Tuesday Aug 06, 2013

Secure, Subset and Self-Service Database provisioning in Cloud

One-step inline data masking and data subsetting is a very innovative solution in Oracle Enterprise Manager 12c that enables enterprises to provision secure and reduced size test systems directly from the production or standby database without the need for a full production database copy. So you are able to create reduced size copies of production database keeping the referential integrity of data set intact saving on storage costs and more importantly also ensure your sensitive database never creeps into any of your development or test systems in compliance with data privacy policies.

With Oracle Enterprise Manager 12c Release 3 customers have now started adopting this one-step on-the-fly masking and subsetting solution along with Database-as-a-Service(DBaaS) self-service provisioning capabilities and the outcome is one of the most comprehensive and unique solution to realize self-service provisioning of secured, subset copies of production like databases for all of testing and development needs in a private cloud model.

In this blog post I will walk through the steps required to achieve this comprehensive solution for test and development systems provisioning in enterprise private cloud.

1) Prepare source database

One of the ideal option in case customer has physical standby is to convert physical standby into a snapshot standby for one-step data subsetting and masking operation. A snapshot standby receives and archives but does not apply redo from primary until converted back to physical standby. So once you have created subsetted and secure dump from snapshot standby you can convert snapshot standby back to physical standby using Oracle Enterprise Manager. Refer to Oracle Data Guard guide for considerations in using snapshot standby.  In-line data subsetting and masking can also be performed on production database in case there is no physical standby.

2) Perform Inline data subsetting and masking workflow

Here are the steps :

a) Create Application Data Model(ADM)
ADM is a knowledge base entity in Oracle Enterprise Manager that captures application metadata, referential relationships, sensitive columns and is used by both test data management and data masking. There are pre-defined drivers to capture data relationships from application metadata tables for Oracle Applications such as Fusion Apps and eBusiness Suite. Security Administrator requires EM_ALL_OPERATOR privilege to create ADM and Data Masking and Subsetting definition.

b) Create Masking and Subsetting definition

As a best practice, Security Administrator can create masking formats for all regulated information in the enterprise. There are out-of-box Oracle supplied default masking formats also that can be used from format library. Next step is to create masking definition that includes information regarding table columns and the format for each column. You can choose which columns to mask. Data Masking workflow can be referred here.
Next step is to create Data subset definition and use the same ADM and database used in creating the masking definition. In this step you can define the table rules,rule parameters, include 'Ancestor and Descendant tables' or 'Ancestor tables only' option this ensuring referential integrity is maintained. At this step Space estimates can also be reviewed and depending on the result, you can modify or add new rules and review back on space estimates value. Pre/Post subset scripts can also be included in definition.

c) Generate subset using export option

Using the definition subset can be created by writing the subset data to export file. Specify directory where to save the export dump and schedule the subset job. Once the job is complete, the subset Data pump file of production data with sensitive data masked is ready. The overall flow is described here
Some key tips -
- Parallel degree can be used for faster export. Start with twice the number of CPUs and tune from there
- %U and max file size parameter can be used to ensure optimum use of parallelism
- Rule parameter in where clause can be used for actual subset generation with different values
- Column rules can be used to set large-sized columns to null or fix value to reduce database size further

3) Prepare secure test/reference database

Once the Data pump export file is generated it can be imported in a test/staging database . For details refer here.This test database can be used as a reference for all development and testing copies and hosted in Self-Service portal for end users to request from service catalog.

4) Self-Service Portal Setup

Following two options are available to cloud-enable this secure reference database for self-service provisioning of future copies of this database via Oracle Enterprise Manager 12c Database-as-a-Service (DBaaS) solution :

a) Snap Clone option that leverages storage level copy-on-write technologies for cloning and is suited best for functional testing requirements and for short lived databases.With this option you can clone terabytes of data in few minutes and storage saving is enormous with this option. you need to review the supported storage options for this method. As of time of writing the post Netapp and ZFS is supported though there are plans to support more storage options in near future.

b)  RMAN based cloning from backup is one of the favorite option for DBAs. The restore process is completely automated with EM 12c DBaaS and this option is best suited for performance and load testing, development requirements and for databases used for significant updates.
Once you decide on the option, steps to follow are documented in one of my recent blog post around Planning Database as a Service Implementation Project

Refer to Private Cloud Setup and Administration guide here for details on DBaaS Setup and Snap Clone, RMAN Profile options. The secure database prepared in previous step will be used as reference target by SSA Administrator while creating database provisioning profile using RMAN backup or Snapshot option. Please also ensure you have reviewed this MOS Note for DBaaS related patches -
"Enterprise Manager Cloud Control 12c Recommended Plug-Ins and Patches for Database as a Service (DBaaS) (Doc ID 1549855.1)"

5) Self-Service database provisioning in Cloud

End users can now request for secure subset copies of production database via Self-service portal for all kind of functional QA, load and performance testing, development requirements. All the databases provisioned from this approach are also enabled by default with EM 12c powered monitoring and diagnostics, lifecycle and cloud management capabilities.

