raastech 2013 mous ofmw infrastructure.v2-1
DESCRIPTION
professional guide for oracle weblogic server administrationTRANSCRIPT
Arun ReddyTechnical DirectorRaastech
Oracle Fusion MiddlewareInfrastructure Best Practices
Schoolcraft College – Vistatech CenterRoom Vt460
November 13, 20132:05pm – 2:50pm
© Raastech, Inc. 2013 | All rights reserved. Slide 2 of 57raastech.com
About Raastech
Systems integrator founded in 2009
Headquartered in the Washington DC area
Specializes in Oracle Fusion Middleware
Oracle Gold Partner & Reseller
Oracle SOA Specialized
Certified staff in multiple disciplines
OCE, OCA, OCP, ITIL, CISSP, PMP, etc.
Continued contributions to the technology community
Sponsor and volunteer of numerous users groups
Ongoing publishing of books, articles, whitepapers, and blogs
Regular presenters at major conferences
© Raastech, Inc. 2013 | All rights reserved. Slide 3 of 57raastech.com
About Arun
14+ years of Infrastructure Administration
Focus on Oracle Fusion Middleware infrastructure
implementation, Security, High Availability, and
Disaster Recovery
OCA, ITIL, PMP Certified
Active WMOUG member/presenter
© Raastech, Inc. 2013 | All rights reserved. Slide 4 of 57raastech.com
What is this presentation about?
For Oracle Fusion Middleware administrators
Covers common infrastructure best practices for:
Installations
Patching
Administration
Deployments
Security
© Raastech, Inc. 2013 | All rights reserved. Slide 5 of 57raastech.com
Why do I need it?
I want to Reduce the OWFM Infrastructure Maintenance because I’m
tired of opening change requests/change controls
To know what I can do different for my OWFM Infrastructure to make it
more stable and highly available
Is there anything that I’m not doing right with my installations, patching
or deployment?
I don’t want my phone to ring when I’m watching Lions game or
Breaking Bad
“I think the presenter is cool.” My n
© Raastech, Inc. 2013 | All rights reserved. Slide 7 of 57raastech.com
Understanding Oracle Fusion Middleware
“Oracle Fusion Middleware” is a misleading term
Used to describe middleware products such as:
Business Intelligence (e.g., OBIEE, Discoverer)
Integration (e.g., SOA Suite, OSB)
Identity Management (e.g., Oracle Access Manager)
Monitoring (e.g., OEM Grid Control)
But usually used to describe a single product:
WebLogic Server
© Raastech, Inc. 2013 | All rights reserved. Slide 8 of 57raastech.com
WebLogic Server: Foundation for Fusion Middleware
WebLogic Server is the core foundation of all Oracle
Fusion Middleware products
OEM Grid
ControlOBIEE
Access
ManagerSOA Suite
WebCenter
Portal
Data
Integrator
Oracle WebLogic Server
Clustering – JNDI – Resource Adapters – JDBC – Security – Self Tuning
© Raastech, Inc. 2013 | All rights reserved. Slide 9 of 57raastech.com
Oracle WebLogic Server
At a glance:
Java application server
Acquired from BEA
Replaces Oracle Application Server 9i/10g
Required for almost all Oracle Fusion Middleware products
Current releases:
Oracle WebLogic Server 11g (10.3.6)
Oracle WebLogic Server 12c (12.1.2)
Majority of OFM products are not yet
available for 12c
© Raastech, Inc. 2013 | All rights reserved. Slide 10 of 57raastech.com
WebLogic Server Architectural Considerations
Typically fronted by WebTier/OHS/Apache
Requires JDK (Sun JDK, JRockit, or new JDK7)
Requires shared filesystem for cluster (in 11g) for tlogs
WebLogic Server WebLogic Server WebLogic Server
Shared File System
WebTier WebTier WebTier
Single AdminServerto administer entire
cluster Node Manager runs on every
server
Hardware load balancer
© Raastech, Inc. 2013 | All rights reserved. Slide 11 of 57raastech.com
WebLogic Server 12c New Features
Certified with JDK7
Zip distribution is only 164 MB
Supports Java EE 6
T-Logs can now be database persisted(no shared file system needed)
Improved high availability, performance, and disaster recovery
200+ new features
© Raastech, Inc. 2013 | All rights reserved. Slide 13 of 57raastech.com
Separation of Binaries and Config
Separate binaries in the Fusion Middleware Home and
Configuration directories
The binaries include the Oracle WebLogic Home, Oracle JDK,
Coherence binaries and any required Fusion Middleware
binaries (Files/Directories are mostly read)
The Configuration directories include all Domain homes,
application files and nodemanager configuration
(Files/Directories are both read and written at runtime)
© Raastech, Inc. 2013 | All rights reserved. Slide 14 of 57raastech.com
Operating System Tuning Parameters
Proper OS tuning improves system performance by
preventing the occurrence of error conditions.
