Oracle® Audit Vault

Release Notes

Release 10.2.3

E11061-01

June 2008

These Release Notes contain important information that was not included in the Oracle Audit Vault Release 10.2.3 documentation. For the most current information, refer to updates of this document, which are located at the following Web site:

http://www.oracle.com/technology/documentation

This document contains these topics:

- General Installation Issues

- General Administration and Configuration Issues

- Source Configuration Issues

- Collector Configuration Issues

- Documentation Accessibility

1 General Installation Issues

This section contains:

- All Platforms (Single Instance and Oracle RAC)

- All Platforms (RAC) Only

- Linux and UNIX Platforms (Single Instance and Oracle RAC)

- Microsoft Windows Platform

1.1 All Platforms (Single Instance and Oracle RAC)

This section describes known issues and workarounds for single instance and Oracle RAC installations on all platforms.

This section contains:

- The Required Storage Space Calculation Is Not Automatically Updated When Adding Member Disks to the ASM Disk Group

- The Same SYSDBA Password Is Required for Audit Vault and ASM

- An Error Occurs After Selecting a Non-Empty Oracle Home for Agent Installation

- Error File Getting Generated During Audit Vault Server Installation

- The -record Option Is Not Supported

- The Silent Installer Does Not Issue an Error When the SID Is Omitted

- The Silent Installer for the Agent Does Not Validate Against the Server

- Silent Installation May Not Report on a Failed DVCA Command

- Silent Installation Proceeds Even When Variables Are Not Populated

- Manual Cleanup Is Required After Uninstalling the Audit Vault Database

- Audit Vault Server Installer Prints Time Zone on Console When Run for Upgrade

- Deinstalling Upgraded Audit Vault Server Does Not Remove Entry from Oratab File

- Automated Backup Job Not Properly Created with Audit Vault Server Installation

- Error Message Appears in Log File After You Deinstall the Audit Vault Agent

- Errors Appear in Agent Log File After Installing Oracle Audit Vault Agents

1.1.1 The Required Storage Space Calculation Is Not Automatically Updated When Adding Member Disks to the ASM Disk Group

During an Audit Vault Server advanced installation, on the Configure Automatic Storage Management Configure page when you select new disks to add from the Add Member Disks table, the Required Storage Space area is supposed to automatically adjust the disk sizes displayed to show the amount of required storage space. However, this calculation is not updated.

Workaround: Click the Change Discovery Path button and update the discovery path to show the adjusted disk sizes before adding the disks.

This issue is tracked with Oracle bug 5764944.

1.1.2 The Same SYSDBA Password Is Required for Audit Vault and ASM

After installing Automatic Storage Management (ASM) and Oracle Audit Vault Server, you may receive the following error when connecting to ASM:

"Supplied ASM SYSDBA password is invalid"

Workaround: Provide the same SYSDBA password for both ASM and Audit Vault Server.

This issue is tracked with Oracle bug 5845686.

1.1.3 An Error Occurs After Selecting a Non-Empty Oracle Home for Agent Installation

When installing an Audit Vault Agent, if you select a non-empty Oracle Home directory, the following error message appears:

Recommendation: Choose a new Oracle Home or a home that contains
Oracle Database 10g Client Release 1 software of a home that contains
Oracle Database 10g Release 2 software for installing this product.

Workaround: This message applies to the Oracle 10g Release 1 client, not the Audit Vault Agent. Install the Audit Vault Agent in a new home directory, or in an existing Oracle Audit Vault home directory.

This issue is tracked with Oracle bug 5874570.

