| Oracle® Audit Vault Administrator's Guide Release 10.2.3.1 Part Number E13841-02 |
|
|
View PDF |
| Oracle® Audit Vault Administrator's Guide Release 10.2.3.1 Part Number E13841-02 |
|
|
View PDF |
This chapter describes common management activities that you need to perform after you have completed the configuration tasks in Chapter 2. You can use the Audit Vault Console or the command-line tools described in this chapter to manage Oracle Audit Vault.
This section contains:
The Audit Vault Console is a graphical user interface that you can use to perform commonly used Oracle Audit Vault administration tasks. If you prefer to use a command-line interface, you can use equivalent commands in the AVCA and AVCTL utilities.
To check the status of the Audit Vault Console:
Open a shell for the Audit Vault Server.
Follow the instructions in Section 2.2.2 to set the environment variables for the Audit Vault Server.
Run the following command:
$ avctl show_av_status
To start the Audit Vault Console:
Access the shell used for the Oracle Audit Vault collection agent.
If you have closed this shell, see the following sections:
Section 2.2.3 describes how to set environment variables for the collection agent.
If you installed the collection agent on Microsoft Windows, do not set any environment variables. Instead, go to the ORACLE_HOME\agent_dir\bin directory.
Ensure that the agent OC4J is running.
Run the following AVCTL command in the Oracle Audit Vault Agent home (ORACLE_HOME/agent_dir/bin) to check its status.
$ avctl show_oc4j_status
If the agent OC4J is not running, run the avctl start_oc4j command.
$ avctl start_oc4j
Access the shell used for the Audit Vault Server.
If you have closed this shell, reset its environment variables. See Section 2.2.2.
Ensure that the Audit Vault Console is running.
$ avctl show_av_status
If the avctl show_status command indicates that the Audit Vault Console is not running, enter the following command:
$ avctl start_av
At this stage, you can log in to the Audit Vault Console.
From a Web browser, enter the following URL:
http://host:port/av
In this specification:
host: The host computer on which you installed the Audit Vault Server.
port: The port number reserved for the Audit Vault Server.
If you are unsure of the host and port number values, then enter the avctl show_av_status command, which displays this information.
In the Login page, enter the following information:
User Name: Enter the name of a user who has been granted the AV_ADMIN role.
Password: Enter the user's password.
Connect As: From the list, select AV_ADMIN.
Click Login.
To stop the Audit Vault Server console:
In a shell for the Audit Vault Server, set its environment variables.
See Section 2.2.2 for more information.
Run the following command:
$ avctl stop_av
If you need to perform maintenance tasks or other similar activities that do not require alert settings to be active, you can globally enable or disable the alert settings that Oracle Audit Vault auditors create. Do not disable alerts unless you are directed to do so by Oracle Support Services or encounter a problem with the alerts table. By default, alerts are enabled.
To globally disable and enable alerts:
Log in to the Audit Vault Console as a user who has been granted the AV_ADMIN role.
See Section 3.2.3 for login instructions.
Select the Configuration tab, and then select the Alert subpage.
The Alert Settings page appears.
At the Alert Processing Status label, select either Disable or Enable.
Click Apply.
Audit event category management consists of viewing the Oracle Audit Vault audit event categories, their attributes, and their audited events. An audit event category defines how various types of events are organized. For example, invalid records are placed in the Invalid Record event category. See Oracle Audit Vault Auditor's Guide for more information about audit event categories.
Log in to the Audit Vault Console as a user who has been granted the AV_ADMIN role.
See Section 3.2.3 for login instructions.
Select the Configuration tab, and then select the Audit Event Category subpage.
The Audit Event Category Management page appears.
Select an audit event category, and then click View to find detailed information about that category.
The View Audit Event Category page appears.
From the Audit Source Type list, select from the available source types: ORCLDB, MSSQLDB, SYBDB, and DB2DB.
Select the Attributes or Audit Events subpages to view detailed information about these categories.
Click OK when you complete viewing the audit event information for the category you selected.
Figure 3-1 shows the Audit Event Category Management page.
Figure 3-1 Audit Event Category Management Page
On the Audit Event Category Management page, audit event categories appear in a table with the following columns:
Audit Event Category
Audit Event Category Description
Format Name
Format Module
You can use the Audit Vault Console to view operational errors that Oracle Audit Vault catches, such as broken database connections and missing files.
To view errors using Oracle Audit Vault:
Log in to the Audit Vault Console as a user who has been granted the AV_ADMIN role.
