Skip to content

Commit 49a0b59

Browse files
AlexanderHodickeAlexanderHodicke
authored
Merge pull request #9 from oracle-devrel/lift-cyber-recovery
lift-cyber-recovery-solution
2 parents e1b0c03 + ca39474 commit 49a0b59

File tree

3 files changed

+331
-0
lines changed

3 files changed

+331
-0
lines changed

‎cloud-architecture/oracle-apps-erp/cyber-recovery-solution/LICENSE

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
2+
Copyright (c) 2023 Oracle and/or its affiliates.
3+
4+
The Universal Permissive License (UPL), Version 1.0
5+
6+
Subject to the condition set forth below, permission is hereby granted to any
7+
person obtaining a copy of this software, associated documentation and/or data
8+
(collectively the "Software"), free of charge and under any and all copyright
9+
rights in the Software, and any and all patent rights owned or freely
10+
licensable by each licensor hereunder covering either (i) the unmodified
11+
Software as contributed to or provided by such licensor, or (ii) the Larger
12+
Works (as defined below), to deal in both
13+
14+
(a) the Software, and
15+
(b) any piece of software and/or hardware listed in the lrgrwrks.txt file if
16+
one is included with the Software (each a "Larger Work" to which the Software
17+
is contributed by such licensors),
18+
19+
without restriction, including without limitation the rights to copy, create
20+
derivative works of, display, perform, and distribute the Software and make,
21+
use, sell, offer for sale, import, export, have made, and have sold the
22+
Software and the Larger Work(s), and to sublicense the foregoing rights on
23+
either these or other terms.
24+
25+
This license is subject to the following condition:
26+
The above copyright notice and either this complete permission notice or at
27+
a minimum a reference to the UPL must be included in all copies or
28+
substantial portions of the Software.
29+
30+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
31+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
32+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
33+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
34+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
35+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
36+
SOFTWARE.

‎cloud-architecture/oracle-apps-erp/cyber-recovery-solution/README.md

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
# Cyber Recovery Solution
2+
3+
Cyber security has become an increasingly critical topic as malware and ransomware attacks continue to occur around the world. For mission-critical databases, such attacks leading to lost data and system downtime can have far-ranging impacts throughout the business in terms of revenue, operations, reputation, and even penalties.
4+
5+
## When to use this asset?
6+
7+
Cyber Recovery should be considered as part of a comprehensive cybersecurity strategy, in conjunction with other preventive, detective, and responsive measures. Its primary focus is on rapid recovery and maintaining the integrity of critical systems and data in the face of cyber threats.
8+
9+
The Cloud Backup Module will be helpful for implementing cyber-recovery solutions, backup high availability, disaster recovery, and guaranteed backups for the database. It enables you to quickly recover your data in case of data loss or corruption. Installation of the Cloud Backup module to take database backups to the object storage will take between 4 to 5 Hrs.
10+
11+
This asset will provide the following key features and benefits:
12+
13+
1) Cloud-Based Data Protection
14+
2) Secure Data Encryption
15+
3) High Availability and Durability
16+
4) Automated and Scheduled Backups
17+
5) Flexible Backup and Recovery Options
18+
6) Compliance and Audit Support
19+
7) Centralized Management and Monitoring
20+
8) Cost Optimization
21+
22+
## How to use this asset?
23+
24+
Here's an overview of how to use this asset:
25+
26+
Follow the deployment section in the Cyber-Recovery-Solution document and configure the Oracle Cloud Backup Module.
27+
28+
#### Pre-requisites:
29+
30+
1) An active Oracle Cloud Infrastructure account.
31+
2) An Oracle Database instance or cluster that you want to back up.
32+
33+
### Useful Links
34+
35+
[This link](https://docs.oracle.com/en/solutions/oci-automated-cyber-recovery/) can be referred to for cyber recovery solutions using Ansible playbooks, Terraform, Shell, and RMAN scripts.
36+
37+
# License
38+
Copyright (c) 2023 Oracle and/or its affiliates.
39+
Licensed under the Universal Permissive License (UPL), Version 1.0.
40+
See [LICENSE](LICENSE) for more details.