1.1.4 Error File Getting Generated During Audit Vault Server Installation

When installing Oracle Audit Vault Server using Oracle Universal Installer, after clicking Next on the Prerequisite Checks screen, the following runtime exception content is written to the error file that is generated:

Runtime exception during validation of variable :s_racSid
java.lang.NullPointerException
at
Components.oracle.rdbms.dv.v10_2_0_3_0.CompContext.validate_s_racSid(Unknown
Source)
at
Components.oracle.rdbms.dv.v10_2_0_3_0.CompContext.validate(Unknown Source)
at
oracle.sysman.oii.oiis.OiisVariable.validate(OiisVariable.java:1409)
at
oracle.sysman.oii.oiis.OiisVariable.validateChildVariables(OiisVariable.java:1836)
at
oracle.sysman.oii.oiis.OiisVariable.setValue(OiisVariable.java:1124)
at
oracle.sysman.oii.oiis.OiisVariable.setVariable(OiisVariable.java:2197)
at
oracle.sysman.oii.oiis.OiisCompContext.doOperation(OiisCompContext.java:1093)
at
oracle.sysman.oii.oiif.oiifb.OiifbLinearIterator.iterate(OiifbLinearIterator.java:147)
at
oracle.sysman.oii.oiic.OiicCompsWizEngine.doOperation(OiicCompsWizEngine.java:202)
at
oracle.sysman.oii.oiif.oiifb.OiifbLinearIterator.iterate(OiifbLinearIterator.java:147)
at
oracle.sysman.oii.oiic.OiicInstallSession$OiicSelCompsInstall.doOperation(OiicInstallSession.java:3838)

Workaround: You can ignore this error. This exception error is a benign error and will be suppressed in a future release. It does not affect the installation or the functionality of the installed Audit Vault databases for a single instance installation or for an Oracle RAC environment installation.

This issue is tracked with Oracle bug 6832669.

1.1.5 The -record Option Is Not Supported

In this release, the installer does not support the -record option.

Workaround: None.

This issue is tracked with Oracle bug 5841694.

1.1.6 The Silent Installer Does Not Issue an Error When the SID Is Omitted

When performing silent installation for the Audit Vault Server, if you do not provide a value for the s_dbSid option, the SID defaults to av.

Workaround: Ensure that you have set the correct value for the s_dbSid option in the response file before running the silent installation.

This issue is tracked with Oracle bug 5739374.

1.1.7 The Silent Installer for the Agent Does Not Validate Against the Server

If you perform a silent installation of the Audit Vault Agent, Oracle Universal Installer does not connect to the specified Audit Vault Server and check the user-provided information. This type of validation is only available when using one-click installation.

Workaround: Use any of the following methods:

- Ensure that you are installing the agent on the computer that you specified when issuing the avca add_agent command on the server.

- Manually check the user-provided information in the response file for the silent installation.

- Verify that the Audit Vault database is up.

This issue is tracked with Oracle bug 5747235.

1.1.8 Silent Installation May Not Report on a Failed DVCA Command

If you perform a silent installation, the DVCA command may fail to run. However, the silent installer will report that it ran successfully.

Workaround: Check the installation logs after running silent installation. The log files are located in the ORACLE_HOME/cfgtoollogs/oui/installActionsdate_time.log file.

This issue is tracked with Oracle bug 5892119.

1.1.9 Silent Installation Proceeds Even When Variables Are Not Populated

When you run the silent installation program as follows, you may receive an error:

On Linux and UNIX systems:

./runInstaller -silent -responseFile absolute_path_to_av.rsp_file

On Windows systems:

setup.exe -silent -responseFile absolute_path_to_av.rsp_file

If you have not properly supplied all required variables in the silent installation file, the following error appears:

'SEVERE:Abnormal program termination. An internal error has occured.
Please provide the following files to Oracle Support :'.

Workaround: Check the silent installation response file and ensure that you have provided proper input for all the required variables.

This issue is tracked with Oracle bug 5859406.

1.1.10 Manual Cleanup Is Required After Uninstalling the Audit Vault Database

After you uninstall the Audit Vault database, the configuration files that Audit Vault created are not removed.

Workaround: Manually delete the Audit Vault home directory after you uninstall the Audit Vault database.

This issue is tracked with Oracle bug 5768129.

