FlexNet Manager Suite can falsely recognize Oracle applications due to remaining Oracle Universal Installer (OUI) evidence reported to the FlexNet inventory agent. This article describes how FlexNet inventory agent gathers Oracle evidence and how you can locate OUI evidence to review potentially outdated files.
OUI tracks details of installed Oracle software components using files named oraInst.loc, inventory.xml, and comps.xml.
The /etc/oraInst.loc file contains an inventory_loc entry.
Under the inventory_loc path will be a ContentsXML/inventory.xml file (in this example, "/u/oracle/app/oraInventory/ContentsXML/inventory.xml").
Example
inventory_loc=/u/oracle/app/oraInventory
inst_group=oinstall
The inventory.xml file provides HOME elements that contain a LOC attribute.
Each home directory includes an inventory/ContentsXML/comps.xml file (in this example, "/u/oracle/app/oracle/product/11.2.0/dbhome_1/inventory/ContentsXML/comps.xml").
Example
<HOME_LIST>
<HOME NAME="OraDb11g_home1" LOC="/u/oracle/app/oracle/product/11.2.0/dbhome_1" TYPE="O" IDX="1"/>
</HOME_LIST>
The comps.xml file contains the installer evidence extracted by the inventory agent.
For each COMP element, the following properties are used:
Example
<COMP NAME="oracle.server" VER="11.2.0.1.0" BUILD_NUMBER="0" REP_VER="0.0.0.0.0" RELEASE="Production" INV_LOC="Components/oracle.server/11.2.0.1.0/1/" LANGS="en" XML_INV_LOC="Components21/oracle.server/11.2.0.1.0/" ACT_INST_VER="11.2.0.1.0" DEINST_VER="11.2.0.0.0" INSTALL_TIME="2011.Jun.02 20:39:31 EST" INST_LOC="/u/oracle/app/oracle/product/11.2.0/dbhome_1/oracle.server">
<EXT_NAME>Oracle Database 11g</EXT_NAME>
<DESC>Installs an optional preconfigured starter database, product options, management tools, networking services, utilities, and basic client software for an Oracle Database server. This option also supports Automatic Storage Management database configuration.</DESC>
<DESCID>COMPONENT_DESC</DESCID>
<STG_INFO OSP_VER="10.2.0.0.0"/>
</COMP>
Package details in an inventory .ndi file generated from the above example would look like the below example.
Example
<Package Name="Oracle Database 11g" Evidence="OUI" Version="11.2.0.1.0" InstallDate="20110602T203931">
<Property Name="InstallLocation" Value="/u/oracle/app/oracle/product/11.2.0/dbhome_1/oracle.server"/>
<Property Name="Publisher" Value="Oracle Corporation"/>
</Package>
Sometimes comps.xml files are not updated by OUI when Oracle applications are uninstalled. When this occurs, it results in the FlexNet inventory agent recognizing installations of Oracle applications based on the evidence files, even if other files associated with the installation are no longer on the computer.
Note: Oracle Universal Installer often (but not always) adds another directory name that does not exist to the end of the path specified by the INST_LOC attribute in comps.xml files. For this reason, the last name in the INST_LOC path is ignored when perform the directory existence check.
For example: a comps.xml file will commonly include details like the following for an installation of the oracle.server package in the path /u/oracle/app/oracle/product/11.2.0/dbhome_1:
<COMP NAME="oracle.server" [...] INST_LOC="/u/oracle/app/oracle/product/11.2.0/dbhome_1/oracle.server">
The "oracle.server" name at the end of the path is ignored, so the package is considered installed and evidence returned in gathered inventory as long as the /u/oracle/app/oracle/product/11.2.0/dbhome_1 directory exists on the filesystem.
OUI evidence often identifies that Oracle applications are installed but won’t identify the edition. Precedence rules are configured in the FlexNet inventory agent’s application recognition library (ARL) to avoid recognizing installations of Oracle applications without specified editions. ARL will use more specific evidence that enables recognition of the edition when available (for example, based on Oracle Database inventory gathered rather than OUI evidence).
Recognition rules for Oracle Database options are generally not configured to match OUI evidence.
OUI evidence is often an unreliable indicator of what is currently installed on computers. As installations change, OUI files on computers are often not updated accordingly. Avoiding using OUI evidence for recognition helps to minimize false positives that arise from using OUI evidence to recognize installations.
Related: See the following post for more information about how OUI evidence for Oracle Database options is handled by FlexNet Manager Suite: Content Change Notification: Changes in the use of Oracle Universal Installer (OUI) evidences for recognition.
