You can optionally run Oracle Orachk or Oracle Exachk as a non-root user.

$ cd /u01/app/crsusr/oracle.ahf/data/host_name/
$ ls -ltra
ls: cannot open directory .: Permission denied
$ cd orachk

$ ls
ls: cannot open directory .: Permission denied
$ cd user_racusr
$ ls -l
total 7456
-r-xr-xr-x 1 root root 6836 Jun 1 13:37 cgrep
rw-rr- 1 root root 5481 Jun 1 13:37 cgrep.pyc
drwxr-xr-x 7 racusr oinstall 274432 Jun 1 14:05 orachk_host_name_ratcdb_060120_133414
rr---- 1 racusr oinstall 7323951 Jun 1 14:05 orachk_host_name_ratcdb_060120_133414.zip
drwx-----T 2 racusr root 4096 Jun 1 14:05 output
drwx-----T 4 racusr root 4096 Jun 1 14:05 work

$ ahfctl showrepo

<<output truncated>>
orachk repository: /u01/app/crsusr/oracle.ahf/data/host_name/orachk/user_racusr/output

Non-root user can run root privileged checks on the database servers without requiring root password or sudo.

1. As root user, grant permission to non-root users to run root privileged checks using the tfactl access grant -user user_name -role privileged-compliance-checks command.
2. Ensure that the non-root user has been assigned to the granted role and promotion is set to n/a.

   tfactl access lsuers
   .-------------------------------------------.
   |            TFA Users in Node1             |
   +-----------+---------+----------+----------+
   | User Name | Status  | Promoted | Roles    |
   +-----------+---------+----------+----------+
   | dbusr     | Allowed | false    | n/a      |
   | giusr     | Allowed | true     | n/a      |
   | orarom    | Allowed | n/a      | platinum |
   '-----------+---------+----------+----------'

Use the daemon to configure automatic compliance check runs at scheduled intervals.

1. Set the daemon properties.

   At a minimum, set AUTORUN_SCHEDULE and NOTIFICATION_EMAIL.

   For example, to set the tool to run at 3 AM every Sunday and email the results to some.body@example.com, run the following command:

   $ exachk –set "AUTORUN_SCHEDULE=3 * * 0 ;NOTIFICATION_EMAIL=some.body@example.com"

   $ orachk –set "AUTORUN_SCHEDULE=3 * * 0 ;NOTIFICATION_EMAIL=some.body@example.com"

   Optionally, you can specify the name of the profile. If you do not specify, then id=DEFAULT.

   For example:

   $ exachk -id dba -set "AUTORUN_SCHEDULE=3 * * 0;NOTIFICATION_EMAIL=some.body@example.com"

   $ orachk -id dba -set "AUTORUN_SCHEDULE=3 * * 0;NOTIFICATION_EMAIL=some.body@example.com"

2. Configure the compliance check daemon as described in "Running Compliance Checks Automatically".
3. Start the daemon as the root user.

   • orachk -autostart

   • exachk -autostart

   To start and load the default schedulers:

   • orachk -autostart reset

   • exachk -autostart reset

   Note:

   You must log in as the root user to run the -autostart and -autostop commands. Non-root users cannot run the TFA Scheduler.

   $ orachk -autostart
   Commands -autostart and -autostop can not be run as non root user. Switch to root user and try again.

   $ orachk -autostop
   Commands -autostart and -autostop can not be run as non root user. Switch to root user and try again.

The following sections provide a brief overview about email notifications and sections of the HTML report output.

• First Email Notification
  After completing compliance check runs, the daemon emails the assessment report as an HTML attachment to all users that you have specified in the NOTIFICATION_EMAIL list.
• What does the Compliance Check Report Contain?
  Compliance check reports contain the health status of each system grouped under different sections of the report.
• Subsequent Email Notifications
  For the subsequent compliance check runs after the first email notification, the daemon emails the summary of differences between the most recent runs.
• Generating a Diff Report
  The diff report attached to the previous email notification shows a summary of differences between the most recent runs.

This section summarizes the scenarios that Oracle recommends running compliance checks on-demand.

$ orachk

$ exachk

Oracle recommends that you run compliance checks in the following on-demand scenarios:

• Pre- or post-upgrades

• Machine relocations from one subnet to another

• Hardware failure or repair

• Problem troubleshooting

• In addition to go-live testing

While running pre- or post-upgrade checks, Oracle Autonomous Health Framework automatically detects the databases that are registered with Oracle Clusterware and presents the list of databases to check.

$ orachk –u –o pre

$ exachk –u –o pre

$ orachk –u –o post

$ exachk –u –o post

Run compliance checks on remote nodes using RSA/DSA SSH private and public keys.

1. Generate RSA/DSA SSH private and public keys on each of the remote nodes as root user.
2. Add the content of the above generated public key to the authorized_keys file for each of the remote nodes.
   For example:

   cat $HOME/.ssh/id_dsa.pub >> $HOME/.ssh/authorized_keys

3. Copy the private keys of all the remote nodes where you want to run the checks, for example, in the PRIVATEKEYDIR directory.
4. Rename each of the private keys as id_encryption.remote_hostname.remote_user.
   Where:

   • remote_user is the Linux user who created the key
   • encryption can be RSA/DSA
   • remote_host is the hostname (not FQDN) of the remote node

   For example:

   id_dsa.node1.root

   id_rsa.node2.oradb

• Synchronous Remote Run
  
• Asynchronous Remote Run
  

Specify a comma-delimited list of check IDs to create and modify custom profiles.