1.1.11 Audit Vault Server Installer Prints Time Zone on Console When Run for Upgrade

During an Audit Vault server upgrade, Oracle Universal Installer prints the time zone in UTC format in the console in which you invoke ./runInstaller. This time zone format also appears in the .out installation log file.

Workaround: None. You can disregard this message on console and in the .out installation log file.

This issue is tracked with Oracle bug 6829132.

1.1.12 Deinstalling Upgraded Audit Vault Server Does Not Remove Entry from Oratab File

If you de-install the Audit Vault Server and even after the de-installation successfully completes, the /etc/oratab file still shows the entry for an upgraded Audit Vault server.

Workaround: After the deinstallation completes, manually update the /etc/oratab file to remove the corresponding Audit Vault server entry.

This issue is tracked with Oracle bug 6833273.

1.1.13 Automated Backup Job Not Properly Created with Audit Vault Server Installation

When you install Oracle Audit Vault, the automated back-up jobs do not work and fail with a No such file or directory error.

Workaround: Use customized back-ups to schedule any back-up jobs.

This issue is tracked with Oracle bug 6844843.

1.1.14 Error Message Appears in Log File After You Deinstall the Audit Vault Agent

If you deinstall the Oracle Audit Vault Agent, the following error message appears in the installation log file:

OPatch failed with error code 73

Command = /scratch/aime/10.2DV/080509/dvr1/avagent1/av/install/avpatch.sh has
failed

Configuration assistant "Oracle Audit Vault Agent One-Off Patches -
Deinstall" failed

This error message only appears in the log files, not from Oracle Universal Installer.

Workaround: The deinstallation process is hanging temporarily. Let it continue for about an hour. It will time out, but afterwards, the deinstallation process completes successfully.

This issue is tracked with Oracle bug 7037396.

1.1.15 Errors Appear in Agent Log File After Installing Oracle Audit Vault Agents

After you install the Oracle Audit Vault agents, the following validation errors appear in the $AGENTHOME/av/log/agent_client-0.log file:

2008/04/29 13:03:38 Thread-10 level of detail(low): error invoking validtion
for input=agent2 method=validateName
java.lang.NoClassDefFoundError: javax/servlet/ServletRequest
at java.lang.Class.getDeclaredMethods0(Native Method)
at java.lang.Class.privateGetDeclaredMethods(Class.java:1655)
at java.lang.Class.getMethod0(Class.java:1901)
at java.lang.Class.getMethod(Class.java:984)
at oracle.av.util.BeanValidator.invoke(BeanValidator.java:49)
at oracle.av.util.BeanValidator.validate(BeanValidator.java:97)
at
@ oracle.av.avca.CommandArguments.validateArguments(CommandArguments.java:170)
at oracle.av.avca.Avca.startCA(Avca.java:106)
at oracle.av.avca.Avca.main(Avca.java:448)
2008/04/29 13:03:38 Thread-10 level of detail(low): validationg getAgentName

Workaround: You can ignore these errors. The Audit Vault agent should start successfully.

This issue is tracked with Oracle bug 7007105.

1.2 All Platforms (RAC) Only

This section describes known issues and workarounds for Oracle RAC installations on all platforms.

This section contains:

- After an Oracle RAC Installation, an Error Is Issued During Creation of the Database

- In an Oracle RAC Environment, an SPFILE Error Is Issued During Installation

1.2.1 After an Oracle RAC Installation, an Error Is Issued During Creation of the Database

After you install Audit Vault Server, the following error appears if you create an Oracle RAC database using the dbca command:

Failed to retrieve network listener Resources

Workaround: Click yes on the error screen and continue the installation.

This issue is tracked with Oracle bug 5488388.

