Managing Oracle Universal Installer (OUI) evidence gathered by the FlexNet inventory agent

[#1]

FlexNet Manager Suite can falsely recognize Oracle applications due to remaining Oracle Universal Installer (OUI) evidence reported to the FlexNet inventory agent. This article describes how FlexNet inventory agent gathers Oracle evidence and how you can locate OUI evidence to review potentially outdated files.

How the FlexNet inventory agent gathers Oracle evidence

Locating OUI evidence

OUI tracks details of installed Oracle software components using files named oraInst.loc, inventory.xml, and comps.xml.

The /etc/oraInst.loc file contains an inventory_loc entry.  

Under the inventory_loc path will be a ContentsXML/inventory.xml file (in this example, "/u/oracle/app/oraInventory/ContentsXML/inventory.xml").

Example

inventory_loc=/u/oracle/app/oraInventory
inst_group=oinstall

The inventory.xml file provides HOME elements that contain a LOC attribute.

Each home directory includes an inventory/ContentsXML/comps.xml file (in this example, "/u/oracle/app/oracle/product/11.2.0/dbhome_1/inventory/ContentsXML/comps.xml").

Example

<HOME_LIST>
  <HOME NAME="OraDb11g_home1" LOC="/u/oracle/app/oracle/product/11.2.0/dbhome_1" TYPE="O" IDX="1"/>
</HOME_LIST>

The comps.xml file contains the installer evidence extracted by the inventory agent.

For each COMP element, the following properties are used:

• EXT_NAME element - installer evidence "Name"
• VER attribute - installer evidence "Version"
• INST_LOC attribute - installer evidence "InstallLocation"
• INSTALL_TIME attribute - installer evidence "InstallDate"
• A hard-coded "Oracle Corporation" - installer evidence "Publisher"

Example

<COMP NAME="oracle.server" VER="11.2.0.1.0" BUILD_NUMBER="0" REP_VER="0.0.0.0.0" RELEASE="Production" INV_LOC="Components/oracle.server/11.2.0.1.0/1/" LANGS="en" XML_INV_LOC="Components21/oracle.server/11.2.0.1.0/" ACT_INST_VER="11.2.0.1.0" DEINST_VER="11.2.0.0.0" INSTALL_TIME="2011.Jun.02 20:39:31 EST" INST_LOC="/u/oracle/app/oracle/product/11.2.0/dbhome_1/oracle.server">
  <EXT_NAME>Oracle Database 11g</EXT_NAME>
  <DESC>Installs an optional preconfigured starter database, product options, management tools, networking services, utilities, and basic client software for an Oracle Database server. This option also supports Automatic Storage Management database configuration.</DESC>
  <DESCID>COMPONENT_DESC</DESCID>
  <STG_INFO OSP_VER="10.2.0.0.0"/>
</COMP>

Package details in an inventory .ndi file generated from the above example would look like the below example.

Example

<Package Name="Oracle Database 11g" Evidence="OUI" Version="11.2.0.1.0" InstallDate="20110602T203931">
  <Property Name="InstallLocation" Value="/u/oracle/app/oracle/product/11.2.0/dbhome_1/oracle.server"/>
  <Property Name="Publisher" Value="Oracle Corporation"/>
</Package>

Installation directories that no longer exist

Sometimes comps.xml files are not updated by OUI when Oracle applications are uninstalled. When this occurs, it results in the FlexNet inventory agent recognizing installations of Oracle applications based on the evidence files, even if other files associated with the installation are no longer on the computer.

• The FlexNet inventory agent versions 2021 R1 (17.0) and later contain an improvement that will only return evidence from comps.xml files where the directory specified in the INST_LOC attribute exists.
  
  

  Note: Oracle Universal Installer often (but not always) adds another directory name that does not exist to the end of the path specified by the INST_LOC attribute in comps.xml files. For this reason, the last name in the INST_LOC path is ignored when perform the directory existence check.