1. To create a profile:

   orachk -createprofile profile_name check_ids 
   

   exachk -createprofile profile_name check_ids

   orachk -createprofile customprofile1 E94AC6ACDA502F3BE04312C0E50A290A,
   F01E3FEDBD2B243EE04312C0E50A4DC5, 
   F02293F7261D1BCAE04312C0E50A4118,
   F9370B4F5707076DE04312C0E50A78AE
   
   Validating checks...
   
   Profile customprofile1 created successfully...

   Oracle Orachk and Oracle Exachk validate profile names and check IDs before creating the profile and print appropriate messages if any discrepancies found. Oracle Orachk and Oracle Exachk create the profiles only if the profile names are unique and check IDs are valid.

2. To modify a profile:

   orachk -modifyprofile profile_name check_ids 
   

   exachk -modifyprofile profile_name check_ids

   exachk -modifyprofile customprofile1 21B57D4065DDEA3DE0530D98EB0A8205,
   39128FBB540C098AE0530D98EB0AFB1A,
   9AD8AF3966FB3027E040E50A1EC0308F,
   019F5085951978CAE05313C0E50A4FCB
   
   Validating checks...
   
   Modifying profile customprofile1...
   
   Profile customprofile1 modified successfully...
   
   
   Added Checks:
   21B57D4065DDEA3DE0530D98EB0A8205
   9AD8AF3966FB3027E040E50A1EC0308F
   019F5085951978CAE05313C0E50A4FCB
   --------------------------------
   Removed Checks:
   39128FBB540C098AE0530D98EB0AFB1A

   You cannot modify the profile name. You can only add to or remove check IDs form the profile.

   If the check IDs are in the profile, then Oracle Orachk and Oracle Exachk remove them from the profile.

   If the check IDs are not in the profile, then Oracle Orachk and Oracle Exachk add them to the profile.

3. To delete a profile:

   orachk -deleteprofile profile_name 
   

   exachk -deleteprofile profile_name

   orachk -deleteprofile customprofile1
   
   Deleting profile customprofile1...
   
   Profile customprofile1 deleted successfully...

   Oracle Orachk and Oracle Exachk delete the profile by removing the profile entry ID from the profiles.dat file, and deleting the corresponding profiles.prf file.

Oracle Autonomous Health Framework uses Adaptive Classification and Redaction (ACR) to sanitize sensitive data.

orachk -sanitize comma_delimited_list_of_collection_IDs

exachk -sanitize comma_delimited_list_of_collection_IDs

14A533F40 00000000 00000000 00000000 002C0000 [..............,.]
14A533F50 35360C02 30352E30 31322E37 380C3938 [..650.507.2189.8]
14A533F60 31203433 37203332 2C303133 360C0200 [34 123 7310,...6]

14A533F40 ******** ******** ******** ******** [****************]
14A533F50 ******** ******** ******** ******** [****************]
14A533F60 ******** ******** ******** ******** [****************]

col 74: [ 1] 80
col 75: [ 5] c4 0b 19 01 1f
col 76: [ 7] 78 77 06 16 0c 2f 26

col 74: [ 1] **
col 75: [ 5] ** ** ** ** **
col 76: [ 7] ** ** ** ** ** ** **

orachk -rmap all|comma_delimited_list_of_element_IDs

exachk -rmap all|comma_delimited_list_of_element_IDs

Starting in release 19.3, Oracle Orachk and Oracle Exachk have the capability to automatically fix problems when found.

orachk -showrepair check_id

exachk -showrepair check_id

orachk -repair all

orachk -repair check_id,[check_id,check_id...]

orachk -repair file

exachk -repair all

exachk -repair check_id,[check_id,check_id...]

exachk -repair file

• check_id: Refers to specific checks that you want to repair. Specify a check ID or a list of comma-delimited list of check IDs.
• file: A text file that contains a list of check IDs. Add one check ID per line.
  For example:

  
  check ID1
  check ID2
  check IDn

DBSAT is a lightweight utility that will not impair system performance in a measurable way.

Oracle Autonomous Health Framework always includes the latest DBSAT and runs DBSAT on all databases if you use the -security profile. For example, orachk -profile security.

ahfctl compliance -profile security

Figure 3-1 Oracle Database Security Assessment Report

Description of "Figure 3-1 Oracle Database Security Assessment Report"

For more information, see Oracle Database Security Assessment Report.

The AutoUpgrade utility identifies issues before upgrades, performs pre- and postupgrade actions, deploys upgrades, performs postupgrade actions, and starts the upgraded Oracle Database.

Before the upgrade, in Analyze mode, the AutoUpgrade utility performs read-only analysis of databases before upgrade, so that it can identify issues that require fixing.

When you run Oracle Orachk in pre-upgrade mode, Oracle Orachk in turn runs the AutoUpgrade utility to check if each database is ready to upgrade or not.

Figure 3-2 Database AutoUpgrade Result

Description of "Figure 3-2 Database AutoUpgrade Result"

For more information, see Using AutoUpgrade for Oracle Database Upgrades.