1.2.2 In an Oracle RAC Environment, an SPFILE Error Is Issued During Installation

If you install Audit Vault Server on a single node in an Oracle RAC environment, the following messages are written to the dvca_install.log file:

Error executing task INIT_AUDIT_SYS_OPERATIONS:java.sql.SQLException:
ORA-32001: write to SPFILE requested but no SPFILE specified at startup
Error executing task INIT_REMOTE_OS_AUTHENT:java.sql.SQLException: ORA-32001:
write to SPFILE requested but no SPFILE specified at startup
Error executing task INIT_REMOTE_OS_ROLES:java.sql.SQLException: ORA-32001:
write to SPFILE requested but no SPFILE specified at startup
Error executing task INIT_OS_ROLES:java.sql.SQLException: ORA-32001: write to
SPFILE requested but no SPFILE specified at startup
Error executing task INIT_SQL92_SECURITY:java.sql.SQLException: ORA-32001:
write to SPFILE requested but no SPFILE specified at startup
Error executing task INIT_OS_AUTHENT_PREFIX:java.sql.SQLException: ORA-32001:
write to SPFILE requested but no SPFILE specified at startup
Error executing task INIT_REMOTE_LOGIN_PASSWORDFILE:java.sql.SQLException:
ORA-32001: write to SPFILE requested but no SPFILE specified at startup
Error executing task INIT_RECYCLEBIN:java.sql.SQLException: ORA-32001: write
to SPFILE requested but no SPFILE specified at startup

Workaround: Ignore the errors, and after the installation is complete, edit the pfile using the following information:

audit_sys_operations=TRUE
remote_os_authent=FALSE
remote_os_roles=FALSE
os_roles=FALSE
sql92_security=TRUE
os_authent_prefix=''
remote_login_passwordfile=EXCLUSIVE
recyclebin=OFF

Afterwards, restart the database.

By default, the PFILE location is in the ORACLE_HOME/admin/db_name/pfile directory.

This issue is tracked with Oracle bug 6131570.

1.3 Linux and UNIX Platforms (Single Instance and Oracle RAC)

This section describes installation and uninstallation issues in Linux and UNIX platforms for single instance and Oracle Real Application Clusters (RAC) installations.

This section contains:

- Oracle Audit Vault Installation Creates an Error Log File

- Accessing Help Displays a Blank Window

1.3.1 Oracle Audit Vault Installation Creates an Error Log File

If you install Oracle Audit Vault, an error log similar to the following is created:

EM Configuration issue.
@ /oracle/av/10.2.3/AV01/av_oh/mycompany.us.oracle.com_ not found.

Workaround: None. Oracle Enterprise Manager should be correctly working. You can disregard this error log file.

This issue is tracked with Oracle bug 6780876.

1.3.2 Accessing Help Displays a Blank Window

On AIX 5L Based Systems, if you perform an Audit Vault Server or Agent installation using Simplified Chinese (zh_CN) or Japanese (ja_JP) languages, then accessing help on the installer screen will display a blank help window.

Workaround: None.

This issue is tracked with Oracle bug 7016874.

1.4 Microsoft Windows Platform

This section contains:

- Special Message for Security Patch Installation in Audit Vault Agent Upgrade

1.4.1 Special Message for Security Patch Installation in Audit Vault Agent Upgrade

During the upgrade from Oracle Audit Vault release 10.2.2 Audit Vault agent to a release 10.2.3 Audit Vault agent on Microsoft Windows, the following special message appears in the installation log file:

ATTENTION                                   **
**
**
** Please note that the Security Patch Installation (Patch Deinstallation) is
**
** not complete until all the Post Installation (Post Deinstallation)
**
** instructions noted in the Readme accompanying this patch, have been
**
** successfully completed.

Workaround: Review the readme and other documentation that accompanies the security patch to ensure that you have completed all the required steps.

This issue is tracked with Oracle bug 6979619.

