Prepare a database for Deep Security Manager

Applies to on-premise Deep Security software installations only

If you are installing Deep Security Manager on an AWS instance, see Prepare a database for Deep Security Manager on AWS.

Before you install Deep Security Manager, you must prepare a database (if you are not using the default instance) and user account for Deep Security Manager to use. Refer to your database provider's documentation for instructions on database installation and deployment, but consider the following for integration with Deep Security.

For a list of supported databases, see Database.

Dedicated server

The database should be installed on a dedicated server that is separate from the manager nodes. It is also important that the database and the Deep Security Manager be co-located on the same network with a 1 Gb LAN connection to ensure unhindered communication between the two. (WAN connections are not recommended.) The same applies to additional Deep Security Manager nodes. 2 ms latency or less is recommended for the connection from the manager to the database.

To achieve this if you install the manager and database on VMs, make sure they are always run in the same ESXi host.

  1. In the vCenter Web Client, go to Host and Clusters and select the cluster.
  2. Go to the Manage tab and click VM/Host Rules > Add.
  3. Type a name for the rule.
  4. Select Enable rule.
  5. From Type select Keep Virtual Machines Together.
  6. Click Add and select the manager and database VMs.

Hardware recommendations

Many Deep Security Manager operations (such as updates and recommendation scans) require high CPU and memory resources. Trend Micro recommends that each manager node has four cores and sufficient RAM in high scale environments.

The database should be installed on hardware that is equal to or better than the specifications of the best Deep Security Manager node. For the best performance, the database should have 8-16 GB of RAM and fast access to the local or network attached storage. Whenever possible, a database administrator should be consulted on the best configuration of the database server and a maintenance plan should be put in effect.

If you are installing the AWS Marketplace version of Deep Security Manager, use the Amazon RDS Management Console to create a database instance for use with Deep Security Manager. You can use a Microsoft SQL RDS or an Oracle RDS. Create the database instance before installing Deep Security Manager. Refer to the Amazon RDS documentation for instructions, but keep the following considerations in mind for integration with Deep Security.

Microsoft SQL Server

Oracle Database

  • Start the "Oracle Listener" service. Verify that it accepts TCP connections.
  • Don't use special characters in Deep Security Manager's database user name.

    Although Oracle allows special characters when configuring the database user object if they are surrounded by quotes, Deep Security does not support special characters for the database user.

  • Grant the CONNECT and RESOURCE roles and UNLIMITED TABLESPACE, CREATE SEQUENCE, CREATE TABLE and CREATE TRIGGER permissions to the Deep Security Manager's database user.

    If using multi-tenancy, also grant CREATE USER, DROP USER, ALTER USER, GRANT ANY PRIVILEGE and GRANT ANY ROLE to the Deep Security Manager's database user.

    Oracle container database (CDB) configuration is not supported with Deep Security Manager multi-tenancy.

Oracle RAC (Real Application Clusters) support

Deep Security supports:

  • SUSE Linux Enterprise Server 11 SP3 with Oracle RAC 12c Release 1 (v12.1.0.2.0)
  • Red Hat Linux Enterprise Server 6.6 with Oracle RAC 12c Release 1 (v12.1.0.2.0)

The default Linux Server Deep Security policy is compatible with the Oracle RAC environment, with the exception of Firewall settings. You can disable Firewall or customize the Firewall settings according to the instructions in Firewall settings with Oracle RAC.

Transport protocol

The recommended transport protocol is TCP.

If using Named Pipes to connect to a SQL Server, a properly authenticated Microsoft Windows communication channel must be available between Deep Security Manager host and the SQL Server host. This may already exist if:

  • The SQL Server is on the same host as Deep Security Manager.
  • Both hosts are members of the same domain.
  • A trust relationship exists between the two hosts.

If no such communication channel is available, Deep Security Manager will not be able to communicate to the SQL Server over named pipes. The AWS Marketplace version of Deep Security Manager does not support Named Pipes.

Connection settings used during Deep Security Manager installation.

During the Deep Security Manager installation, you will be asked for Database connection details. Enter the Database hostname under "Hostname" and the database that you previously created for Deep Security under "Database Name".

The installation supports both SQL and Windows Authentication. When using Windows Authentication, click on the "Advanced" button to display additional options. (The "Advanced" option is not available with the AWS Marketplace version of Deep Security Manager.)

High availability

The Deep Security database is compatible with database failover protection so long as no alterations are made to the database schema. For example, some database replication technologies add columns to the database tables during replication which can result in critical failures.

For this reason, database mirroring is recommended over database replication.