Oracle® Secure Enterprise Search

General Requirements for Installing Oracle Software

The following sections describe the general requirements for installing Oracle software:

• Logging In to the System as root

• Required Operating System Group and User

more /etc/oraInst.loc

inventory_loc=/u01/app/oracle/oraInventory
inst_group=oinstall

# /usr/sbin/groupadd oinstall

# id oracle

uid=440(oracle) gid=200(oinstall) groups=201(dba),202(oper)

# /usr/sbin/usermod -g oinstall -G dba oracle

Checking the Software Requirements

A Linux system must meet the following minimum software requirements, depending on your Linux distribution and version.

Red Hat Enterprise Linux ES/AS 3 (x86)

• The system must be running the following kernel version: 2.4.21 (or a later version)

• Gnu gcc package: gcc-3.2.3 or higher

• The following packages (or higher versions) must be also be installed:

  • glibc-2.3.2-95.20

  • make-3.79.1

  • binutils-2.14.90.0.4

  • openmotif-2.2.3-3

  • compat-db-4.0.14.5

  • compat-gcc-7.3-2.96.128

  • compat-gcc-c++-7.3-2.96.128

  • compat-libstdc++-7.3-2.96.128

  • compat-libstdc++-devel-7.3-2.96.128

  • setarch-1.3-1

Red Hat Enterprise Linux ES/AS 4 (x86)

• The system must be running the following kernel version: 2.6.9 (or a later version)

• Gnu gcc package: gcc-3.4.3-22.1 or higher

• The following packages (or higher versions) must be also be installed:

  • glibc-2.3.4-2.9

  • make-3.80

  • binutils-2.15.92.0.2

  • openmotif-2.2.3-9.RHEL4.1

  • compat-db-4.1.25-9

  • setarch-1.6-1

SUSE Linux Enterprise Server 9

• The system must be running the following kernel version: 2.6.5 (or a later version)

• Gnu gcc package: gcc-3.3.3-43.34 or higher

• The following packages (or higher versions) must be also be installed:

  • glibc-2.3.3-98.47

  • make-3.80-184.1

  • binutils-2.15.90.0.1.1-32.10

  • openmotif-2.2.2-519.4

To ensure that the system meets these requirements:

1. To determine which version of the operating system is installed, enter the following command:

   cat /etc/issue
    
   

2. To determine whether the required kernel is installed, enter the following command:

   uname -r
   
   

   On a Red Hat Enterprise Linux 3.0 system, the output may be as follows:

   2.4.21-27.EL
   
   

   In this example, the output shows the kernel version (2.4.21) and errata level (27.EL). Kernel updates are available from the Red Hat Network.

   On a Red Hat Enterprise Linux 4.0 system, the output may be as follows:

   2.6.9-11.EL
   
   

   On a SUSE Linux Enterprise Server 9 system, the output may be as follows:

   2.6.5-7.191
   
   

   In this example, the output shows the kernel version on the system. Contact SUSE for information about obtaining and installing the kernel updates.

3. To determine whether the required packages are installed, enter commands similar to the following:

   rpm -q package_name
   
   

   If a package is not installed, or if the version is lower than the required version, then install it from your Linux distribution media or download the required package from your Linux vendor's Web site.

Checking the Hardware Requirements

Oracle SES requires a minimum of 2 gigabytes of disk space. This includes 1 gigabyte to install and approximately .5 gigabyte to create the initial Oracle SES index. Additional Oracle SES requirements are based on the amount of data that you need to search. Here are some configuration examples:

To index 100,000 documents:

• 4 gigabytes disk space

• 1 gigabyte RAM

To index 1,000,000 documents:

• 20 gigabytes disk space

• 6 gigabytes RAM

For installation help, including pre-installation tips, see the Oracle SES tutorial:

http://st-curriculum.oracle.com/tutorial/SESAdminTutorial/index.htm

Configuring Kernel Parameters

Before starting the Oracle installation, verify that the parameters shown in the following table are set to values greater than or equal to the recommended value shown. The procedure following the table describes how to verify and set the values.

To view the current value specified for these kernel parameters, and to change them if necessary, follow these steps:

1. Enter commands similar to the following to view the current values of the kernel parameters:

   Note:

   Make a note of the current values and identify any values that you must change. The user must be root to run the commands for kernel parameters.

