Oracle Audit – Finding the products with limited tools

Whether it’s an Oracle audit, license review or database consolidation one of the tasks in the early stage of your project is to prepare your list of targets (servers) which will need to be checked.  This stage in the SAM process is often referred to as Discovery and defines the scope of your search.  How you arrive at this list of servers is important as you’ll need to share your approach with Oracle LMS and convince them that all servers running Oracle products have been found and checked.

If you have a Software Asset Management (SAM) tool and you are confident all servers are accounted for then all you have to do is run off a server and Virtual host report and move on to the next stage, Inventory. 

Where you don’t have a SAM tool that covers Oracle or there are potential gaps then you need to use one or more sources of data to build up your server target list.  If the list of servers is relatively short and you have the time and resources you now carry out an inventory of every server, running the Review Lite and CPU Scripts provided by Oracle LMS.

Oracle Focused Server List

To generate an Oracle Focused Server list you need to merge data from certain data sources that may be available in your organisation. By reconciling two or more of these sources you will come up with an servers list that is focused on Oracle and which Oracle LMS will accept.  It will also significantly reduce the effort your team will have to make to collect data.

The sources, in order of precedence are:

• Port Scan (ports Oracle product listening on)
• Oracle Server Worksheet (OSW) sent to Oracle in the past.
• Oracle Enterprise Manager (OEM) or Oracle GRID Controller>
• Server lists from virtual controls (vCentre, HMC, OVM, etc)
• Backup Logs (backup tools can be DB aware)
• Credential management systems including DBA spreadsheets
• Security Scanning Tools (may include port scans)
• Server Naming Conventions (SRVDB1001)
• CMDB or Service Desk tools (e.g. ServiceNow)
• MS SCCM (desktop products only)
• MS MAP Windows Servers with Oracle products installed
• Patch management tool reports (BladeLogic, Puppet, etc.)
• Previous database upgrade or transition projects

(if you can think of other sources please add to comments below)

It is worth noting that Oracle provide port scanning within their Oracle Measurement Tool (OMT).  This can be used to carry out the port scan mentioned but it will still need to be reconciled against other sources to ensure there are no gaps or surprises later.  This post describes how to run Oracle Measurement Tool.

Narrowing the list further

To be 100% sure you should check every server that appears on your list.  If you are still short on time or resources simply narrow the list to servers that appear on more than one list or that have a “last seen” date less than 90 days.  Your team will also have higher confidence in particular lists so that should get priority.  Now you should have a valid, shorter, defensible list to start an inventory from.

Still need more help

If your team are still under time pressure we at Suredatum can quickly produce your server list for you.  As we specialise in preparing clients for Oracle audits we have developed technology to automate this stage in the process.

What next?

Once you have your Oracle focused list of servers and their hosts you need to plan your Inventory.  If using inventory tools is not an option, for whatever reason, you will need to run the Oracle Review LITE and CPU scripts on each of your servers to produce an Inventory and to fill in your Oracle Server Worksheet.Because running scripts is a manual, time consuming process and will need support of several teams you need to plan out the next stage with care.  There are a number of techniques that can help you speed up this process and reduce your risk but that’s for another post.