Patching and Configuration Management

One of the things that I have been talking about this year at various user groups and in peer discussions are bad practices that we, as database administrators, developers or managers of Oracle teams can find ourselves engaged in. If you are a member of the UKOUG you can get a copy of the presentation here

One of the things on my list is an absence of an up to date and accurate configuration management database - something that Doug referred to as a database catalog back in January. That copy of the presentation talks about the need to know things like versions, passwords, system owners etc from a day to day management and maintenance perspective. I hadn't explicitly mentioned patching since this is a straight DBA type presentation.

However I now have yet another reason to add to the list, one that specifically applies to EBS people, but probably applies to all 3rd party applications that run on a database (I'm treating E-Business Suite as a 3rd party app in the sense that we buy it and don't have any control over its development). One of our projects this year is to deploy Oracle's iRecruitment product externally enabling people to apply for jobs with us over the net and for the recruitment process to be handled by our in-house recruitment team. Somewhat unsurprisingly I have insisted that we therefore deploy Oracle's Critical Patch Updates. This is something that we haven't done historically. There's therefore a rather large catch up exercise to be done. I will be documenting that as we go through. A quick look at each of the Critical Patch Updates (Metalink Note 420055.1 covers April 2007 for example) shows that we need to have recorded not only major versions, but which servers run which versions of which services and so might be affected by different vulnerabilities. As this is the sort of information that hasn't historically been recorded in any central location (and we have a lot of patches to catch up on) there is a large documentation task to be done before we even start testing.

Meanwhile, and just in the nick of time, Howard Rogers over at dizwell.com has released a GPL'd drupal website for doing exactly this. It comes in the form of a VMware VM and is downloadable here