2 General Administration and Configuration Issues

This section contains:

- Audit Vault Source Database Audit Trail Clean-Up Feature Patch

- Garbled Multi-byte User Name Is Displayed on the Login Page

- Subpools for Streams Can Become Too Large

- Need to Enable DV_SECANALYST to Access the DVSYS.AUDIT_TRAIL$ Table

- Time Values in Reports Do Not Display the Time Zone

- Audit Vault Duplicates FGA Policies if Policy Name Is Lower Case

- SQL Server avmssqldb Command Returns Incorrect Warning Message

2.1 Audit Vault Source Database Audit Trail Clean-Up Feature Patch

New for this release of Oracle Audit Vault is the integration with a new PL/SQL package, DBMS_AUDIT_MGMT in Oracle Database. The package provides a set of PL/SQL procedures that you can use to perform audit trail clean-up tasks. In addition to this package, four audit trail clean-up related data dictionary views are provided. This functionality will be available in upcoming versions of Oracle Database. To use this functionality in an existing Oracle 10.2.0.3.0 database, you must download and install Patch 6989148 on the Audit Vault source database.

To download and install Patch 6989148:

1. Log in to OracleMetaLink from the following URL:
http://metalink.oracle.com

2. In Quick Find, select Patch Number from the list of categories. In the second Quick Find field, enter 6989148 for the patch number. Then, click Go.

3. On the Patch 6989148 page, download and install the patch onto the Audit Vault source database, using the instructions in the provided readme file.

This issue is tracked with Oracle bug 6989148.

2.2 Garbled Multi-byte User Name Is Displayed on the Login Page

If you enter an invalid multi-byte user name on the login page for the Audit Vault Console, an error is displayed and the user name is displayed in a garbled manner.

For example, this problem occurs if you do the following:

1. Set the browser to simplified Chinese.

2. Access the Audit Vault Console URL.

3. On the login page, enter an invalid multi-byte user name and then click Login.

Workaround: None.

This issue is tracked with Oracle bug 5899718.

2.3 Subpools for Streams Can Become Too Large

The REDO collector uses Oracle Streams technology to retrieve logical change records (LCRs) from the redo logs. On the source database, a Streams capture process uses LogMiner to extract new LCRs from the redo logs based on capture rules that are defined by the user.

If you configure initialization parameters for a streams pool with subpool durations for instance, session, cursor, and execution, you can receive an ORA-4031 error.

Workaround: Use one of the following:

- Find what allocations made a particular duration subpool too large and change their durations, for example, from session to cursor or execution.

- Combine the durations into one pool using the following initialization parameter in the init.ora initialization file:

_enable_shared_pool_durations = false

However, be aware that setting this parameter prevents the Streams pool from shrinking.

This issue is tracked with Oracle bug 5919096.

2.4 Need to Enable DV_SECANALYST to Access the DVSYS.AUDIT_TRAIL$ Table

Audit Vault extracts the Oracle Database Vault audit trail records by using the DV_ADMIN or DV_OWNER role to read the contents of the DVSYS.AUDIT_TRAIL$ table for Oracle Database 11g Release 1 (11.1). For better security, Audit Vault should be able to use the DV_SECANALYST role to read the DVSYS.AUDIT_TRAIL$ table.

Workaround:

1. Log in to SQL*Plus as a user who has been granted the DV_OWNER role.

2. Grant the DV_ADMIN role to the user account that was created on the source database for Audit Vault.

This issue is tracked with Oracle bug 7022650.

2.5 Time Values in Reports Do Not Display the Time Zone

The time values displayed in the Oracle Audit Vault reports do not display the time zone. Oracle Audit Vault bases the time zone value the TZ environment variable setting on Linux32 (other platforms vary) that was in place when you start the Audit Vault database. The Home page and all other pages in the Audit Vault Console explicitly use Coordinated Universal Time (UTC) and display the time zone. Therefore, if you start the Audit Vault database in a time zone other than UTC, the timestamps between different parts of the Audit Vault Console are different.

When you install Oracle Audit Vault, Oracle Universal Installer starts the database in UTC. If you then shut down and subsequently restart Audit Vault, time values in the reports can be different. As a result, you cannot determine which time zone in which the report was generated.

Workaround: Always start Oracle Audit Vault using the UTC. For example:

1. In a shell window, set the TZ environment variable to UTC.

setenv TZ UTC

2. Start the listener.

lsnrctl start

3. Start the Audit Vault database.

sqlplus sys/as sysoper
Enter password: password
Connected.
SQL> startup

4. Start the Audit Vault console.

avctl start_av

This issue is tracked with Oracle bug 7027265.

