Raastech 2013 MOUS OFMW Infrastructure.v2-1

Arun ReddyTechnical DirectorRaastech

Oracle Fusion MiddlewareInfrastructure Best Practices

Schoolcraft College – Vistatech CenterRoom Vt460

November 13, 20132:05pm – 2:50pm

© Raastech, Inc. 2013 | All rights reserved. Slide 2 of 57raastech.com

About Raastech

Systems integrator founded in 2009

Headquartered in the Washington DC area

Specializes in Oracle Fusion Middleware

Oracle Gold Partner & Reseller

Oracle SOA Specialized

Certified staff in multiple disciplines

OCE, OCA, OCP, ITIL, CISSP, PMP, etc.

Continued contributions to the technology community

Sponsor and volunteer of numerous users groups

Ongoing publishing of books, articles, whitepapers, and blogs

Regular presenters at major conferences


About Arun

14+ years of Infrastructure Administration

Focus on Oracle Fusion Middleware infrastructure

implementation, Security, High Availability, and

Disaster Recovery

OCA, ITIL, PMP Certified

Active WMOUG member/presenter


What is this presentation about?

For Oracle Fusion Middleware administrators

Covers common infrastructure best practices for:

Installations

Patching

Administration

Deployments

Security


Why do I need it?

I want to Reduce the OWFM Infrastructure Maintenance because I’m

tired of opening change requests/change controls

To know what I can do different for my OWFM Infrastructure to make it

more stable and highly available

Is there anything that I’m not doing right with my installations, patching

or deployment?

I don’t want my phone to ring when I’m watching Lions game or

Breaking Bad

“I think the presenter is cool.” My n


Overview


Understanding Oracle Fusion Middleware

“Oracle Fusion Middleware” is a misleading term

Used to describe middleware products such as:

Business Intelligence (e.g., OBIEE, Discoverer)

Integration (e.g., SOA Suite, OSB)

Identity Management (e.g., Oracle Access Manager)

Monitoring (e.g., OEM Grid Control)

But usually used to describe a single product:

WebLogic Server


WebLogic Server: Foundation for Fusion Middleware

WebLogic Server is the core foundation of all Oracle

Fusion Middleware products

OEM Grid

ControlOBIEE

Access

ManagerSOA Suite

WebCenter

Portal

Data

Integrator

Oracle WebLogic Server

Clustering – JNDI – Resource Adapters – JDBC – Security – Self Tuning


Oracle WebLogic Server

At a glance:

Java application server

Acquired from BEA

Replaces Oracle Application Server 9i/10g

Required for almost all Oracle Fusion Middleware products

Current releases:

Oracle WebLogic Server 11g (10.3.6)

Oracle WebLogic Server 12c (12.1.2)

Majority of OFM products are not yet

available for 12c


WebLogic Server Architectural Considerations

Typically fronted by WebTier/OHS/Apache

Requires JDK (Sun JDK, JRockit, or new JDK7)

Requires shared filesystem for cluster (in 11g) for tlogs

WebLogic Server WebLogic Server WebLogic Server

Shared File System

WebTier WebTier WebTier

Single AdminServerto administer entire

cluster Node Manager runs on every

server

Hardware load balancer


WebLogic Server 12c New Features

Certified with JDK7

Zip distribution is only 164 MB

Supports Java EE 6

T-Logs can now be database persisted(no shared file system needed)

Improved high availability, performance, and disaster recovery

200+ new features


Installations


Separation of Binaries and Config

Separate binaries in the Fusion Middleware Home and

Configuration directories

The binaries include the Oracle WebLogic Home, Oracle JDK,

Coherence binaries and any required Fusion Middleware

binaries (Files/Directories are mostly read)

The Configuration directories include all Domain homes,

application files and nodemanager configuration

(Files/Directories are both read and written at runtime)


Operating System Tuning Parameters

Proper OS tuning improves system performance by

preventing the occurrence of error conditions.

Below are some key parameters to considerO/S Parameters Default Proposed

Linux tcp_fin_timeoutBy reducing the value , TCP/IP releases closed connections faster, providing more resources for new connections.

60 30

Linux Backlog connections queue (tcp_max_syn_backlog) When the server is loaded or has many clients with bad connections, it can result in an increase in half-open connections

1024 4096

Linux File Descriptors (open files) 1024 4096(32bit)

WIN2008 MaxUserPortUnder heavy loads it may be necessary to adjust the MaxUserPort. This parameter determines the availability of user ports requested by application

16383 65532

WIN2008 Set the power option setting to "High performance”With High Performance power scheme, processors are always locked at the highest performance state

Balanced High Performance


Deployments


Custom Application Deployments

Deploy Custom Application deployments on a shared storage

Applications are deployed as EAR files to servers or read as exploded directories. Place the archives in a shared directory such as $ORACLE_BASE/admin/shared/deploy

In a shared services environment, applications should all be deployed as NOSTAGE

Admin server default is STAGE

Managed server default is NOSTAGE

In NOSTAGE, the application files reside in a location from which all cluster members can initiate a deployment


Backups


Environment Backup – how often do we need it?

The following lists some of the common scenarios in a typical deployment that require performing a backup

After WLS is installed and a domain is created

Before and after making configuration changes to a component or cluster

Prior to deploying a custom pure Java EE application

After any major architectural changes to deployment architecture

Before and after product binary files are patched or upgraded

Important - Backup Embedded LDAP (Set it up through console)

Scheduled backups on a nightly basis or as needed, or both


Configuration File Backup


Configuration File Backup (contd)


Administration


BAU activities

Starting and stopping a managed server

Don’t use both command line and console for an operation. Use

one or the other for the console to reflect accurate server state

For production environments, use WLST scripts for

deployments


Security


Security Best Practices

Control Access to OFMW Resources

Create a separate OS user for OFMW and limit access to $MW_HOME

Avoid running the server under a privileged account

If OHS needs to run on port 80, use sudo privileges to start

Enable security auditing

Use connection filters

Security roles and security policies protects WebLogic resources at the domain, application, and the application-component level. Connection filters let you deny access at the network level.

Prevent Denial of Service attacks

Configure “Message Timeout” less than default 60 seconds

Restrict the size of the message (default is 10MB)

Limit the maximum open sockets (if necessary)


Console and EM Access through LB (Ex. F5 BIG IP)

Create a filtering iRule on the BIG IP Load Balancer to disallow access to WL Console and EM. If you are using any other Load balancer devices, create a custom ACL accordingly.

For example, to create the filtering iRule

On the Main tab, expand Local Traffic, then click iRules. The iRule screen open

In the upper right portion of the screen, click the Create button. The new iRulescreen opens

In the Name box, enter a name for your iRule. Ex: we can use oracle-soa-filter.

In the Definition section, copy and paste the following iRule:

when HTTP_REQUEST {

if { [HTTP::uri] starts_with "/console" } { HTTP::respond 403 content "<html><body><b>HTTP Error 403 - Forbidden</b></body></html>” }

if { [HTTP::uri] starts_with "/em" } { HTTP::respond 403 content "<html><body><b>HTTP Error 403 - Forbidden</b></body></html>” }

}


Summary


New Environment Checklist

Area Description

Logging Enable log rotation

Scripting Develop startup/shutdown scripts

Deployments Develop deployment scripts

Automation Script configuration and resource creation using WLST

Tuning Document core performance tuning areas

Backup Schedule backups


Summary

xxx


Q/A


Contact Information

Arun Reddy

Technical Director

[email protected]

Raastech 2013 MOUS OFMW Infrastructure.v2-1

Documents