See Section 3.2.3 for login instructions.
Select the Management tab, and then select the Audit Errors subpage.
The Audit Errors page appears.
After the Error Time label, specify a time range of errors to view.
Select from the Last 24 Hours, Last One Week, or Last One Month options to view errors from those times, or select The Period and then enter a start date in the From field and end date in the To field to specify a different time range.
Click Go.
Figure 3-2 shows the Audit Errors page with audit errors from the last 24 hours.
The Audit Errors page displays error information as a table with the following column headings:
Error Time: Local time when the audit error was generated
Audit Source: The audit source database on which the audit error originated
Collector: The collector on which the audit error originated
Module: The module name involved in the audit error
Message: The content of the audit error message
After you add a collector to a database source, Oracle Audit Vault creates the collector with a set of default properties that are internal to Oracle Audit Vault. They have no effect on the source database. These properties control aspects such as the frequency of audit data collection from the source database, the name of the source database, and so on.
To alter collector properties and attributes using the Audit Vault Console:
Log in to the Audit Vault Console as a user who has been granted the AV_ADMIN role.
See Section 3.2.3 for login instructions.
Select the Configuration tab, and then select the Audit Source subpage.
The Source Configuration Management page appears.
Select the Collector subpage.
The Collector Configuration Management page appears, which displays the current settings for the available collectors.
Select the collector that you want to modify, and then click the Edit button.
The Edit Collector page appears.
Under Attributes, modify the attributes for the collectors by editing the values in the Value column.
For more information about these attributes, see the following sections:
Section 8.4 for the Oracle Database collector attributes
Section 9.4 for the SQL Server collector attributes
Section 10.4 for the Sybase ASE collector attributes
Section 11.4 for the IBM DB2 collector attributes
Click OK.
To alter collector properties using a shell:
In a shell for the Audit Vault Server, ensure that you have set its environment variables.
See Section 2.2.2 for more information.
Run the alter_collector command for each collector type, as shown in the following examples:
For Oracle Database:
$ avorcldb alter_collector -srcname hrdb.example.com -collname DBAUD_Collector AUDAUDIT_DELAY_TIME=60
See Section 8.4 for more information about the avorcldb alter_collector command.
For Microsoft SQL Server:
$ avmssqldb alter_collector -srcname mssqldb4 -collname MSSQLCollector NO_OF_RECORDS=1500 DESCRIPTION="MSSQLDB collector 45" SERVERSIDE_FILEPATH="c:\SQLAuditFile*
See Section 9.4 for more information about the avmssqldb alter_collector command.
For Sybase ASE:
$ avsybdb alter_collector -srcname sybdb4 -collname SybaseCollector NO_OF_RECORDS=1500 DESCRIPTION="Sybase collector 45"
See Section 10.4 for more information about the avsybdb alter_collector command.
For IBM DB2:
$ avdb2db alter_collector -srcname db2db4 -collname DB2Collector NO_OF_RECORDS=1500 DESCRIPTION="IBM DB2 collector 95"
See Section 11.4 for more information about the avdb2db alter_collector command.
This section contains:
The collectors collect audit data from their source database and send it to the Oracle Audit Vault repository. The repository stores the data in an internal format. The repository also contains a data warehouse. A database job periodically refreshes the data warehouse with the latest audit records. Oracle Audit Vault provides predefined reports that display the data in the warehouse to the auditor.
You can perform the following activities with the Oracle Audit Vault data warehouse:
Set the Audit Vault data warehouse refresh schedule. This schedule determines how frequently the data warehouse is refreshed with current data collected by the collectors.
Set a retention period for the data that has been refreshed. The data warehouse then contains the most recent data for that length of time after each refresh.
Load older data from the raw audit data store into the data warehouse tables. You can load older data into the data warehouse so that it can be available for analysis in the Oracle Audit Vault reports. However, you cannot load data from outside sources—just data that has been previously collected by the collectors but is too old to be loaded into the data warehouse as part of a normal refresh.
Purge audit data. If you load older audit data into the warehouse, you can purge it from the data warehouse. Oracle Audit Vault still maintains this data in the Audit Vault repository but does not make is available for analysis in the warehouse.
This section contains:
The refresh schedule moves data from the raw audit data store (that is, the internal format) into the data warehouse, so that it can be made available for the Oracle Audit Vault reports. The data warehouse is implemented as a sliding window over the audit data that has been collected. Each refresh of the data warehouse moves this window forward in time so that it always contains the latest audit records. The size of the window specifies how far back in time the window extends.