‎cloud-architecture/oracle-apps-erp/cyber-recovery-solution/files/cyber-recovery-solution.md

Lines changed: 255 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,255 @@
1+
# Introduction
2+
3+
Cyber security has become an increasingly critical topic as malware and ransomware attacks continue to occur around the world. For mission-critical databases, such attacks leading to lost data and system downtime can have far-ranging impacts throughout the business in terms of revenue, operations, reputation, and even penalties.
4+
5+
The purpose of Oracle Cloud Database Backup Service is to provide a secure, reliable, and cost-effective way to back up and recover Oracle Database workloads that are running in the cloud or on-premises. With this service, you can create backups of your databases and store them in Oracle Cloud Infrastructure Object Storage, which provides highly durable and scalable object storage.
6+
7+
The service offers several benefits, including automated backups, point-in-time recovery, and backup retention policies. It enables you to quickly recover your data in case of data loss or corruption, and can also be used to migrate your databases to the cloud. Additionally, the service helps you meet your regulatory and compliance requirements by providing data encryption and secure backups.
8+
9+
Owner: Bhaskar Ivaturi
10+
11+
## Deployment
12+
13+
Download and install the Oracle Cloud Backup Module on the database server(s) where your Oracle Database resides. The installation process typically involves running the provided installation scripts and configuring the necessary parameters.
14+
15+
- Download the Oracle Database Cloud Backup Module for OCI from Oracle Technology Network (https://www.oracle.com/database/technologies/oracle-cloud-backup-downloads.html).
16+
- Accept the license agreement, click All Supported Platforms, and provide your OTN username and password when prompted. Then download the ZIP file that contains the installer (opc_installer.zip) to your system.
17+
- Extract the contents of the zip file.
18+
- The file contains two directories, oci_installer (for Oracle Cloud Infrastructure) and opc_installer (for Oracle Cloud Infrastructure Classic), and a README file.
19+
- To use Oracle Database Backup Cloud Service for Oracle database backups, you'll need to install the appropriate backup module needed for cloud backups.
20+
- Run the installer, oci_install.jar, from the oci_installer directory. Provide the required parameters in one line, with each parameter preceded by a hyphen and followed by its value.
21+
22+
The following is an example run of the installer. This example shows how the installer automatically downloads the Oracle Database Cloud Backup Module for OCI for your operating system, creates a wallet that contains Oracle Database Backup Cloud Service identifiers and credentials, creates the backup module configuration file, and downloads the library necessary for backups and restores to Oracle Cloud Infrastructure.
23+
24+
```
25+
%java -jar oci_install.jar -host https://objectstorage.<region>.oraclecloud.com
26+
-pvtKeyFile /oracle/dbs/oci_wallet/oci_pvt
27+
-pubFingerPrint xx:10:06:b1:fb:24:xx:xx:46:21:16:20:00:xx:xx:00
28+
-uOCID ocid1.user.oc1..aaaaaaaasd11111111111111111111117z7aibxxxxxxxxxxxxxxxxxxx
29+
-tOCID ocid1.tenancy.oc1..aaaaaaaav11111111111111111111rft58i6ts3xxxxxxxxxxxxxxxxxx
30+