  For example: a comps.xml file will commonly include details like the following for an installation of the oracle.server package in the path /u/oracle/app/oracle/product/11.2.0/dbhome_1:

  <COMP NAME="oracle.server" [...] INST_LOC="/u/oracle/app/oracle/product/11.2.0/dbhome_1/oracle.server">

  The "oracle.server" name at the end of the path is ignored, so the package is considered installed and evidence returned in gathered inventory as long as the /u/oracle/app/oracle/product/11.2.0/dbhome_1 directory exists on the filesystem.

• Earlier agent versions return all evidence as specified in the comps.xml file, regardless of whether referenced installation directories actually exist.

ARL rules for recognizing OUI evidence

OUI evidence often identifies that Oracle applications are installed but won’t identify the edition. Precedence rules are configured in the FlexNet inventory agent’s application recognition library (ARL) to avoid recognizing installations of Oracle applications without specified editions. ARL will use more specific evidence that enables recognition of the edition when available (for example, based on Oracle Database inventory gathered rather than OUI evidence).

Recognition rules for Oracle Database options are generally not configured to match OUI evidence.

OUI evidence is often an unreliable indicator of what is currently installed on computers. As installations change, OUI files on computers are often not updated accordingly. Avoiding using OUI evidence for recognition helps to minimize false positives that arise from using OUI evidence to recognize installations.

Related: See the following post for more information about how OUI evidence for Oracle Database options is handled by FlexNet Manager Suite: Content Change Notification: Changes in the use of Oracle Universal Installer (OUI) evidences for recognition.

Review file evidence using the FlexNet inventory agent tracker.log

If the FlexNet inventory agent is configured to scan the file system, it will discover the oraInst.loc, inventory.xml, and comps.xml files as part of that scan. The inventory agent's tracker.log will give details on which packages are found on the device.

tracker.log file location:

• Windows: %temp%\ManageSoft\tracker.log
• non-Windows: /var/opt/managesoft/log/tracker.log

You will see messages like the following appearing in the tracker.log:

[2018/04/15 01:24:20 AM (G, 0)] {2940} The file 'C:\oracle\inventory\ContentsXML\comps.xml' has been detected as a possible package registry

Review each .xml file to ensure it accurately reflects which applications are currently installed on the device.

Additional diagnostics

You can obtain additional diagnostic tracing information about the scanning performed by the inventory agent by enabling the +Inventory/Packaging/OracleUniversalInstaller agent trace flag in the etcp.trace file. Instructions on how to do this are located here: How to enable FlexNet Manager Suite diagnostic tracing.

Related resources

• Universal Installer and OPatch User's Guide from Oracle Enterprise Manager Documentation, 11g Release 1 (11.1)
• Significance of oraInst.loc When Installing Oracle Products and Applying Patches
• FAQs on Central Inventory and Oracle Home Inventory (Local Inventory) in Oracle RDBMS

[joshua_neadow]

What if we are still unable to locate the file proving the installation is in fact on the device?  is it just written off as a false positive or is there a workaround?  Should we unlink that evidence to the application?

[kclausen]

@joshua_neadow - You should look at the TRACKER.LOG file on the server in question.  This will indicate where each xml file is found that contains OUI install evidence.

You will see entries in the log file such as the following:

[2018/04/15 01:24:20 AM (G, 0)] {2940} The file 'C:\oracle\inventory\ContentsXML\comps.xml' has been detected as a possible package registry

[nrousseau1]

Just a small update on this post: from December 2021 on, in addition to the enhanced OUI data collection, precedence rules have been created in the ARL to remove Oracle OUI when more recent versions of Oracle Standard or Enterprise have been recognized on the server.

In such situations, the “unspecified edition” installations will be removed.

While the database can still be recognized through OUI in the case no more recent versions has been correctly inventoried, the Options are no longer recognized by OUI evidences (this will actually be the case in the coming weeks). Ignored OUI evidences have been created and other installer evidences linked to the applications are going to be deleted as a second step.