Below are some key parameters to considerO/S Parameters Default Proposed
Linux tcp_fin_timeoutBy reducing the value , TCP/IP releases closed connections faster, providing more resources for new connections.
60 30
Linux Backlog connections queue (tcp_max_syn_backlog) When the server is loaded or has many clients with bad connections, it can result in an increase in half-open connections
1024 4096
Linux File Descriptors (open files) 1024 4096(32bit)
WIN2008 MaxUserPortUnder heavy loads it may be necessary to adjust the MaxUserPort. This parameter determines the availability of user ports requested by application
16383 65532
WIN2008 Set the power option setting to "High performance”With High Performance power scheme, processors are always locked at the highest performance state
Balanced High Performance
© Raastech, Inc. 2013 | All rights reserved. Slide 16 of 57raastech.com
Custom Application Deployments
Deploy Custom Application deployments on a shared storage
Applications are deployed as EAR files to servers or read as exploded directories. Place the archives in a shared directory such as $ORACLE_BASE/admin/shared/deploy
In a shared services environment, applications should all be deployed as NOSTAGE
Admin server default is STAGE
Managed server default is NOSTAGE
In NOSTAGE, the application files reside in a location from which all cluster members can initiate a deployment
© Raastech, Inc. 2013 | All rights reserved. Slide 18 of 57raastech.com
Environment Backup – how often do we need it?
The following lists some of the common scenarios in a typical deployment that require performing a backup
After WLS is installed and a domain is created
Before and after making configuration changes to a component or cluster
Prior to deploying a custom pure Java EE application
After any major architectural changes to deployment architecture
Before and after product binary files are patched or upgraded
Important - Backup Embedded LDAP (Set it up through console)
Scheduled backups on a nightly basis or as needed, or both
© Raastech, Inc. 2013 | All rights reserved. Slide 20 of 57raastech.com
Configuration File Backup (contd)
© Raastech, Inc. 2013 | All rights reserved. Slide 22 of 57raastech.com
BAU activities
Starting and stopping a managed server
Don’t use both command line and console for an operation. Use
one or the other for the console to reflect accurate server state
For production environments, use WLST scripts for
deployments
© Raastech, Inc. 2013 | All rights reserved. Slide 24 of 57raastech.com
Security Best Practices
Control Access to OFMW Resources
Create a separate OS user for OFMW and limit access to $MW_HOME
Avoid running the server under a privileged account
If OHS needs to run on port 80, use sudo privileges to start
Enable security auditing
Use connection filters
Security roles and security policies protects WebLogic resources at the domain, application, and the application-component level. Connection filters let you deny access at the network level.
Prevent Denial of Service attacks
Configure “Message Timeout” less than default 60 seconds
Restrict the size of the message (default is 10MB)
Limit the maximum open sockets (if necessary)
© Raastech, Inc. 2013 | All rights reserved. Slide 25 of 57raastech.com
Console and EM Access through LB (Ex. F5 BIG IP)
Create a filtering iRule on the BIG IP Load Balancer to disallow access to WL Console and EM. If you are using any other Load balancer devices, create a custom ACL accordingly.
For example, to create the filtering iRule
On the Main tab, expand Local Traffic, then click iRules. The iRule screen open
In the upper right portion of the screen, click the Create button. The new iRulescreen opens
In the Name box, enter a name for your iRule. Ex: we can use oracle-soa-filter.
In the Definition section, copy and paste the following iRule:
when HTTP_REQUEST {
if { [HTTP::uri] starts_with "/console" } { HTTP::respond 403 content "<html><body><b>HTTP Error 403 - Forbidden</b></body></html>” }
if { [HTTP::uri] starts_with "/em" } { HTTP::respond 403 content "<html><body><b>HTTP Error 403 - Forbidden</b></body></html>” }
}
© Raastech, Inc. 2013 | All rights reserved. Slide 27 of 57raastech.com
New Environment Checklist
Area Description
Logging Enable log rotation
Scripting Develop startup/shutdown scripts
Deployments Develop deployment scripts
Automation Script configuration and resource creation using WLST
Tuning Document core performance tuning areas
Backup Schedule backups
© Raastech, Inc. 2013 | All rights reserved. Slide 30 of 57raastech.com
Contact Information
Arun Reddy
Technical Director