2.6 Audit Vault Duplicates FGA Policies if Policy Name Is Lower Case

If an auditor creates a fine-grained audit policy and then specifies the policy name using lower-case letters, then Oracle Audit Vault creates a duplicate fine-grained audit policy. The duplicate policy uses upper-case letters for the policy name.

Workaround: Use one of the following solutions:

- Choose a different policy name.

- Delete the fine-grained audit policy and then create a new one having same policy name with previous fine-grained audit policy.

This issue is tracked with Oracle bug 6975309.

2.7 SQL Server avmssqldb Command Returns Incorrect Warning Message

When you run the avmssqldb verify or avmssqldb setup command, and if the source user you specify does not have SYSADMIN privilege, then the avmssqldb command returns an error message claiming that you need the SYSADMIN privilege.

This error message is correct for SQL Server 2000 but incorrect for SQL Server 2005. For SQL Server 2005, you do not need the SYSADMIN privilege.

Workaround: You can ignore this message. The command succeeds in spite of the error message.

This issue is tracked with Oracle bug 7122168.

3 Source Configuration Issues

This section contains:

- Long Source Database Name Is Garbled in Top Five Audit Sources by Number of Alerts Graph

- Sybase and SQL Server Source and Audit Vault Event Times Differ

3.1 Long Source Database Name Is Garbled in Top Five Audit Sources by Number of Alerts Graph

If the source database has a long name and appears on the Y-axis of the graph Top Five Audit Sources by Number of Alerts, the graph is squeezed to the point that the X-axis becomes one dimensional and does not show the two-dimensional aspect of the graph.

Workaround: Create a reasonably short source name, about 15 characters long, using the -srcname srcname argument when you add the source to Oracle Audit Vault.

This issue is tracked with Oracle bug 6837441.

3.2 Sybase and SQL Server Source and Audit Vault Event Times Differ

The source database event time and Audit Vault event times differ for Sybase and SQL Server. This time difference is small, however.

Table 1 demonstrates this problem. In the values listed in the Audit Vault Timestamp column, there is a trailing, recurring last digit followed by zeros. For some cases, the leading zero is dropped. This could pose problems because the event_time value is usually used as a basis for co-relating events.

Table 1 Timestamp Differences Between the Source and Audit Vault Event Times

Source DB Timestamp

Audit Vault Timestamp

2008-03-13 15:27:44.773

2008-03-13 15:27:44.773333000

2008-03-13 15:28:48.056

2008-03-13 15:28:48.56667000

2008-03-13 15:28:55.103

2008-03-13 15:28:55.103333000

2008-03-13 15:28:57.76

2008-03-13 15:28:57.760000000

2008-03-13 15:29:00.086

2008-03-13 15:29:0.86667000

2008-03-13 15:29:52.883

2008-03-13 15:29:52.883333000

Workaround: None.

This issue is tracked with Oracle bug 6890264.

4 Collector Configuration Issues

This section contains:

- Collector Startup Can Be Slow

- SQL Server Collector Status Not Updated

- Invalid Path Error Appears in SQL Server Collector Log File

- DBAUD Collector Collects Invalid Object from Oracle Database Vault

- Invalid Error Message Appears After Failed Provisioning

- OSAUD Collector Log Contains Errors When Parsing XML Audit Files That Contain Japanese Characters

- OSAUD Collector Collects Records Multiple Times from SYSLOG when Log File Rotation Is Turned On

- SYBDB Collector Hangs if the sybsecurity Database Is Dropped With the Collector Running

- avsybdb setup Command Failure Results in Help Being Thrown on the Console

- OS Collector Does Not Pick Up the OSAUD_LOG_LEVEL Parameter from the Database

- Audit Records from SYSLOG Have the Wrong Date

- SYSLOG Files Are Garbled When Collected by the OSAUD Collector

- XML Audit Files Are Garbled When Collected by the OSAUD Collector

4.1 Collector Startup Can Be Slow

After several restarts, a collector can take a while to start. In most cases, when the avctl start_collector command is successful, the avctl show_collector_status command and Audit Vault Console indicate that the collector is running. However, in some cases the collector status may indicate that it is not running. This can be due to working in a slow environment and it takes more time to respond to the metrics query, or the collector is doing an initialization and recovery.