   Table 2 Commands for Kernel Parameters

   Parameter	Command
   semmsl, semmns, semopm, semmni	/sbin/sysctl -a | grep sem This command displays the value of the semaphore parameters in the order listed.
   shmall, shmmax, shmmni	/sbin/sysctl -a | grep shm
   file-max	/sbin/sysctl -a | grep file-max
   ip_local_port_range	/sbin/sysctl -a | grep ip_local_port_range This command displays a range of port numbers.

   
   

2. If the value of any kernel parameter is different than the recommended value, then complete the following steps:

   1. Using a text editor, create or edit the /etc/sysctl.conf file and add or edit lines similar to the following:

      Note:

      Include lines only for the kernel parameter values that you want to change. For the semaphore parameters (kernel.sem), you must specify all four values. However, if any of the current values are larger than the recommended value, then specify the larger value.

      kernel.shmall = 2097152
      kernel.shmmax = 2147483648 (that is, half the physical memory)
      kernel.shmmni = 4096
      kernel.sem = 250 32000 100 128
      fs.file-max = 65536
      net.ipv4.ip_local_port_range = 1024 65000
      
      

      By specifying the values in the /etc/sysctl.conf file, they persist when you reboot the system.

   2. Enter the following command to change the current values of the kernel parameters:

      /sbin/sysctl -p
      
      

      Review the output from this command to verify that the values are correct. If the values are incorrect, then edit the /etc/sysctl.conf file and enter this command again.

Setting Shell Limits for the oracle User

To improve the performance of the software on Linux systems, you must increase the following shell limits for the oracle user:

To increase the shell limits:

1. Add the following lines to the /etc/security/limits.conf file:

   *    soft    nproc   16384
   *    hard    nproc   16384
   *    soft    nofile  1024
   *    hard    nofile  65536
   
   

2. Add the following line to the /etc/pam.d/login file, if it does not already exist:

   session    required     /lib/security/pam_limits.so
   
   

3. Depending on the oracle user's default shell, make the following changes to the default shell start-up file:

   • For the Bourne, Bash, or Korn shell, add the following lines to the /etc/profile file:

     if [ $USER = "oracle" ]; then
             if [ $SHELL = "/bin/ksh" ]; then
                   ulimit -p 16384
                   ulimit -n 65536
             else
                   ulimit -u 16384 -n 65536
             fi
     fi
     
     

   • For the C or tcsh shell, add the following lines to the /etc/csh.login file:

     if ( $USER == "oracle" ) then
             limit maxproc 16384
             limit descriptors 65536
     endif
     
     

4. Reboot the system after setting shell limits.

   If it is not rebooted, then a pre-requisite check fails with the following error:

   =========================================================================
   Error:
   Checking Shell Limits ...
   Actual Result: Detected the following existing settings ...
   Failed >>    Limit on maximum number of processes for a single user: 7168
   Failed >>    Limit on maximum number of open file descriptors: 1024
   Check complete. The overall result of this check is: Failed <<<<
   Problem: The Installer has detected that the limits specified for the
   reported SHELL parameters do not match the recommended limits.
   Recommendation: The recommended values for the SHELL limits are: 
   <1> For tcsh, csh and zsh:
       a. maximum number of open file descriptors: 65536 
       b. maximum number of processes for a single user: 16384
   <2> For ksh, bash and sh: 
       a. maximum number of open file descriptors: 65536(hard); 1024(soft) 
       b. maximum number of processes for a single user: 16384(hard); 2047(soft)
   Refer to the documentation for instructions on setting the reported SHELL
   limits to the recommended values.
   =========================================================================
   

Installing on a Port Number Less Than 1024

Oracle SES must be installed by a non-root user. However, UNIX operating systems require that only root users can bind to ports less than 1024. Follow these steps to install Oracle SES on a port number less than 1024:

1. During installation, specify a port greater than or equal to 1024 (for example, 7777).

2. After the installation is complete, follow the instructions in the following section, "Changing the Oracle SES Middle Tier Port", to change to a port number less than 1024 (for example, 80).