[clyntonh]

Is the installer evidence that the Flexera agent gathers from the comps.xml file only related to Oracle Database or would it also include evidence for middleware products like WebLogic if such apps are installed?

[ChrisG]

@clyntonh - Oracle Universal Installer (OUI) technology is used with a wide range of Oracle software applications, including WebLogic. Use of OUI is not limited to Oracle Database.

[WStephans]

Are there plans to remove OUI evidence from being used to detect installations of Oracle DB? I understand that OUI evidence is no longer used for Oracle DB Options (https://community.flexera.com/t5/FlexNet-Manager-Content-Blog/Content-Change-Notification-Changes-in-the-use-of-Oracle/ba-p/216818) but what about the core DB product itself? I have seen MANY false positives where Flexera reports Oracle DB is installed but after checking with the DBA teams they can confirm that Oracle DB is not installed. Given that if the server is running in VMWare, Flexera will license the entire VMWare cluster, these false positives can create HUGE apparent non-compliance and financial risk values. 

These situations typically present themselves as: only OUI evidence detected but no actual Oracle DB instance detected.

[anne_watson]

I think the problem stems from the ARL evidence created by Flexera is set to Any - so there is no way to distinguish OUI evidence as it is wrapped into applications that have Any for evidence.  It seems you would have to address it at the Inventory.xml to prevent OUI or RPM evidence from being brought in, in the first place.  Is my assumption correct here?

[nrousseau1]

Hello @anne_watson , hello @WStephans ,

So far, here is our position on this tricky topic... that could evolve of course... 

• Oracle DB Options: OUI is NEVER interesting as it causes hundreds of false positives. An installed and not used option will be reported by the LMS queries from v$Version or DBA_FEATURE_USAGE_STATISTICS
• Oracle Database:
  • OUI is often a false positive left from older version upgrades when it creates an Oracle Unspecified edition installation. It can however be interesting when the Oracle LMS inventory has not worked.
  • That's why we have extended the precedence rules: an Oracle Database Unspecified edition will be removed by any more recent recognized edition of Oracle (and not only the same version)
  • The false positive should be massively reduced but still exist when Oracle DB has been deployed but no instance installed or all instances are powered off (passive not of a cluster)
• Other applications (Java, Middleware...)
  • Until we are confirmed these are false positive and we have a better data collection solution, we keep them.

So, this is the pragmatic logic we have adopted. An additional enhancement that was added in 2021 was: if the agent finds a OUI evidence that points to an inexistent folder, it will not be retained.

Are you seeing massive Oracle Unspecified edition installations? Would you say they correspond to passive or un-activated nodes?

Thanks!

Nicolas

Principal Product Manager

Flexera ITAM

[anne_watson]

Hi Nicholas, this is causing issues with with various titles, including database and Java and we are not at version 2021 yet. And it is enough to be concerning.

If we could wholly exclude the local OUI evidence from joining to the Flexera Any definition that joins it before we even see it, that would be the ideal. And that OUI exclusion needs to extend to SCCM and JAMF where Java is concerned.

[nrousseau1]

Hello @anne_watson ,

Here is an update on two recent changes we made to "Fight the OUI (and BEA...) false positives".

• I just introduced today some precedence rules that remove any "Unspecified" editions of WebLogic Server when triggered by BEA or OUI installer evidence. Content post here.
• We removed end of April (ARL2740) any installer evidence for Java recognition. Info here. More information on Java in the SAM Best Practice Webinar on Java.

Best regards,

Nicolas

[OHITAnalyst]

Hi, 

Is there a way to exclude OUI evidence collected by Flexera agent ? and rely only on file or installer evidence?

Best regards, 
Osama 

[ChrisG]

@OHITAnalyst - I believe that OUI evidence will always be gathered based on OUI registry files found while scanning the filesystem. You can stop this from happening by not scanning the filesystem - but that will also result in files about other files you may be interested in not being gathered, so is not necessarily a good idea to do.