Workaround: Wait until the startup completes. Operations should be normal after the collector has finished starting. Before reperforming a collector status query, wait a bit longer. The collector status will eventually indicate a running state.

This issue is tracked with Oracle bug 5937597.

4.2 SQL Server Collector Status Not Updated

If you run the Audit Vault SQL Server avmssqldb command on the source database, and then try to start the SQL Server collector, the command succeeds but the collector status remains unchanged. It should show a status indicating that the SQL Server collector has started. To find if this error has occurred, check the $ORACLE_HOME/av/log directory of the Agent and see if the SQL Collector log file has a Generic Wallet Error. If this wallet error is present, then it is most likely this bug.

Typically, you follow these steps:

1. On the Audit Vault Server side, you add the source and collectors as follows:

avmssqldb add_source -srcname src_name ...
avmssqldb add_collector -collname collector_name ...

2. On the Audit Vault Agent side, you run the following set-up command:

avmssqldb setup -srcname src_name

3. Then, on the Audit Vault Server side, you run these commands:

avctl start_collector -srcname src_name -collname collector_name
avctl show_collector_status -srcname src_name -collname collector_name

If you omit Step 2, then no error displays when you run the avctl start_collector command in Step 3. When you run the avctl show_collector_status command next, then the status displays a not running message.

Workaround: Run the avmssqldb setup command on the agent, and then restart the collector.

This issue is tracked with Oracle bug 7010699.

4.3 Invalid Path Error Appears in SQL Server Collector Log File

The SQL Server collector log file erroneously states that the directory path specified by the C2_TRACE_FILEPATH attribute setting is incorrect.

Workaround: Specify the complete file name, with the wildcard asterisk (*) instead of .trc in the C2_TRACE_FILEPATH parameter. For example, if the file name is C:\MyTrace.trc, then specify the value C:\MyTrace*.

This issue is tracked with Oracle bug 7030424.

4.4 DBAUD Collector Collects Invalid Object from Oracle Database Vault

Violations to Oracle Database Vault settings (such as command rule violations) are not being properly recorded by the DBAUD collector. The violations are correctly recorded in the Database Vault DVSYS.AUDIT_TRAIL$ audit table. Oracle Audit Vault collects the audit record, but adds it to the Invalid Record audit event category instead of the Database Vault audit event category. The reason the record is invalid is because on Microsoft Windows, the PROCESS# column has a format process#:thread#. This string cannot be converted into number format.

In addition, the DBAUD collector log file includes related errors, similar to the following:

ERROR @ '25/04/2008 02:07:57 09:00':  On line 7613: OCI-22062: invalid input
string : [3708:3568]
WARNING @ '25/04/2008 02:07:57 09:00': errors are produced during converting
column PROCESS# at <3708:3568>

Workaround: None.

This issue is tracked with Oracle bug 7000223.

4.5 Invalid Error Message Appears After Failed Provisioning

Provisioning an invalid audit setting can result in an invalid error message. This error appears in the Audit Vault Console (under Audit Setting/Overview) after you click the Submit button. For example, suppose an auditor provisions a fine-grained audit policy using a source user who does not have the EXECUTE privilege for the DBMS_FGA PL/SQL package, which is required to create this type of policy. The provisioning will fail, and an error message unrelated to the problem appears, similar to the following:

collector ORCLDB_REDO is not deployed on the source.

Workaround: None.

This issue is tracked with Oracle bug 6994067.

