FlashGrid Server (non-clustered) on AWS. Deployment Guide – FlashGrid Help Center

rev. 26.05

1 Overview
    1.1 Key Benefits
    1.2 Key Components
    1.3 Infrastructure-as-Code Deployment
2 Prerequisites
    2.1 Required Knowledge
    2.2 Getting access to FlashGrid Server AMI from AWS Marketplace
    2.3 Uploading Oracle installation files to S3
    2.4 Preparing the VPC
3 Deploying FlashGrid Server
4 After Deploying
    4.1 Verifying an Instance Status
    4.2 OS User Accounts
    4.3 Finalizing Software Configuration
    4.4 Enabling Termination Protection
    4.5 Installing an Additional Database Home
    4.6 Use of Anti-virus and Other Third-party Software
    4.7 Use of Automatic Configuration Tools
    4.8 Security Hardening
    4.9 Convert RHEL PAYG to BYOS License
5 Monitoring Instance Health
6 Before Going Live
7 Deleting an Instance
8 Additional Documentation
9 Technical Support

1 Overview

FlashGrid Server is an engineered cloud system that helps you achieve reliable Oracle Database operation and maximum uptime on AWS EC2 instances.

1.1 Key Benefits

Key benefits of using FlashGrid Server for running Oracle Database on AWS EC2 instances:

Automated and repeatable Infrastructure-as-Code deployment with the help of the FlashGrid Launcher tool.
Operating system optimized in accordance with proven best practices for running Oracle Database.
Extensive validation for compatibility and reliable operation between the EC2 instances, the OS, and the Oracle Database, including OS updates and Oracle patches.
Monitoring, logging, and diagnostics tools that help prevent and analyze reliability issues.
24x7 support for the entire infrastructure stack provided by engineers with AWS cloud, Linux OS, and Oracle Database expertise.

1.2 Key Components

Key components of FlashGrid Server on AWS:

FlashGrid Storage Fabric software
FlashGrid Diagnostics software
FlashGrid Health Checker software
Oracle Database: 26ai or 19c
Oracle Grid Infrastructure: 26ai or 19c
Operating Systems:
- Oracle Linux: 8 (UEKR7) or 9 (UEKR7)
- Red Hat Enterprise Linux (RHEL): 8 or 9
Note: Contact FlashGrid support if a new deployment with RHEL 7 or Oracle Linux 7 is required.
Amazon EC2 instances:
- General purpose: M8i, M8a, M8azn, M7i, M7a, M6i, M6in, M6a
- Memory optimized: R8i, R8a, R7i, R7iz, R7a, R6i, R6in, R6a, R5b, High Memory, X8i, X8aedz, X2idn, X2iedn, X2iezn, Z1d
Disks: EBS GP3 volumes, EBS GP2 volumes (AWS Outposts only)

1.3 Infrastructure-as-Code Deployment

FlashGrid Server is delivered as an AWS CloudFormation or Terraform template that automates the configuration of multiple components required for a database. FlashGrid Launcher is an online tool that simplifies the deployment process by guiding through the system configuration parameters and generating CloudFormation or Terraform templates.

2 Prerequisites

2.1 Required Knowledge

Working knowledge of the following AWS services is required for successful deployment of FlashGrid Server on AWS: EC2, VPC, EBS, CloudFormation, S3, IAM, Marketplace.

2.2 Getting access to FlashGrid Server AMI from AWS Marketplace

To be able to create an instance, your AWS account must have an active subscription to the selected FlashGrid AMI. Otherwise deployment will fail when creating EC2 instances. The FlashGrid AMIs are based on either Oracle Linux or RHEL.

To get access to the FlashGrid AMI

Open FlashGrid product page in AWS Marketplace

Commercial and GovCloud regions:
European Sovereign Cloud (credentials required to view products):
Click View Purchase Options button
Click Accept Terms button

Software fees charged through AWS Marketplace include FlashGrid software license and 24x7 Mission-Critical support plan. The fees are charged by the hour per instance and depend on the selected EC2 instance type and size. Pricing information is available on the AWS Marketplace product pages – see the links above.