Solution References

1) Oracle Enterprise Manager 12c Packs
Oracle Test Data Management Pack
Oracle Data Masking Pack
Oracle Database Lifecycle Management Pack
Oracle Database Cloud Management Pack

2) Oracle Enterprise Manager 12c Platform and Plug-ins
Enterprise Manager Cloud Control 12c Release 3 Base Platform (
Enterprise Manager for Oracle Database (DB) plug-in
Enterprise Manager for Oracle Virtualization (VT) plug-in
Enterprise Manager Storage Management Framework (SMF) plug-in
Enterprise Manager for Oracle Cloud (SSA) plug-in

Additional information

Stay Connected:

Twitter |  Face book |  You Tube |  Linked in |  Newsletter

Friday Aug 02, 2013

Managing Oracle Database 12c

Oracle recently announced new management capabilities for Oracle Database 12c, providing customers with even more enhancements to improve productivity and manageability. The new Oracle Enterprise Manager 12c features are supported out-of-the-box with Oracle Database 12c. So whether you want to take advantage of the new Data Redaction capabilities at the security layer, or whether you want to take a look at some of the heat map capabilities in our Information Lifecycle Management or leverage the new performance management features, such as, Database Operations Monitoring or Enhanced Real-Time ADDM, you can use Oracle Enterprise Manager 12c to manage them all.

These new capabilities can be integrated with your standard monitoring and management that you already have in your environment without having to undertake any additional tools or any additional training. Simply install or upgrade to Oracle Enterprise Manager 12c and Oracle Database 12c and together these two products will let you plug into the Cloud.

Here is a quick summary of all the new Oracle Enterprise Manager 12c capabilities for Oracle Database 12c:

  • Complete lifecycle management of multitenant databases: Support for the entire lifecycle operations of multitenant databases that comprise migration, creation, cloning, patching and tracking for compliance
  • Consolidated database replay: Allows customers to test and plan their consolidation using Oracle’s multitenant container and pluggable database technology
  • At-source data masking: Allows customers to maximize compliance and security by masking data in-flight as it is being copied from production
  • Enhanced diagnostics: Improvements to Automatic Database Diagnostic Monitor (ADDM) for real-time and proactive problem detection, especially designed for catching short, transient performance issues
  • Real-time business operations monitoring: Monitors composite business operations such as; batch jobs and ETL operations, providing real-time reports on all SQLs and PL/SQLs executed inside the job
  • Performance hub: Newly redesigned performance home page that provides administrators with a single, at-a-glance view of all performance data and advisors
  • New Oracle Enterprise Manager Database Express 12c: An out-of-the-box, lightweight, easy-to-use web-based management solution for managing individual databases
  • Schema as a Service: This ultimate consolidation of databases lets administrators host multiple application schemas within a single database and offer database as a service to hundreds of application users without creating database sprawl
  • Snap Clone: Instant database cloning allows administrators to create fully functional copies of databases using the copy-on-write capabilities of the underlying storage layer

To learn more about all the latest capabilities, be sure to register for our upcoming webcast: Managing Oracle Database 12c with Oracle Enterprise Manager 12c.

Stay Connected:
Twitter |
Facebook | YouTube | Linkedin | Newsletter
Download the Oracle Enterprise Manager Cloud Control12c Mobile app

Tuesday Jul 02, 2013

Oracle Enterprise Manager 12c R3 introduces advancements in cloud lifecycle and operations management

Oracle Enterprise Manager 12c Release 3 (R3) was announced ( Press Release ) earlier today. It is now available for download at  OTN .

