF agent resides. The EM management agents can be installed using the Enterprise Manager graphical user interface (using a “push” method) or by manually ”pulling” the agent software onto the Audit Vault Server or Database Firewall Appliance.
Installing the Enterprise Manager Agent With UI
Installing the Oracle Enterprise Manager Cloud Control 13c agent is done via a push method from the OEM console.
Be sure to perform the prerequisites detailed in Prerequisites to Installing Enterprise Manager Agent.
- From the Setup dropdown select Add Target > Add Target Manually.
- Click Install Agent on Host.
- Click the + Add button, fill in the Host Name and Platform and click Next.
- Fill in the Installation Base Directory as /var/lib/oracle/agent13c.
- Create a Named Credential for user oracle.
- Leave the root credential blank.
- Click Deploy Agent.
Note:
During the installation phase, you may see a message about sudo not being setup with visible password. Click Continue All Hosts. - Open a terminal window in the Audit Vault Server as root and run the following command:
./var/lib/oracle/agent13c/<agent_version>/root.sh
Manually Installing the EM Management Agent on an Audit Vault Server or a Database Firewall Appliance
Follow the steps below to install the EM Management Agent manually by pulling the agent files and configuring an agent on an Audit Vault Server or a Database Firewall Appliance.
Be sure to perform the prerequisites detailed in Prerequisites to Installing Enterprise Manager Agent.
-
Log in as the
root
user on the Audit Vault Server and run the following command to become theoracle
user:su - oracle
-
Download the
AgentPull.sh
script as follows:cd /tmp curl "https://<OMS_HOST>:<OMS_PORT>/em/install/getAgentImage" -k -o AgentPull.sh
-
Give execute permission to the AgentPull.sh script:
chmod +x AgentPull.sh
-
Create a response
agent.rsp
file with the following content:LOGIN_USER=sysman PLATFORM="Linux x86-64"
-
Run the
AgentPull.sh
script to download and install the Management Agent:./AgentPull.sh RSPFILE_LOC=/tmp/agent.rsp AGENT_BASE_DIR=/var/lib/oracle/emagent ORACLE_HOSTNAME=location.mycompany.com AGENT_PORT=3872
Note:
ORACLE_HOSTNAME
is the fully qualified hostname of the Audit Vault Server where the EM Management Agent is being installed.You will be prompted for two passwords immediately upon executing this command.
The installation of the EM Management Agent starts automatically as soon as the download has finished. At the end of the installation, you will be prompted to run a script as root
.
After running that script, continue with Discovering the Oracle AVDF Target.