2.3 Uploading Oracle installation files to S3

During instance initialization Oracle installation files will be downloaded from an S3 bucket. The list of files that must be placed in the S3 bucket will be shown by the FlashGrid Launcher tool. The same S3 bucket can be used for deploying multiple instances.

Please refer to this Knowledge Base article for the steps to upload Oracle installation files to S3.

2.4 Preparing the VPC

When creating a new instance, you have two options:

Automatically create a new VPC.

This option is usually used for test systems isolated in their own sandbox VPCs. A VPC will be created together with the required subnet and security groups. By default, the VPC will be created with CIDR 10.100.0.0/16
Create the instance in an existing VPC.

This option is used for majority of production deployments where other systems (e.g. app servers) share the same VPC as the instance. You will need to provide the VPC ID in the FlashGrid Launcher tool and subnet ID and security group IDs in the CloudFormation Manager.

If using an existing VPC then make sure that the following pre-requisites are met before creating an instance:

The VPC may have any CIDR that does not overlap with 192.168.0.0/16, for example 10.100.0.0/16. If you have to use VPC with CIDR that overlaps with 192.168.0.0/16 then please request a customized configuration file from FlashGrid technical support.
The VPC has a subnet in the availability zone used for the instance.
The VPC has an S3 endpoint configured (required unless public IPs can be enabled for access to S3)
If you choose to enable Public IPs on the EC2 instance, then the VPC must have Internet Gateway configured.
The VPC has a security group with the following ports open for inbound traffic:
- TCP port 22 for SSH access to the instance
- TCP port 5901 if you choose to use VNC for creating a database using DBCA in GUI mode
- TCP port 1521 for database client and application server access

3 Deploying FlashGrid Server

The FlashGrid Launcher tool simplifies instance deployment in AWS by automating the following tasks:

Creating and configuring EC2 VPC, subnet, security group (optional)
Creating EBS volumes and launching an EC2 instance
Installing and configuring FlashGrid software
Installing and patching Oracle Grid Infrastructure software
Configuring Grid Infrastructure
Installing and patching Oracle Database software
Creating ASM disk groups

To create an instance with CloudFormation

Log in to AWS Management Console with a user account that has the following privileges:
- AWSCloudFormationFullAccess
- AmazonEC2FullAccess
- AmazonVPCFullAccess (required only if creating a new VPC)
Open FlashGrid Launcher tool:
- Start with one of the standard configurations at https://www.flashgrid.io/products/flashgrid-for-oracle-db-on-aws/
- or, if you have a custom configuration file, upload it at https://latest.cloudprov.flashgrid.io
Configure parameters for the deployment
Click Validate Configuration button
If verification passes then click Launch button, which will take you to AWS CloudFormation Manager
Click Next
Select your SSH key
If using an existing VPC, then select subnet and security group.
Click Next
On the Options page:
- If you added tags in FlashGrid Launcher then do not add the same tags in CloudFormation Manager
- If the instance is for production use then expand the Advanced options and enable Termination Protection
Click Next
Click Create
Wait until the status of the stack changes to CREATE_COMPLETE
If creating the stack fails:
1. Check for the cause of the failure on the Events tab
2. Correct the cause of the error
3. Delete the failed stack
4. Repeat the steps for creating a new stack
Use EC2 Management Console to get IP addresses of the instance
SSH to the instance as user cloud-admin
The welcome message will show the current software initialization status: in progress, failed, or completed.
If software initialization is still in progress then wait for it to complete. You will receive a broadcast message when software initialization completes or fails. Software initialization takes approximately 30 minutes, this includes Oracle software installation and configuration.

Note: for deploying FlashGrid Server with SELinux please refer to the following Knowledge Base article: How to configure SELinux mode during system deployment

4 After Deploying

4.1 Verifying an Instance Status

On an instance run flashgrid-health-check command to verify that the instance status is Good and all checks are passing.