-walletDir /oracle/dbs/oci_wallet
31+
-libDir /oracle/lib
32+
-bucket db_backups
33+
```
34+
35+
After installing the backup module, you'll configure the settings that will be used for backup and recovery operations. When using Recovery Manager (RMAN) for backup and recovery operations with Oracle Database Backup Cloud Service, you must configure your RMAN environment.
36+
37+
```
38+
RMAN> CONFIGURE DEFAULT DEVICE TYPE TO 'SBT_TAPE';
39+
RMAN> CONFIGURE CHANNEL DEVICE TYPE sbt PARMS='SBT_LIBRARY=location-of-the-SBT-library-for-the-backup-module, SBT_PARMS=(OPC_PFILE=location-of-the-configuration file)’;
40+
RMAN> CONFIGURE COMPRESSION ALGORITHM 'MEDIUM’;
41+
RMAN> CONFIGURE DEVICE TYPE 'SBT_TAPE' PARALLELISM 4 BACKUP TYPE TO COMPRESSED BACKUPSET;
42+
RMAN> CONFIGURE ENCRYPTION FOR DATABASE ON;
43+
```
44+
45+
### Backup Destination
46+
47+
Create an Oracle Cloud Infrastructure Object Storage bucket to serve as the backup destination. This bucket will store the backup files securely in the Oracle Cloud.
48+
49+
##### Backup Schedule and Policies:
50+
51+
Define backup schedules and retention policies based on your requirements. You can specify the frequency and timing of backups, as well as how long to retain them. Oracle Cloud Backup Module(OCBM) supports full and incremental backups to optimize storage consumption and backup duration.
52+
53+
##### Backup and Recovery Operations:
54+
55+
Initiate backups using OCBM commands or integrated RMAN (Recovery Manager) commands. OCBM seamlessly integrates with RMAN, providing familiar commands and workflows.
56+
Monitor the progress and status of backup operations to ensure successful completion.
57+
58+
Perform restore and recovery operations as needed. OCBM allows you to restore the database to a specific point in time using backups stored in OCI Object Storage. Use the RMAN shell scripts for seamless restore operations.
59+
60+
##### Use Case 1: Implement a cyber recovery solution on Oracle Cloud Infrastructure
61+
###### RMAN Scripts for backup and restore
62+
###### Sample Backup script:
63+
64+
```
65+
#!/bin/bash
66+
#
67+
W_SID=$1
68+
VDATE=`date +%d'-'%m'-'%Y`
69+
. /home/oracle/${W_SID}.env
70+
$ORACLE_HOME/bin/rman target / <<EOF
71+
SET ENCRYPTION ON;
72+
RUN {
73+
ALLOCATE CHANNEL SBT_1 DEVICE TYPE SBT parms='SBT_LIBRARY=/xxx/xxxxx/xxxx/libopc.so, ENV=(OPC_PFILE=/xxx/xxxxx/xxxx//opcCRS.ora)' ;
74+
ALLOCATE CHANNEL SBT_2 DEVICE TYPE SBT parms='SBT_LIBRARY=/xxx/xxxxx/xxxx/libopc.so, ENV=(OPC_PFILE=/xxx/xxxxx/xxxx//opcCRS.ora)' ;
75+
ALLOCATE CHANNEL SBT_3 DEVICE TYPE SBT parms='SBT_LIBRARY=/xxx/xxxxx/xxxx/libopc.so, ENV=(OPC_PFILE=/xxx/xxxxx/xxxx//opcCRS.ora)' ;
76+
ALLOCATE CHANNEL SBT_4 DEVICE TYPE SBT parms='SBT_LIBRARY=/xxx/xxxxx/xxxx/libopc.so, ENV=(OPC_PFILE=/xxx/xxxxx/xxxx//opcCRS.ora)' ;
77+
BACKUP SECTION SIZE 64G AS COMPRESSED BACKUPSET INCREMENTAL LEVEL 0 DATABASE FORCE TAG '${W_SID}_LEV0_BACKUP_${VDATE}' FORMAT '%U-%d-OSS-DB-19-%I-%T';
78+
BACKUP AS COMPRESSED BACKUPSET ARCHIVELOG FROM TIME 'SYSDATE-1' FORCE FORMAT '%U-%d-OSS-DB-19-%I-%T';
79+
}
80+
EOF
81+
```
82+
83+
###### Sample Restore script:
84+
85+
```
86+
#!/bin/bash
87+
###############################################################################
88+
# $Header: db_restore.sh v0.1 - DB Restore $
89+
# NAME
90+
# db_restore.sh
91+
# FUNCTION
92+
# This script will restore the control file, and restore & recover the database using standby DB backup which is taken to object storage.
93+
