Oracle 11g stores audit data in the SYS.AUD$ database audit table. The SYS.AUD$ table contains links to multiple tables within the database that have supporting information about the audit logs such as user names and object names. Therefore, LogRhythm is configured to pull data remotely or locally from DBA_COMMON_AUDIT_TRAIL database view via the LogRhythm Agents UDLA collection mechanism. The DBA_COMMON_AUDIT_TRAIL view pulls all relevant data about the audit records into one easy-to-understand record.
Alternatively, the audit trail can be collected to log to a flat file instead of logging the audit trail to a database view. Reference Oracle documentation and consult with your Database Administrator for the proper steps for configuring the audit trail to be written to a file.
The UDLA collection mechanism used by the agent makes ODBC or OLE connections to the database to collect the logs. The following information is required for UDLA to function properly and should be gathered prior to configuring collection:
- The IP Address and/or host name of the database server to be collected from.
- The database instance name you would like to collect audit logs from.
- The database login credentials of the user account the LogRhythm Agent should use to connect to the database.
- The LogRhythm agent which will be used to collect the audit data from the Oracle database.
Configure Oracle 11g Auditing
Oracle allows fine-grained auditing of all database objects. Configuration of the Oracle database audit policy which determines what types of activities to audit and for whom should be completed by the Oracle Database Administrator.
To configure Oracle to write audit data to the SYS.AUD$ table, run one of the following SQL commands against the database:
ALTER SYSTEM SET audit_trail=db SCOPE=SPFILE
ALTER SYSTEM SET audit_trail=true SCOPE=SPFILE
Configure the ODBC or Oracle ODAC OLE Driver
Oracle 11g Audit Trail logs are accessed by LogRhythm via a Microsoft ODBC driver or Oracle ODAC OLE driver. Before configuring the UDLA log source in LogRhythm, the recommended driver must already be installed on the System Monitor host and configured according to the information in Configure UDLA Log Collection.
- Version. 2.576.3959.00
- Date. 2/18/2007
- Download Location. Pre-installed
- Oracle Provider for OLE DB. 22.214.171.124.0
- Download Location. Oracle Technology Network
After you configure the device, you must also configure LogRhythm according to the instructions provided on the overview page of this guide. LogRhythm requires that you use a LogRhythm System Monitor Agent to collect the logs. The agent does not need to reside on the same host as Oracle 11g instance, but it does need to be able to establish a network ODBC or OLE connection. In addition, in order to utilize the “Test” functionality of the UDLA log source configuration in the Client Console, a Client Console needs to be installed on the same host as the Agent you are configuring. Although not recommended, due to troubleshooting limitations, you can configure a UDLA log source with an Agent on a host which does not have a Console installed locally.
Only Global Admins or Restricted Admins with elevated View and Manage privileges can take this action.
Before you begin, download the Oracle 11g Audit Trail XML Configuration File. You will import this file later to populate the UDLA configuration fields for the Log Source.
The name of the log message source is UDLA - Oracle 11g Audit Trail. In addition, when configuring this log source:
- For Log Message Processing Mode, select MPE Processing Enabled, Event Forwarding Enabled.
- For Log Message Processing Engine (MPE) Policy, select LogRhythm Default.
- On the UDLA Settings tab, enter the following:
Click Import, and then browse to and open the XML file that you downloaded from LogRhythm.
If you are using an OLE connection, select OLE DB and change the connection string to: Provider=oraoledb.oracle;User ID=<username>;Password=<password>;Data Source=<server>/<instance>
For either connection type, ensure that you change the placeholder values in the Connection String box to those that match your deployment.
- If you want to validate the current settings, click Test.
If the test fails, verify the connection settings and that all values were entered correctly.
- When the test passes, close the Test dialog box.