[fg@myhostname ~]$ flashgrid-health-check

HealthCheck 20.9.1.57074 #7226b34d571618368a70c9af809e5f150f8c67ba
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Check: ASM DiskGroup status
    myhostname: OK
      --------------------------------------------------------------------------------------------------------
      GroupName  Status  Mounted   Type    TotalMiB  FreeMiB  OfflineDisks  LostDisks  Resync  ReadLocal  Vote
      --------------------------------------------------------------------------------------------------------
      DATA       Good    AllNodes  EXTERN  6144      6028     0             0          No      Enabled    N/A
      FRA        Good    AllNodes  EXTERN  6144      6040     0             0          No      Enabled    N/A
      GRID       Good    AllNodes  EXTERN  5120      5020     0             0          No      Disabled   N/A
      --------------------------------------------------------------------------------------------------------

Check: Alerts in Storage Fabric logs in the last 7 days
      myhostname: OK

Check: Available memory
      myhostname: OK : avail mem: 27.7%

Check: Check db memory settings
      myhostname: OK

Check: Check local_listener for each db
      myhostname: OK

Check: Check tnsnames.ora
      myhostname: OK

Check: Flashgrid CLAN check
      myhostname: OK

Check: Free system disk space
      myhostname: OK : /u01: avail 66%, /: avail 90%

Check: Kernel taint check
      myhostname: OK

Check: SF node status
      myhostname: OK

Check: Swap disabled
      myhostname: OK : Swap disabled

Check: System config file modifications
      myhostname: OK

Check: System services
      myhostname: OK

Check: Unexpected or 3rd party RPMs installed
      myhostname: OK

Check: Unexpected or 3rd party services enabled
      myhostname: OK

4.2 OS User Accounts

During software initialization the following OS user accounts are created:

cloud-admin - the user account used to SSH to the EC2 instance with the SSH key that was selected when creating the instance configuration. The user has sudo rights.
fg – can be used for running FlashGrid Storage Fabric or FlashGrid Cloud Area Network utilities. The user fg has sudo rights.
grid - Grid Infrastructure owner. GI environment variables are preconfigured.
oracle - Database home owner. Database environment variables, except ORACLE_SID and ORACLE_UNQNAME, are preconfigured. After creating a database you can configure ORACLE_SID and ORACLE_UNQNAME by editing /home/oracle/.bashrc file on an instance.

Note that no passwords are configured for any users. Also password-based SSH authentication is disabled in /etc/ssh/sshd_config. Key-based authentication is recommended for better security. Creating passwords for any user is not recommended.

Users cloud-admin and fg have sudo rights and allow switching to any other user without requiring a password (which is not configured by default). Example:

sudo su - grid

4.3 Finalizing Software Configuration

See the Knowledge Base article Creating a Database for instructions.

Note: ACFS support on RHEL may require an additional Oracle Clusterware patch. Please refer to Oracle KB129209 for ACFS patch information.

4.4 Enabling Termination Protection

If termination protection was not enabled when creating the instance and if the instance is for production use then it is strongly recommended to enable termination protection:

Enable instance termination protection
Enable termination protection for the CloudFormation stack

4.5 Installing an Additional Database Home

In most cases manual installation of database software is not required. However, if you need an additional software then follow Oracle Database documentation for installing the database software.

4.6 Use of Anti-virus and Other Third-party Software

If anti-virus software must be used, then it is recommended to configure it in a way that avoids putting any files in quarantine. Automatic quarantine of files creates risk of the system downtime in case of a false positive detection on a critical system file on an EC2 instance.

Any proprietary kernel modules installed by third-party software create risks to reliable operation of the system. Such proprietary kernel modules are not tested or supported by FlashGrid, Red Hat, or Oracle Linux. Proprietary kernel modules may consume kernel resources and may create instability, especially under high load. Symptoms may include kernel crashes, network disruptions, storage i/o disruptions, and server brown-out. If such reliability issue is encountered and no other root cause can be readily identified, FlashGrid support reserves the right to request removal of all proprietary kernel modules before continuing investigation.