This latest release features improvements in several areas, including:

  • Improvements to Private Cloud and Engineered Systems Management
  • Expanded Middleware and Application Management Capabilities
  • Efficiency Gains for Enterprise manager Users in EM’s Enterprise-Ready Framework

You can learn more about what's new in the Oracle Enterprise Manager 12c R3 in the Enterprise Manager 12c documentation . You will see more blogs and details about the new features during the next few weeks. Please let us what

On July 18th, you can join us at a webcast to hear Thomas Kurian, EVP of Product Development on what Oracle Engineering has achieved with Oracle Enterprise Manager 12c Release 3 to address these challenges. Later, during this webcast, Oracle experts will discuss the latest capabilities in Oracle Enterprise Manager 12c Release 3 for cloud lifecycle and operations management.

The presentation will be followed by a live Q&A session with Oracle experts. You can also join us online on Twitter to get your specific questions answered. Please use hash tag #em12c to join the conversation.

Register Now for the Webcast!

Stay Connected:

Twitter |  Face book |  You Tube |  Linked in |  Newsletter

Tuesday Jun 25, 2013

Planning Database as a Service Implementation Project

People, process and planning are the three key elements to success in a private cloud journey. Some common questions i hear from field/customers often relates to tasks involved in setting up Database-as-a-Service(DBaaS) using Oracle Enterprise Manager 12c from scratch and how these tasks are mapped to current IT roles and responsibilities - overall list of activities that needs to be performed to setup and achieve DBaaS and who does what during the implementation process.

In terms of roles, responsibilities and users, you will map to these categories

  • Project Manager is responsible for working with all stakeholders, project team and coordinating in planning and delivering DBaaS implementation project
  • EM Admin sets ups Cloud management infrastructure and is responsible for overall EM 12c installation/configuration and Administration
  • Cloud Admins are responsible for managing the Cloud infrastructure(Servers, Network, Storage) and related Administration
  • SSA Admins or Cloud DBAs are responsible for Self Service portal setup, managing quotas, policies, target DBs S/W provisioning/ongoing Administration
  • SSA Users or End users of Cloud who actually requests for DB instances to be rapidly provisioned on-demand from Self Service portal

Here is a sample Work-breakdown structure(WBS) listing down tasks involved and with individual owners mapped. Note - we have all type of use cases covered in the plan (DBCA, RMAN, Schema as a Service, Snap Clone) and you can pick up any or mix or all of these tasks in your plan depending on your use cases and requirements for implementing DBaaS -

 Activity Description
A. Initiation and Startup

Determine scope of implementation
Determine and document scope of DBaaS Cloud implementation together with customer and end users. Determine requirements and goals. Introduction meeting implementation team. Project Manager
Coordination and quality management Coordination and quality management on throughout all phases of the implementation Project Manager
Define High availability Needs
Determine the level of High availability required Project Manager
Technical intake Technical intake meeting; Infrastructure requirements (Hardware, OS, network/firewall, s/w requirement) for cloud setup Project Manager
Functional intake Functional intake meeting; Monitoring /Reporting/Alerting requirement. User/Roles/Groups/Rules model Project Manager
Deliver implementation plan Document requirements and goals. Document required functional and technical configuration. Build architecture Diagram. Update estimate planning based on implementation plan. Project Manager
B. Infrastructure Setup

Install hardware systems Plan EM12c compatible hardware systems EM Admin
Operating system installation
Installation of certified OS platform [Refer Certify on MOS] EM Admin
Network configuration of hardware systems General network configuration of hardware systems I.e. TCP/IP, routing, NTP, firewall access, SSH, HTTP and HTTPS access. Set up network access between systems and work place of end users. Optionally implementation of remote access EM Admin
C. Production EM 12c Cloud Control Installation

Install of Oracle Database 11gR2 Installation of Oracle Database 11gR2 for Repository EM Admin
Installation of EM 12c Cloud Control Release 2 Update 1 and latest PSU Installation of EM 12c Cloud Control OMS/Agents EM Admin
Review HA, Security, Sizing Best practices Setup as per EM 12c Admin guide EM Admin
Review recommended patches Review latest PSU and DBaaS patches as per MOS Note 1549855.1 EM Admin
D. Setting up High Availability

Configure Repository For High Availability Enable Repository as per database high availability best practices.
Configure Standby database @ DR site for EM cloud control repository.
Configure repository database as RAC database with 2 or more nodes
Configure OMS for RAC/standby repository
EM Admin
Configure OMS for High Availability See Enterprise Manager Cloud Control Administrator's Guide for Configuring OMS for high availability EM Admin
Configure Agents for High availability See Enterprise Manager Cloud Control Administrator's Guide for Configuring Agents for high availability EM Admin
Test failover strategy