Create a Sample Oracle 10g Audit Trail UDLA Log Source
LogRhythm utilizes its extensive knowledge of log formats from various vendors to process logs. Processing is based on LogRhythm rules which dictate is a log is elevated to an event or to an alarm. Because UDLA log collection users define the log format, the following sample should be used so that LogRhythm can process this UDLA log type. Oracle 10g writes its audit data to the COMMON_AUDIT_TRAIL table.
For the MPE Policy Processing rules provided by LogRhythm for Oracle Audit Trail to parse the logs correctly, use the following configuration, making adjustments for the deployment environment.
Cutting-and-pasting the following Settings into a UDLA configuration in the LogRhythm Client Console may produce characters that are not supported by UDLA.
| Parameter Name | Setting |
|---|---|
| ODBC/OLE DB | Select ODBC connection. |
Connection String | Driver={Oracle in OraDb10g_home1};Server=myServer;Uid=myUserID;Pwd=myPassword; Be sure to replace the variables myServer, myUserID, and myPassword with the appropriate settings for the current environment. |
Query | SELECT * FROM (SELECT TO_CHAR(EXTENDED_TIMESTAMP, 'YYYYMMDDHH24MISSXFF') AS EXTENDED_TIMESTAMP, AUDIT_TYPE, STATEMENT_TYPE, RETURNCODE,AUDIT_OPTION, PRIV_USED, OS_USER, DB_USER, USERHOST, TERMINAL, OBJECT_SCHEMA, OBJECT_NAME, POLICY_NAME, NEW_OWNER, NEW_NAME, EXT_NAME, SQL_TEXT, COMMENT_TEXT, SES_ACTIONS, GLOBAL_UID, SESSION_ID, PROXY_SESSIONID, STATEMENTID, ENTRYID, CLIENT_ID, ECONTEXT_ID, TRANSACTIONID, OS_PROCESS, INSTANCE_NUMBER, ACTION, SQL_BIND, OBJ_PRIVILEGE, SYS_PRIVILEGE, OS_PRIVILEGE, SCN, GRANTEE, LOGOFF_TIME, LOGOFF_LREAD, LOGOFF_PREAD, LOGOFF_LWRITE, LOGOFF_DLOCK, SESSION_CPU FROM SYS.DBA_COMMON_AUDIT_TRAIL ORDER BY EXTENDED_TIMESTAMP) WHERE ROWNUM<= <Max_Message_Count> |
Output Format | <EXTENDED_TIMESTAMP> AUDIT_TYPE=<AUDIT_TYPE> STATEMENT_TYPE= |
Unique Identifier Field | SESSION_ID,ENTRYID |
Message Date Field | EXTENDED_TIMESTAMP |
State Field Type | Timestamp |
State Field | EXTENDED_TIMESTAMP |
State Field | ‘<UDLA_State_Field>’ |
Get UTC Date Statement | SELECT SYS_EXTRACT_UTC(CURRENT_TIMESTAMP) FROM dual OR SELECT TO_DATE(TO_CHAR(SYS_EXTRACT_UTC(CURRENT_TIMESTAMP),'YYYY-MM-DD HH24:MI:SS'),'YYYY-MM-DD HH24:MI:SS') FROM dual |
