Search <book_title>...

InfoScale™ 9.0 Storage Foundation Administrator's Guide - Linux

Last Published: 2025-05-15

Product(s): InfoScale & Storage Foundation (9.0)

Platform: Linux

Secure file system for Oracle Single Instance

SecureFS Oracle integration provides the ability to take application aware file system checkpoints for Oracle Single Instance for ransomware protection. The feature creates consistent online checkpoints for all the file systems used by Oracle to store data, redo logs, and archive logs. This makes application consistent recovery in case of ransomware scenario possible with minimum RTO.

Note:

Before configuring SecureFS, ensure that the Oracle instance is in running state.

Prerequisites

SecureFS for Oracle requires Oracle database to be running in ARCHIVELOG mode. Refer to the Oracle Database documentation for steps to enable ARCHIVELOG mode.
Ensure that all the directories used by Oracle for storing data and log files reside on a VxFS file system. This allows SecureFS to checkpoint all these file systems in application consistent manner.

To configure secure file system for Oracle Single Instance using CLI

Run the command to ensure that vxfstaskd is in an active state.
# systemctl status vxfstaskd

Enable and start the dbed service.

# systemctl enable vxdbdctrl.service
# systemctl start vxdbdctrl.service

If the Oracle application is managed through a InfoScale Cluster Server resource, create the new Process agent resource. Refer to the Cluster Server Administrator's Guide for details. If the Oracle application is not managed through the InfoScale Cluster Server (VCS) resource, make all the file systems used by the application primary on the node where the Oracle instance is running.
# /opt/VRTS/bin/fsclustadm setprimary <mount point>
Sample command:
# /opt/VRTS/bin/fsclustadm setprimary /dbmnt
Create a secureFS config file on the data file mount point.
# /opt/VRTS/bin/vxschadm create <mount point>
Sample command:
# /opt/VRTS/bin/vxschadm create /dbmnt
Enable Compliance (WORM) or Enterprise (SoftWORM) on data file mount point.
# /opt/VRTS/bin/fsadm -o <worm/softworm> <mount point>
Sample command:
# /opt/VRTS/bin/fsadm -o worm /dbmnt
Configure DBED on the node where the Oracle instance is running.
# /opt/VRTS/bin/dbed_update -S <Oracle SID> -H <Oracle home>
Sample command:
# /opt/VRTS/bin/dbed_update -S testdb -H /u01/oracle/dbhome
Add Oracle application in secureFS config file on data file mount point.
# /opt/VRTS/bin/vxschadm add application oracle <ora_user> <ora_home> <ora_sid> <mntpt>
Sample command:
# /opt/VRTS/bin/vxschadm add application oracle orauser /u01/oracle/dbhome testdb /dbmnt
When SecureFS is configured on the data file system, it identifies all the other file systems used by Oracle and applies the same checkpoint schedule for all such file systems. Manual intervention is not required.
Note:
WORM mode and audit log feature enabled on data file mount point, are applied to redo and archival log mount points.
Enable the checkpoint feature on the data file mount point.
# /opt/VRTS/bin/vxschadm add checkpoint <interval in os cron format> <maximum number of checkpoints> <retention period of checkpoint> <time mode> <removable> <mount_point>
Time interval
```
Format : "mm hh dd MM ww"
mm : minutes (0-59) or *
hh : hours (0-23) or *
dd : days (1-31) or *
MM: months (1-12) or *
ww: week (0-6) SUNDAY=0, SATURADAY=6
```
*: Refers 'per', for example per minute, per hour, and so on.
Time mode can be:
```
m : minutes
h : hours
d : days
M : months
y : years
```
Sample command and output:
# /opt/VRTS/bin/vxschadm add checkpoint "59 15 * * *" 1 h 0 1 /mnt1
Following are the sample output of the snapshot interval format:
Example 1: "30 15 * * *" Output: Every day at 1530 hours, the task is run.
Example 2: "30 15 * * 6" :Output: Every Saturday at 1530 hours, the task is run.
Caution: "* * * * *"
Every minute and hour options are not supported.
If the Oracle Single Instance is under VCS control, you must mark the file system where the Oracle database (DB) resource is online as primary. You can mark the file system as primary by setting the Oracle resource SetFSPrimary attribute value to 1.
The SetFSPrimary attribute for Oracle resource in VCS configures the file system as primary on the node where the Oracle DB resource is online. This attribute plays an important role when the Oracle database is set up as a VCS resource in the Oracle service group that includes both CFSmount and CVMVoldg resources.
When the Oracle resource is online on a node, the InfoScale cluster file system (CFS) should be primary on that same node to ensure that the SecureFS feature functions correctly. To achieve this, set SetFSPrimary to 1 where the Oracle resource is present. With SetFSPrimary set to 1, the Oracle agent resource ensures that the underlying CFS mount is primary on that node.
Note the following when you use this attribute in SecureFS configuration:
- This attribute takes effect only when Cluster Server (VCS) manages the startup of the application.
- If an application mount point is added after the VCS resource is online, then to mark the mount point as primary on the file system, you must restart the VCS application service group.
Use one of the following methods depending on the product version and the SecureFS primary configuration.
- For a fresh InfoScale installation (not an upgrade case), run the following commands to enable the SetFSPrimary attribute:
```
# /opt/VRTSvcs/bin/haconf -makerw
# /opt/VRTSvcs/bin/hares -modify Oracleresourcename SetFSPrimary 1
# /opt/VRTSvcs/bin/haconf -dump -makero
```
- If you have upgraded from InfoScale version 8.0.2 Update 2 (8.0.2.1500) to the current version of InfoScale, you must first remove the existing independent Process agent resource that is added in the Oracle service group. In InfoScale 8.0.2, this Process agent resource is used to mark the file system as primary. However, beginning with InfoScale 9.0 release, a new attribute named SetFSPrimary is introduced to provide the same functionality. Therefore, to set the file system as primary, you must first remove the Process agent resource and then enable the attribute.
  Run the following commands:
  - # /opt/VRTSvcs/bin/haconf -makerw
  - Take the existing Process agent resource in the Oracle service group offline gracefully:
    # /opt/VRTSvcs/bin/hares -offline Processagentresourcename
  - Confirm that the Process agent resource is offline and then delete that resource from the Oracle service group:
    # /opt/VRTSvcs/bin/hares -delete Processagentresourcename
  - Enable the SetFSPrimary attribute by setting its value to 1:
    # /opt/VRTSvcs/bin/hares -modify Oracleresourcename SetFSPrimary 1
    Note:
    The SetFSPrimary attribute value changes take effect only in the next online of the Oracle resource.
  - Save the VCS configuration changes:
    # /opt/VRTSvcs/bin/haconf -dump -makero

If Oracle Single Instance is not under VCS control, ensure FS primary of data file mount point is the system where Oracle Single Instance is up and running.

Interval of less than one hour is not supported. The checkpoints that get created are non-modifiable checkpoints which can only be mounted in read-only mode. If a new datafile or log directory is added to Oracle application which is on a new file system, such file system automatically becomes part of the SecureFS configuration on next checkpoint schedule. Manual intervention is not required.

All SecureFS configuration file operations that are done using # /opt/VRTS/bin/vxschadm must be on the data file mount point.

Note:

Operations performed on redo and archive file system can lead to undefined behavior. Previously taken checkpoints and modes that are WORM and aulog, remain as is, even after you delete the checkpoint feature.