By default, Oracle Audit Vault refreshes the data warehouse once every 24 hours. You can set a retention period that determines the size of a sliding window of time for the data warehouse to hold this audit data.
The refresh schedule and retention period work together as follows: Suppose you have configured two source databases with Oracle Audit Vault. One database has 4 years of audit data accumulated and the other has 3 years of audit data. You want to retain only exactly the last year of data after each refresh. To accomplish this, you must do the following:
Schedule the refresh to start on a given day. For example, assuming that today is August 8, 2008, you set it for today.
Specify a frequency of once a day for the refresh to occur.
Set the retention period to 1 year. This retention period refers to the year before and leading up to the date that you specified in Step 1.
When the first refresh occurs, Oracle Audit Vault loads into the data warehouse the audit data that began 1 year ago, starting on August 8, 2007, to the current date, August 8, 2008. When the next refresh occurs on August 9, 2008, only the new audit data is retrieved. The retention period shifts forward: now this period is from August 9, 2007, to August 9, 2008. Oracle Audit Vault then discards the audit data from August 8, 2007, because now it is older than the retention period. This way, you always have the most recent year of audit data, right up to the current date.
There are two ways that you can create a refresh schedule:
Create the schedule once, directly in Oracle Audit Vault. The schedule settings remain in place until the next time you modify these settings.
Create one or more predefined schedules by using the DBMS_SCHEDULER PL/SQL package. You can create this schedule in SQL*Plus (or another SQL tool such as SQL Developer). Afterward, you use Oracle Audit Vault to select the schedule that you want to use. For more information about the DBMS_SCHEDULER package, see Oracle Database PL/SQL Packages and Types Reference.
You can create a schedule and retention period from either the Audit Vault Console or at a shell by using the AVCA utility.
To create the refresh schedule and retention period using the Audit Vault Console:
Log in to the Audit Vault Console as a user who has been granted the AV_ADMIN role.
See Section 3.2.3 for login instructions.
Select the Management tab, and then select the Configuration subpage.
The Warehouse Settings page appears.
Either select an existing schedule or create a new one.
To select an existing schedule:
Under Schedule to Send New Data, select Use Pre-defined Schedule.
From the Schema list, select the name of the schema in which the schedule was created.
From the Schedule list, select the name of the schedule.
Information about the schedule appears: a brief description, repeat times (frequency of to repeating the schedule), interval, repeat time (the time to repeat the schedule), and start and end dates. If settings have been omitted (for example, an interval time), then these labels are blank.
To create a new, standard schedule:
Under Schedule to Send New Data, select Standard.
Enter the following information:
Frequency Type: From the list, select a frequency type, such as By Hours.
Interval (frequency type): Enter the frequency for the type of frequency that you selected. For example, 1 for once every hour.
Start Date: Specify the date on which the refresh occurs. If you select a date that is earlier than today's date, then the refresh today.
Start Time: Enter the time at which the refresh occurs.
Set the retention window, that is, the period of time during which the data sent to the Oracle Audit Vault data warehouse remains in storage.
For example, suppose that you scheduled Oracle Audit Vault to refresh the raw audit data store every 2 hours, starting on August 19, 2008 at 2 a.m., and you want to keep this data in storage for the next year and a half. To do so, you would enter 1 in the Year field and 6 in the Months field.
Click Apply.
To create the refresh schedule and retention period using a shell:
In a shell for the Audit Vault Server, ensure that you have set its environment variables.
See Section 2.2.2 for more information.
Run the avca set_warehouse_schedule command to either specify an existing schedule or to create a new one.
For example, to select an existing schedule named daily_refresh:
$ avca set_warehouse_schedule -schedulename 'daily_refresh'
To create a new schedule:
$ avca set_warehouse_schedule -startdate 01-JUL-06 -rptintrv 'FREQ=DAILY;BYHOUR=0'
In this example:
startdate specifies the date for the first refresh to begin.
rptintrv specifies the intervals for the refreshes, in this case, once a day.
See Section 6.14 for more information about the avca set_warehouse_schedule command.
Run the avca set_warehouse_retention command to set the retention period.
For example, to specify a period of 1 year and 6 months, enter the following command:
$ avca set_warehouse_retention -intrv +01-06
See Section 6.13 for more information about the avca set_warehouse_retention command.