# This script is executed as an Oracle user and needs to be updated as per your environment.
94+
# UPDATE The Script as per your environment.
95+
# 1) Update the environment file name and path which needs to be sourced.
96+
# 2) Make sure we have the required pfile in place to start the DB in nomount.
97+
# 3) Update the DBSID.
98+
# 4) Disk Group name at set newname for database line.
99+
# NOTES
100+
# MODIFIED
101+
##############################################################################
102+
# User specific aliases and functions
103+
. /home/oracle/DB.env
104+
sqlplus -s "/ as sysdba" << EOF
105+
startup nomount pfile='/u01/OCI-Cyber-scripts/DB-Restore/db/pfile.ora';
106+
create spfile='+DATA' from pfile='/u01/OCI-Cyber-scripts/DB-Restore/db/pfile.ora';
107+
startup nomount force;
108+
EOF
109+
rman target / << EOF
110+
run
111+
{
112+
set DBID <Update the DB ID Value>;
113+
ALLOCATE CHANNEL SBT1 DEVICE TYPE SBT parms='SBT_LIBRARY=/u01/OCI-Cyber-scripts/DB-Restore/opc/lib/libopc.so, ENV=(OPC_PFILE=/u01/OCI-Cyber-scripts/DB-Restore/opc/opcCRS.ora)' ;
114+
restore PRIMARY controlfile from AUTOBACKUP maxdays 20;
115+
alter database mount;
116+
}
117+
EOF
118+
sqlplus -s "/ as sysdba" << EOF
119+
alter database disable block change tracking;
120+
alter database set standby to maximize performance;
121+
EOF
122+
srvctl status database -d $ORACLE_UNQNAME
123+
sqlplus -S "/ as sysdba" << EOF > /u01/OCI-Cyber-scripts/DB-Restore/db/current_seq.log
124+
set head off
125+
set echo off
126+
set feedback off
127+
select 'set until sequence ' || seq# || ' thread ' || thread# || '; ' "Recover Command"
128+
from (
129+
select * from (
130+
select thread#, sequence# seq#, next_change# from (
131+
select * from v\$backup_archivelog_details
132+
where thread# || '_' || sequence# in
133+
(select thread# || '_' || max(sequence#) from v\$backup_archivelog_details group by thread#)
134+
) order by next_change#
135+
) where rownum = 1 ) ;
136+
EOF
137+
echo "run" > /u01/OCI-Cyber-scripts/DB-Restore/db/rman_restore.sh
138+
echo "{" >> /u01/OCI-Cyber-scripts/DB-Restore/db/rman_restore.sh
139+
echo "ALLOCATE CHANNEL CH1 DEVICE TYPE SBT parms='SBT_LIBRARY=/u01/OCI-Cyber-scripts/DB-Restore/opc/lib/libopc.so, ENV=(OPC_PFILE=/u01/OCI-Cyber-scripts/DB-Restore/opc/opcCRS.ora)';" >> /u01/OCI-Cyber-scripts/DB-Restore/db/rman_restore.sh
140+
echo "ALLOCATE CHANNEL CH2 DEVICE TYPE SBT parms='SBT_LIBRARY=/u01/OCI-Cyber-scripts/DB-Restore/opc/lib/libopc.so, ENV=(OPC_PFILE=/u01/OCI-Cyber-scripts/DB-Restore/opc/opcCRS.ora)';" >> /u01/OCI-Cyber-scripts/DB-Restore/db/rman_restore.sh
141+
echo "ALLOCATE CHANNEL CH3 DEVICE TYPE SBT parms='SBT_LIBRARY=/u01/OCI-Cyber-scripts/DB-Restore/opc/lib/libopc.so, ENV=(OPC_PFILE=/u01/OCI-Cyber-scripts/DB-Restore/opc/opcCRS.ora)';" >> /u01/OCI-Cyber-scripts/DB-Restore/db/rman_restore.sh
142+
echo "ALLOCATE CHANNEL CH4 DEVICE TYPE SBT parms='SBT_LIBRARY=/u01/OCI-Cyber-scripts/DB-Restore/opc/lib/libopc.so, ENV=(OPC_PFILE=/u01/OCI-Cyber-scripts/DB-Restore/opc/opcCRS.ora)';" >> /u01/OCI-Cyber-scripts/DB-Restore/db/rman_restore.sh
143+
echo "set newname for database to '+DATA'; " >> /u01/OCI-Cyber-scripts/DB-Restore/db/rman_restore.sh
144+
cat /u01/OCI-Cyber-scripts/DB-Restore/db/current_seq.log >> /u01/OCI-Cyber-scripts/DB-Restore/db/rman_restore.sh
145+