Changing the Oracle SES Middle Tier Port

To change the Oracle SES middle tier port, follow these steps:

1. Shutdown the middle tier with the following command:

   $ORACLE_HOME/bin/searchctl stop
   
   

2. Edit the value for the port attribute in $ORACLE_HOME/oc4j/j2ee/OC4J_SEARCH/config/http-web-site.xml. (Make sure that the new port is not already in use.)

3. To change to a port less than 1024:

   1. Run chgrp -R root $ORACLE_HOME/jdk

   2. Log on as the root user and perform step 5.

4. To change from a port that was less than 1024 to a port that is greater than or equal to 1024:

   1. Log on as the root user.

   2. Run the following:

      chown -R <user> $ORACLE_HOME/oc4j/j2ee $ORACLE_HOME/search/opmn
      $ORACLE_HOME/persistence
      
      

      where <user> is the user that installed Oracle SES

   3. Log off from root user and log on as the user that installed Oracle SES.

5. Start the middle tier with the following command:

   $ORACLE_HOME/bin/searchctl start
   

Mounting the DVD-ROM

Follow these steps if your computer does not automount the DVD-ROM:

1. Insert the DVD-ROM.

2. Log on as the root user:

   su
   Password:
   
   

3. Create the DVD-ROM mount point directory:

   /usr/bin/mkdir /SD_DVDROM
   
   

4. Mount the DVD-ROM drive on the mount point directory:

   /usr/sbin/mount -F cdfs -o rr /dev/dvdrom /SD_DVDROM
   
   

   In the preceding example, /SD_DVDROM is the disc mount point directory and /dev/dvdrom is the device name for the disc device.

5. Log out from the root user.

   exit
   

Selecting a Response File

Before performing a silent installation, you must provide information specific to your installation in a response file. The installer will fail if you attempt an installation using a response file that is not configured correctly. Response files are text files that you can create or edit in a text editor.

The Oracle SES DVD provides the following templates for the Oracle Universal Installer response files:

Response files are located in the /response directory on Disk 1 of the Oracle SES DVD. You must edit the response file according to your requirements for silent installation.

To use a response file, first copy it from the DVD to your system. For example:

1. Go to the /response directory

2. Copy the server.rsp file to your system hard drive:

   # cp server.rsp /private/ses/response/server.rsp
   

Editing the Response File

Use any text editor to edit the response file to include information specific for your system. You must specify values for variables in your response file. Each variable listed in the response file is associated with a comment, which identifies the variable type. For example:

string = "Sample Value"
Boolean = True or False
Number = 1000
StringList = {"StringValue 1", "String Value 2"}

The values that are given as <Value Required> must be specified for silent installation. Remove the comment from the variable values in the response file before starting the Oracle SES installation.

Specifying a Response File and Starting the Installation

Before you specify a response file, ensure that all the values in the response file are correct. To make Oracle Universal Installer use the response file at installation time, specify the location of the response file as a parameter when starting Oracle Universal Installer. To perform a silent installation, use the -silent parameter:

# ./runInstaller -silent -responseFile absolute_path_and_filename

The success or failure of silent installations is logged in the installActions.log file. Additionally, the silent installation creates the silentInstall.log file. The log files are created in the $ORACLE_HOME/oraInventory/logs directory.

The silentInstall<Date_Time>.log file contains the following line if the installation was successful:

The installation of Oracle Secure Enterprise Search was successful.

The corresponding installActions<Date_Time>.log file contains specific information regarding installation.

Security Tips for Silent Installations

The response file contains the installation password in clear text. To minimize security issues, follow these guidelines:

• Set the permissions on the response files so that they are readable only by the operating system user performing the silent installation.

• If possible, remove the response files from the system after the silent installation is completed.

Error Handling

Values for variables that are of the wrong context, format, or type are treated as if no value were specified. Variables that are outside any section are ignored.

If you attempt a silent installation with an incorrect or incomplete response file, or if Oracle Universal Installer encounters an error, such as insufficient disk space, the installation fails.

Certifications and Patches

The Oracle SES administration tool and default query application are certified on the following browsers:

• Firefox 1.0, 1.0.1, 1.0.6, 1.0.7, 1.5

• Internet Explorer 6.0

• Netscape 7.1, 7.2

• Mozilla 1.7.3

The requirements and certifications included in this installation guide were current at the time this guide was published. See the certification matrix on the OracleMetalink Web site for the most up-to-date information.