This section contains:
You can refresh the Oracle Audit Vault data warehouse repository with data from the raw audit data store. As with a scheduled refresh, Oracle Audit Vault collects the raw audit data from its source databases and places it into the Audit Vault data warehouse.
When you manually refresh the data in the Oracle Audit Vault data warehouse, you also can check the history of when refresh operations occurred.
To manually refresh the data warehouse using the Audit Vault Console:
Log in to the Audit Vault Console as a user who has been granted the AV_ADMIN role.
See Section 3.2.3 for login instructions.
Select the Management tab, and then select the Warehouse subpage.
The Warehouse Activity page appears.
The Warehouse Activity page shows the following information:
Scheduled: The scheduled time to perform a refresh operation
Start Time: The time when a refresh operation started
Duration (Minutes): The total time required to complete a refresh operation
CPU Used: The amount of CPU time used to complete a refresh operation
Error Number: The Oracle ORA- error number, if any, resulting from a refresh operation
Message: The error messages, if any, resulting from a refresh operation
Status: The current status of a refresh operation: FAILED or SUCCEEDED
Click the Refresh Now button.
To manually refresh the data warehouse using a shell:
In a shell for the Audit Vault Server, set its environment variables.
See Section 2.2.2 for more information.
Run the avctl refresh_warehouse command.
For example:
$ avctl refresh_warehouse -wait AVCTL started Refreshing warehouse... Waiting for refresh to complete... done.
The -wait parameter delays refreshing the raw data store until the current refresh job (if one is occurring) completes. See Section 7.4 for more information about the avctl refresh_warehouse command.
This section contains:
You can load data that is older than the retention period from the raw audit data store into the Oracle Audit Vault data warehouse tables. After you load this data, it is available to auditors to generate reports or perform analysis.
To find the current retention period setting, view the Warehouse Settings page of the Audit Vault Console (see Section 3.4.2); to find the last time the data was refreshed, view the Warehouse Activity page (Section 3.4.3).
To load the data warehouse data using the Audit Vault Console:
Log in to the Audit Vault Console as a user who has been granted the AV_ADMIN role.
See Section 3.2.3 for login instructions.
Optionally, disable the alert settings.
See Section 3.2.5 for more information.
Select the Management tab, and then select the Warehouse subpage.
The Warehouse Activity page appears.
Select the Load Activity subpage.
The Load Activity page appears.
In the Start Date field, enter the beginning date of the data that you want to load. For example, suppose the source database contains audit data that is 10 years old, and you want to load the last 5 years worth of audit data into the Oracle Audit Vault data warehouse. Assuming that today's date is August 8, 2008, you would specify August 8, 2003 as the start date.
In the Number of Days field, enter the number of days, starting from the start date, through which you want to load data.
Click the Load Now button.
Oracle Audit Vault schedules the data load operation, which is listed on this page the next time you access it.
Reenable the alert settings if you had disabled them.
See Section 3.2.5 for more information.
To load the data warehouse data using a shell:
Optionally, disable the alert settings.
See Section 3.2.5 for more information.
In a shell for the Audit Vault Server, ensure that you have set its environment variables.
See Section 2.2.2 for more information.
Run the avctl load_warehouse command.
For example, to load 10 days of audit data that was recorded starting on August 8, 2003, enter the following command:
$ avctl load_warehouse -startdate 08-AUG-03 -numofdays 10
See Section 7.2 for more information about the avctl load_warehouse command.
Reenable the alert settings if you had disabled them.
See Section 3.2.5 for more information.
This section contains:
When you no longer need the audit data that you have loaded into Audit Vault Server, you can remove it from the Oracle Audit Vault data warehouse. If in the future you decide that you need to run reports against this purged data, follow the instructions in Section 3.4.4 to reload the necessary data into the data warehouse. You can only remove data that is older than the retention period. You can find and reset the retention period from the Audit Vault Console Warehouse Settings page (see Section 3.4.2).
To purge the data warehouse data using the Audit Vault Console:
Log in to the Audit Vault Console as a user who has been granted the AV_ADMIN role.
See Section 3.2.3 for login instructions.
Select the Management tab, and then select the Warehouse subpage.
The Warehouse Activity page appears.
Select the Purge Activity page.
The Purge Activity subpage appears.
In the Start Date field, enter the beginning date of the data that you want to purge.
In the Number of Days field, enter the number of days, starting from the start date, through which you want to purge data.
Click the Purge Now button.
Oracle Audit Vault schedules the data purge operation, which is listed on this page the next time you access it.