4.7 Use of Automatic Configuration Tools

Automatic configuration tools (e.g. Ansible, Salt, etc.) must be used with extra care. Incorrect modification of a critical system file (e.g. /etc/resolv.conf) may cause system downtime. Note that many critical system configuration files are protected with immutable attribute and have warnings in them. Do not remove the immutable attribute or allow automatic modification of such files unless absolutely necessary.

4.8 Security Hardening

The system is deployed using RHEL or Oracle Linux images that have main security best practices implemented by default. The following steps are recommended, in case additional security hardening is required:

For applying a different hardening profile, the following steps are recommended:

Request FlashGrid support to review the list of required changes
Back up an instance
Implement the required changes
Restart the instance
Verify health of the instance as user fg:
```
flashgrid-health-check
```
In case of errors, roll back the changes or restore the instance from backup

4.9 Convert RHEL PAYG to BYOS License

If RHEL is used, the EC2 instance is provisioned with a RHEL PAYG license attached. To adopt BYOS, the RHEL license must be converted as per the procedure documented by AWS, following server deployment.

5 Monitoring Instance Health

The following methods of monitoring system health are available:

flashgrid-health-check utility checks multiple items including database configuration, storage, OS kernel, config file modifications, errors in the logs, and other items that may affect health of the system or could help with troubleshooting. It is recommended for manual checks only.
FlashGrid Node Monitor service is part of the flashgrid-diags package. It provides monitoring of various system health indicators, including CPU utilization, available memory, and clocks.
Alerts about failures are recorded in system log and can be analyzed by 3rd-party tools.
Email alerts can be configured in FlashGrid Launcher and sent to one or several email addresses. See the Knowledge Base article Configuring email for FlashGrid notifications.
FlashGrid Node Monitor can send alerts and diagnostic uploads via HTTP/HTTPS to a remote endpoint, with support for routing through an HTTP proxy. Node Monitor detects a condition, then sends either an email alert and/or an HTTP/REST request to a monitoring/alerting service.
ASM disk group monitoring and alerting via Oracle Enterprise Manager.

6 Before Going Live

Before switching the instance to live use (run commands as user fg):

Confirm that only minimally required access to the server is allowed in network security settings, and remove any unnecessary access
Verify health of the instance: flashgrid-health-check
Confirm that email alerts are configured and delivered: flashgrid-node test-alerts
Upload diags to FlashGrid support: flashgrid-diags upload-all
Stop the instance and back it up
Start the instance and do final check of the instance health: flashgrid-health-check

7 Deleting an Instance

To delete an instance

Disable instance termination protection if it was enabled
Open AWS CloudFormation Manager console
Disable termination protection for the corresponding CloudFormation stack if it was enabled
Delete the stack corresponding to the instance
If any EBS volumes were added after deploying the instance, those volumes must be deleted separately
If any AMI images or volume snapshots were created after deploying the instance, those AMIs and snapshots must be deleted separately

8 Additional Documentation

FlashGrid Server on AWS Knowledge Base

FlashGrid Server (non-clustered) on AWS. Backup Best Practices

FlashGrid Storage Fabric CLI Reference Guide

FlashGrid Cloud Area Network CLI Reference Guide

9 Technical Support

For technical help with FlashGrid Server please open a support request.

To expedite troubleshooting please also collect and upload diagnostic data to the secure storage used by FlashGrid support by running the following command as user fg:

flashgrid-diags upload-all

For reporting emergency type of issues that require immediate attention please also use the 24/7 telephone hotline: +1-650-641-2421 ext 7. Please note that use of the 24/7 hotline is reserved for emergency situations only.

Support Tiers and SLA details document: FlashGrid Technical Support Services.

Table of Contents