Backing Up the Oracle SES 10.1.6 Instance

There is no downgrade support from 10.1.8. Before upgrading, first shutdown Oracle SES, then back up the 10.1.6 ORACLE_HOME directory, the oradata directory, and the entire oraInventory directory to a different location. (The oraInventory directory is a central inventory of all Oracle homes. Its location is specified in /etc/oraInst.loc.)

For example:

$ORACLE_HOME/bin/searchctl stopall
cd ~
msu password
tar cvf ses.tar {$ORACLE_HOME} 
tar cvf ses.tar {oraInventory} 
tar cvf ses.tar {oradata}

If the upgrade should fail, then restore your 10.1.6 instance by cleaning up the ORACLE_HOME, oradata, and oraInventory directories and using the tar command to copy them back to the same location. For example:

tar xvf ses.tar {$ORACLE_HOME} 
tar xvf ses.tar {oraInventory} 
tar xvf ses.tar {oradata}

After your 10.1.6 environment is back, you can retry the 10.1.8 upgrade.

Upgrading on a Port Number Less than 1024

If the 10.1.6 installation is bound to a port number less than 1024, then first change the Oracle SES middle tier port to a port number greater than 1024. After the upgrade completes, you can change the Oracle SES middle tier port back to a port number less than 1024.

Moving QTA Jar Files

For any custom query-time authorization (QTA) jar files in the 10.1.6 Oracle home directory, manually move them into the new Oracle home directory or into an entirely new location. Also, for any sources that used these QTA jar files, update the location in the Jar File Name field on the Home - Sources - Authorization page. This protects you from inadvertently deleting these jar files if you remove the old Oracle home directory after the upgrade process.

Migrating Federated Sources

To migrate federated sources in the 10.1.6 installation, you must edit each federated source in the 10.1.8 installation. On the Home - Sources - Customize Federated Source page, enter the Web services URL for the source.

After editing the source, you can have public federated search on the remote Oracle SES instances. For secure federated search, see the section "Setting Up Secure Federated Search" in the Oracle Secure Enterprise Search Administrator's Guide. If the remote Oracle SES instances are using the 10.1.6 installation, then they also need to be upgraded to 10.1.8 for secure federated search to work.

Migrating Single Sign-On Configuration

If the 10.1.6 Oracle SES instance had been configured to use a single sign-on URL to access the Oracle SES search page and administration tool, then do the following to migrate the configuration to 10.1.8:

1. Edit the $ORACLE_HOME/oc4j/j2ee/OC4J_SEARCH/config/http-web-site.xml file. In the element web-site, change the attribute protocol from "http" to "ajp13":

   <web-site ... protocol="ajp13" ... >
   
   

2. Restart the Oracle SES middle tier using searchctl restart.

3. Configure mod_osso to protect the search with SSO. Add the following lines to $AS_HOME/Apache/Apache/conf/mod_osso.conf within the IfModule element:

   <Location /search/query/formlogin.uix>
     require valid-user
     AuthType Basic
   </Location>
   
   

4. Restart Oracle HTTP Server. On the OracleAS middle tier host, run the following command:

   $AS/opmn/bin/opmnctl restartproc process-type=HTTP_Server
    
   opmnctl: restarting opmn managed processes...
   

Changes in 10.1.8

• If 10.1.6 was connected to Oracle Internet Directory, then after upgrade, you may see "orclApplicationCommonName=oesEntity_ ... " in the user name on the Global Settings - Identity Management Setup page. This user was created implicitly by Oracle SES 10.1.6 when the instance connected to Oracle Internet Directory, and it was used internally for Oracle Internet Directory authentication and authorization. After upgrade, 10.1.8 continues to use the user for Oracle Internet Directory authentication and authorization.

• In 10.1.6, the jar files for custom crawler plug-ins were located in the $ORACLE_HOME/search/lib/agent directory. This directory does not exist in 10.1.8. These jar files from 10.1.6 were migrated to the $ORACLE_HOME/search/lib/plugins directory.