echo "restore database;" >> /u01/OCI-Cyber-scripts/DB-Restore/db/rman_restore.sh
146+
echo "switch datafile all;" >> /u01/OCI-Cyber-scripts/DB-Restore/db/rman_restore.sh
147+
echo "recover database;" >> /u01/OCI-Cyber-scripts/DB-Restore/db/rman_restore.sh
148+
echo "}" >> /u01/OCI-Cyber-scripts/DB-Restore/db/rman_restore.sh
149+
chmod +x /u01/OCI-Cyber-scripts/DB-Restore/db/rman_restore.sh
150+
rman target / cmdfile=/u01/OCI-Cyber-scripts/DB-Restore/db/rman_restore.sh log=/u01/OCI-Cyber-scripts/DB-Restore/db/logs/rman_restore_`date +%Y%m%d%H%M%S`.log
151+
sqlplus -s "/ as sysdba" << EOF
152+
alter database set standby to maximize performance;
153+
alter database open resetlogs;
154+
EOF
155+
srvctl stop database -d $ORACLE_UNQNAME
156+
srvctl start database -d $ORACLE_UNQNAME -o "read only"
157+
srvctl status database -d $ORACLE_UNQNAME -v
158+
```
159+
160+
##### Use Case 2: Create DR Using backup from Object Storage
161+
162+
To perform targetless duplication in RMAN without connecting to the source database or catalog, the BACKUP LOCATION clause is used. However, this method is only applicable when the source database backups are stored in a DISK location. If the source database utilizes Oracle Database Backup Cloud Service (e.g., ZDM or EBS Cloud Manager) for cloud backups, the following steps need to be followed:
163+
1) Apply one-off patch 26082402:
164+
- For Oracle RDBMS versions 12c and later, it is necessary to apply patch 26082402.
165+
- Please note that this bug is fixed starting from Oracle RDBMS version 19.1 onwards.
166+
2) Create an XML file with backup information:
167+
- On the destination database server, execute the odbsrmt.py script (bundled along with the libopc.so library file).
168+
- This script generates an XML file containing the necessary backup information. The XML file will be utilized by the DUPLICATE command in RMAN.
169+
By following these steps, the targetless duplication process can be performed successfully, even when using cloud backups from Oracle Database Backup Cloud Service. The patch application ensures that any relevant issues are resolved, and the odbsrmt.py script facilitates the creation of the XML file containing the required backup information for the DUPLICATE command in RMAN.
170+
171+
###### Example
172+
173+
```
174+
python odbsrmt.py --mode=rman-listfile --host=https://swiftobjectstorage.<region>.oraclecloud.com/v1/<namespace> --container=<container_name> --forcename=duplicate.xml –dir=/u01/install/APPS/backup/ --credential=Username/"tokenID" --dbid=<database ID>
175+
odbsrmt.py: ALL outputs will be written to [/u01/install/APPS/backup/duplicate.xml]
176+
odbsrmt.py: Processing container backup_db...
177+
cloud_slave_processors: Thread Thread_0 starting to download metadata XML files...
178+
cloud_slave_processors: Thread Thread_0 successfully done
179+
odbsrmt.py: ALL outputs have been written to [/u01/install/APPS/backup/duplicate.xml]
180+
```
181+
182+
###### Script to duplicate standby database.
183+
184+
```
185+
connect auxiliary /
186+
set DECRYPTION identified by "<password>";
187+
run {
188+
ALLOCATE AUXILIARY CHANNEL aux1 DEVICE TYPE SBT parms='SBT_LIBRARY=/u01/install/APPS/backup/lib/libopc.so, ENV=(OPC_PFILE=/u01/install/APPS/backup/opcdbbkp.ora)';
189+
ALLOCATE AUXILIARY CHANNEL aux2 DEVICE TYPE SBT parms='SBT_LIBRARY=/u01/install/APPS/backup/lib/libopc.so, ENV=(OPC_PFILE=/u01/install/APPS/backup/opcdbbkp.ora)';