If the FlexNet inventory agent is configured to scan the file system, it will discover the oraInst.loc, inventory.xml, and comps.xml files as part of that scan. The inventory agent's tracker.log will give details on which packages are found on the device.
tracker.log file location:
You will see messages like the following appearing in the tracker.log:
[2018/04/15 01:24:20 AM (G, 0)] {2940} The file 'C:\oracle\inventory\ContentsXML\comps.xml' has been detected as a possible package registry
Review each .xml file to ensure it accurately reflects which applications are currently installed on the device.
You can obtain additional diagnostic tracing information about the scanning performed by the inventory agent by enabling the +Inventory/Packaging/OracleUniversalInstaller agent trace flag in the etcp.trace file. Instructions on how to do this are located here: How to enable FlexNet Manager Suite diagnostic tracing.
on Jun 08, 2018 10:31 AM - edited on Jan 11, 2023 09:24 PM by ChrisG
What if we are still unable to locate the file proving the installation is in fact on the device? is it just written off as a false positive or is there a workaround? Should we unlink that evidence to the application?
@joshua_neadow - You should look at the TRACKER.LOG file on the server in question. This will indicate where each xml file is found that contains OUI install evidence.
You will see entries in the log file such as the following:
[2018/04/15 01:24:20 AM (G, 0)] {2940} The file 'C:\oracle\inventory\ContentsXML\comps.xml' has been detected as a possible package registry
Just a small update on this post: from December 2021 on, in addition to the enhanced OUI data collection, precedence rules have been created in the ARL to remove Oracle OUI when more recent versions of Oracle Standard or Enterprise have been recognized on the server.
In such situations, the “unspecified edition” installations will be removed.
While the database can still be recognized through OUI in the case no more recent versions has been correctly inventoried, the Options are no longer recognized by OUI evidences (this will actually be the case in the coming weeks). Ignored OUI evidences have been created and other installer evidences linked to the applications are going to be deleted as a second step.
Is the installer evidence that the Flexera agent gathers from the comps.xml file only related to Oracle Database or would it also include evidence for middleware products like WebLogic if such apps are installed?
@clyntonh - Oracle Universal Installer (OUI) technology is used with a wide range of Oracle software applications, including WebLogic. Use of OUI is not limited to Oracle Database.
Are there plans to remove OUI evidence from being used to detect installations of Oracle DB? I understand that OUI evidence is no longer used for Oracle DB Options (https://community.flexera.com/t5/FlexNet-Manager-Content-Blog/Content-Change-Notification-Changes-in-the-use-of-Oracle/ba-p/216818) but what about the core DB product itself? I have seen MANY false positives where Flexera reports Oracle DB is installed but after checking with the DBA teams they can confirm that Oracle DB is not installed. Given that if the server is running in VMWare, Flexera will license the entire VMWare cluster, these false positives can create HUGE apparent non-compliance and financial risk values.
These situations typically present themselves as: only OUI evidence detected but no actual Oracle DB instance detected.
I think the problem stems from the ARL evidence created by Flexera is set to Any - so there is no way to distinguish OUI evidence as it is wrapped into applications that have Any for evidence. It seems you would have to address it at the Inventory.xml to prevent OUI or RPM evidence from being brought in, in the first place. Is my assumption correct here?
Hello @anne_watson , hello @WStephans ,
So far, here is our position on this tricky topic... that could evolve of course...
So, this is the pragmatic logic we have adopted. An additional enhancement that was added in 2021 was: if the agent finds a OUI evidence that points to an inexistent folder, it will not be retained.
Are you seeing massive Oracle Unspecified edition installations? Would you say they correspond to passive or un-activated nodes?
Thanks!
Nicolas
Principal Product Manager
Flexera ITAM
Hi Nicholas, this is causing issues with with various titles, including database and Java and we are not at version 2021 yet. And it is enough to be concerning.
If we could wholly exclude the local OUI evidence from joining to the Flexera Any definition that joins it before we even see it, that would be the ideal. And that OUI exclusion needs to extend to SCCM and JAMF where Java is concerned.
Hello @anne_watson ,
Here is an update on two recent changes we made to "Fight the OUI (and BEA...) false positives".
Best regards,
Nicolas
Hi,
Is there a way to exclude OUI evidence collected by Flexera agent ? and rely only on file or installer evidence?
Best regards,
Osama
@OHITAnalyst - I believe that OUI evidence will always be gathered based on OUI registry files found while scanning the filesystem. You can stop this from happening by not scanning the filesystem - but that will also result in files about other files you may be interested in not being gathered, so is not necessarily a good idea to do.