To purge the data warehouse data using a shell:
In a shell for the Audit Vault Server, ensure that you have set its environment variables.
See Section 2.2.2 for more information.
Run the avctl purge_warehouse command.
For example, to purge 10 days of audit data that was recorded starting on January 1, 2004, and to specify that the operation wait until the previous purge job completes, enter the following command:
$ avctl purge_warehouse -startdate 01-JAN-04 -numofdays 10 -wait
See Section 7.3 for more information about the avctl purge_warehouse command.
After you register a source database, Oracle Audit Vault creates a set of properties that reflect general aspects of the source database itself, such as its port number and IP address. These properties are internal to Oracle Audit Vault and have no effect on the source database.
To alter the source database attributes using the Audit Vault Console:
Log in to the Audit Vault Console as a user who has been granted the AV_ADMIN role.
See Section 3.2.3 for login instructions.
Select the Configuration tab, and then select the Audit Source subpage.
The Source Configuration Management page appears.
Select the Source subpage.
The Source Configuration Management page displays the current settings for the available collectors.
Select the source database that you want to modify, and then click the Edit button.
The Edit Source page appears.
Under Properties, optionally modify the description of the source database.
Under Attributes, modify the attributes for the source database by editing the values in the Value column.
For more information about these attributes, see the following sections:
Section 8.5 for the Oracle Database source database attributes
Section 9.5 for the SQL Server source database attributes
Section 10.5 for the Sybase ASE source database attributes
Section 11.5 for the IBM DB2 source database attributes
Click OK.
To alter source database attributes using a shell:
In a shell for the Audit Vault Server, ensure that you have set its environment variables.
See Section 2.2.2 for more information.
Run the alter_source command for each source database type, as shown in the following examples.
For Oracle Database:
$ avorcldb alter_source -srcname hrdb.example.com PORT=1522
See Section 8.5 for more information about the avorcldb alter_source command.
For Microsoft SQL Server:
$ avmssqldb alter_source -srcname mssqldb4 DESCRIPTION="HR Database"
See Section 9.5 for more information about the avmssqldb alter_source command.
For Sybase ASE:
$ avsybdb alter_source -srcname sybdb4 DESCRIPTION="HR Database"
See Section 10.5 for more information about the avsybdb alter_source command.
For IBM DB2:
$ avdb2db alter_source -srcname db2db4 DESCRIPTION="HR Database"
See Section 11.5 for more information about the avdb2db alter_source command.
If you no longer need to have a source database registered with Oracle Audit Vault, you can use either the Audit Vault Console or the command-line utilities to remove the source database from Oracle Audit Vault. After you have removed the source database, its audit data still resides in the data warehouse within its retention period. To purge this audit data, see Section 3.4.5. You can check the length of the retention period in the Audit Vault Console; see Section 3.4.2.
Remember that after you have removed a source database, its identity data remains in Oracle Audit Vault so that there will be a record of source databases that have been dropped. Therefore, you cannot add a new source database with the name of a dropped source database. Remove the source database only if you no longer want to collect its data or if it has moved to a new host computer.
To remove a source database from Oracle Audit Vault using the Audit Vault Console:
Log in to the Audit Vault Console as a user who has been granted the AV_ADMIN role.
See Section 3.2.3 for login instructions.
Select the Configuration tab, and then select the Audit Source subpage.
The Source Configuration Management subpage appears.
From the list of source databases, select the database that you want to remove, and then click Delete.
You can search for a source database by entering data in the Source Type and Source fields.
Click Yes in the Confirmation window.
To remove a source database from Oracle Audit Vault using a shell:
In a shell for the Audit Vault Server, ensure that you have set its environment variables.
See Section 2.2.2 for more information.
Run the drop_source command for the source database, as shown in the following examples:
For Oracle Database:
$ avorcldb drop_source -srcname orcldb.example.com
See Section 8.7 for more information about the avorcldb drop_source command.
For Microsoft SQL Server:
$ avmssqldb drop_source -srcname mssqldb4
See Section 9.7 for more information about the avmssqldb drop_source command.
For Sybase ASE:
$ avsybdb drop_source -srcname sybdb4
See Section 10.7 for more information about the avsybdb drop_source command.
For IBM DB2:
$ avdb2db drop_source -srcname db2db4
See Section 11.7 for more information about the avdb2db drop_source command.
|
 Copyright © 2007, 2009, Oracle and/or its affiliates. All rights reserved. Legal Notices |
|