190+
ALLOCATE AUXILIARY CHANNEL aux3 DEVICE TYPE SBT parms='SBT_LIBRARY=/u01/install/APPS/backup/lib/libopc.so, ENV=(OPC_PFILE=/u01/install/APPS/backup/opcdbbkp.ora)';
191+
ALLOCATE AUXILIARY CHANNEL aux4 DEVICE TYPE SBT parms='SBT_LIBRARY=/u01/install/APPS/backup/lib/libopc.so, ENV=(OPC_PFILE=/u01/install/APPS/backup/opcdbbkp.ora)';
192+
duplicate target database for standby backup location from file '/u01/install/APPS/backup/duplicate.xml' nofilenamecheck;
193+
}
194+
```
195+
196+
*Reference doc: Perform RMAN Targetless Duplication Using Cloud (Oracle Database Backup Cloud Service) Backups (Doc ID 2454290.1)*
197+
198+
#### Validation/Testing
199+
200+
Test Scenario – This script, named validation.sql, runs the validation queries while connected as sysdba. It provides a comprehensive validation report for the target database after the restore process. The script sets various SQL*Plus settings to control output formatting and executes the necessary queries. The results include information such as the PDB name, current date, database name, open mode, database status, logins, and status of distinct datafiles, tablespaces, temp files, and data files. It also reports the number of invalid objects and the count of recoverable files.
201+
202+
Executing this script ensures a thorough validation of the restored database, enabling confirmation of a successful restore operation and providing critical information for further testing and analysis.
203+
204+
```
205+
#!/bin/bash
206+
###############################################################################
207+
# $Header: validation.sql - DB Restore $
208+
# NAME
209+
# validation.sql
210+
# FUNCTION
211+
# This script runs the validation queries connected as sysdba.
212+
# NOTES
213+
# MODIFIED
214+
###############################################################################
215+
# User-specific aliases and functions
216+
#
217+
# Source the DB envirnomnet
218+
#
219+
. /home/oracle/DB.env
220+
ORACLE_PDB_SID=PDBSID; export ORACLE_PDB_SID
221+
#
222+
#echo "Validation Report of Database"
223+
#echo "================================="
224+
#
225+
sqlplus -s "/ as sysdba" << EOF
226+
set echo off
227+
set verify off
228+
set feedback off
229+
set heading off
230+
set trimspool on
231+
#set termout off
232+
233+
col Distinct_Datafile_Status for a24
234+
col Distinct_Tablespaces_Status for a27
235+
col Distinct_Tempfiles_Status for a25
236+
col Distinct_Datafiles_Status for a25
237+
SET NUMWIDTH 20
238+
239+
select 'pdb:'||PDB_NAME from dba_pdbs;
240+
select 'Sysdate:'||sysdate from dual;
241+
select 'DB_Name:'||name from v\$database;
242+
select 'Open_Mode:'||open_mode from v\$database;
243+
select 'Status:'||status from v\$instance;
244+
select 'Current_scn:'||current_scn from v\$database;
245+
select 'Database_Status:'||database_status from v\$instance;
246+
select 'Logins:'||logins from v\$instance;
247+
select distinct 'Distinct_Datafile_Status:'||status from v\$datafile;
248+
select distinct 'Distinct_Tablespaces_Status:'||status from dba_Tablespaces;
249+
select distinct 'Distinct_Tempfiles_Status:'||status from dba_data_files;
250+
select distinct 'Distinct_Datafiles_status:'||status from dba_temp_files;
251+
select 'Invalids:'||count(*) from dba_objects where status='INVALID';
252+
select 'Recover_Files:'||count(*) from v\$recover_file;
253+
254+
EOF
255+
```

0 commit comments

Comments
 (0)