✅ Oracle Database Production Hardening Checklist (RHEL)

1️⃣ OS & Kernel Hardening

🔒 OS Configuration

Dedicated server / VM for Oracle only
Correct RHEL version certified for Oracle
Minimal packages installed (no GUI, dev tools)
NTP / chrony configured and synced

chronyc tracking

⚙ Kernel Parameters

Verify:

sysctl -a | egrep "shm|sem|fs.aio|max_map_count"

Key settings:

✅ Persist in /etc/sysctl.conf

❌ Transparent Huge Pages (THP)

THP set to never

cat /sys/kernel/mm/transparent_hugepage/enabled

2️⃣ CPU & NUMA Hardening

🧠 NUMA Validation

lscpu | grep NUMA

numactl --hardware

NUMA detected and considered
Oracle memory interleaving enabled
No CPU pinning unless justified

Recommended:

numactl --interleave=all

🔥 CPU Oversubscription

No CPU quota throttling (VM / container)
vCPU ≤ physical CPU
Hyper‑threading understood and planned

3️⃣ Memory Hardening

📦 SGA & PGA

SGA < per‑NUMA node memory
PGA target sized (avoid PGA spills)
HugePages configured (if applicable)

Check HugePages:

grep Huge /proc/meminfo

🚨 Swap

Swap enabled but minimal
No Oracle paging to swap

vmstat 1 5

4️⃣ Storage & IO Hardening

💾 Disk Separation (Mandatory)

No sharing of redo + data.

⏱ IO Latency Targets

IO Type	Target
Redo writes	< 5 ms
Data reads	< 15 ms
Temp IO	< 20 ms

Verify:

iostat -xm 1 5

🧩 ASM (If Used)

Diskgroup redundancy defined
Rebalance power controlled
No mixed latency tiers in same DG

5️⃣ Oracle Parameter Hardening

✅ Mandatory Parameters

show parameter processes;

show parameter sessions;

show parameter open_cursors;

Ensure:

open_cursors ≥ 2–3× app need
processes sized for peak
sessions = processes * 1.5

⚡ Performance Safety

cursor_sharing = FORCE (only if needed)
result_cache_mode evaluated
optimizer_adaptive_features controlled
parallel_degree_policy understood

6️⃣ Security & Access Hardening

🔐 OS Level

Oracle user non‑login shell (if allowed)
SSH key‑based access
No password reuse
Root access logged

🔑 Database Level

Password profiles enforced
Default accounts locked
Strong SYS password
ADMIN roles minimized

SELECT username FROM dba_users WHERE account_status!='OPEN';

7️⃣ Resource Management (Very Important)

🎛 Oracle Resource Manager

Enabled in production
Separate OLTP / Batch consumers
CPU runaway prevention

SHOW PARAMETER resource_manager_plan;

8️⃣ Backup & Recovery Hardening

🛡 RMAN

Daily incremental
Weekly full
Archive log backups
Controlfile autobackup ON

SHOW ALL;

🔁 Restore Testing

Restore tested quarterly
PITR validated
Backup success monitored

9️⃣ Monitoring & Alerting

📊 OS Monitoring

CPU, load
Memory pressure
IO latency
Filesystem usage

🧠 Oracle Monitoring

AWR enabled
ASH accessible
Tablespace growth alerts
Session thresholds

🔍 Baselines

CPU baseline captured
IO latency baseline captured
AWR baseline saved post go‑live

🔟 Patch & Lifecycle Management

🧩 Oracle

Quarterly RU applied
OPatch version updated
Patch rollback plan ready

🧩 OS

Kernel patches tested
Reboot procedure documented
Firmware audited (if bare metal)

1️⃣1️⃣ High Availability & DR

Data Guard configured (if required)
DG lag alerts
Switchover tested
DR RTO/RPO documented

1️⃣2️⃣ Documentation & Audit Readiness

✅ Final “GO‑LIVE” Gate Criteria

✔ Stable CPU baseline
✔ Disk latency within SLA
✔ RMAN recoverable
✔ Resource controls enabled
✔ Security controls enforced

📌 Pro Tip (Real‑World)

Most production outages happen due to lack of resource controls, not lack of hardware.

Wednesday, April 29, 2026

Oracle Database Production Hardening Checklist - Best Practice