4.6 OSAUD Collector Log Contains Errors When Parsing XML Audit Files That Contain Japanese Characters

If you set the Oracle Database AUDIT_TRAIL initialization parameter to XML or XML, EXTENDED, the OSAUD collector cannot parse XML files that contain Japanese words. An audit record appears in the XML file, but the audit record is not collected. The log file will have error messages similar to the following:

INFO @ '16/05/2008 07:14:19 09:00':
Collector all metrics = 1.0000:0.0000:0.0000
ERROR @ '16/05/2008 07:14:28 09:00':
Error while parsing file, E:\ORACLE\ADMIN\ORCL\ADUMP\ora_27064.xml,
error code 200.

Workaround: None.

This issue is tracked with Oracle bug 7109998.

4.7 OSAUD Collector Collects Records Multiple Times from SYSLOG when Log File Rotation Is Turned On

If log rotation is enabled and there are no new records in the log file after it has been rotated out, there will be a 0 byte syslog file. If the SYSLOG collector tries to access the syslog at that time, some audit records are collected again. It then re-archives all records in the existing syslog file.

Workaround: None.

This issue is tracked with Oracle bug 7109020.

4.8 SYBDB Collector Hangs if the sybsecurity Database Is Dropped With the Collector Running

Deleting the sybsecurity database results in the following message in the Collector log:

sysaudits_01 not found. Specify owner.objectname or use sp_help to check whether the object exists (sp_help may produce lots of output)

However, after you add the Sybsecurity database and then generate audit records, the Sybase collector fails to collect them. The collector status shows that it is running, but there is no subsequent data in Oracle Audit Vault.

Workaround: Shut down the SYBDB collector before dropping the sybsecurity database and then restart the SYBDB collect after the sybsecurity database has been recreated. Alternately, if the database is indeed dropped while the collector is running, stop the collector using the avctl stop_collector command and then restart the collector.

This issue is tracked with Oracle bug 7037266.

4.9 avsybdb setup Command Failure Results in Help Being Thrown on the Console

Incorrectly running the avsybdb setup command, such as specifying an incorrect -srcname value, causes help to be thrown on the console.

Workaround: None.

This issue is tracked with Oracle bug 7037146.

4.10 OS Collector Does Not Pick Up the OSAUD_LOG_LEVEL Parameter from the Database

The OS collector is not reading the OSAUD_LOG_LEVEL parameter. You cannot change this value using the Audit Vault Console.

Workaround:

1. Stop all the collectors running in the agent using the avctl stop_collector command on the server.

2. Stop the agent using the avctl stop_agent command on the server.

3. Stop OC4J using the avctl stop_oc4j command on the agent.

4. Start OC4J using the correct log level (avctl start_oc4j -loglevel error warning info debug).

5. Restart the agent and collectors.

This issue is tracked with Oracle bug 7008473.

4.11 Audit Records from SYSLOG Have the Wrong Date

Some records collected by the OSAUD collector from SYSLOG have the Event Time field set to a value one year in the past. This happens because of a bug in Oracle Audit Vault and because the SYSLOG file format does not contain year and time zone information for the timestamp. As a result, the SYSLOG collector does not pick up the debug level. The records are sent to the Audit Vault repository, but the activity graph does not display the records. There are no errors in the OS collector log. This problem occurs if you set the AUDIT_TRAIL initialization parameter to OS and the AUDIT_SYSLOG_LEVEL to syslog.info in the source database. It does not occur for the DB collector, REDO collector, OS Collector(XML), or OS Collector(Aud).

Workaround: None.

This issue is tracked in Oracle bug 7109942.

4.12 SYSLOG Files Are Garbled When Collected by the OSAUD Collector

If the source database is configured to send the audit trail to SYSLOG, and the audit trail contains multi-byte characters in non-UTF8 encodings, those characters are garbled in the Audit Vault repository.

Afterwards, data in the Audit Vault Repository is garbled. This problem occurs even if you start the agent and collector with correct NLS_LANG set.

Workaround: None.

This issue is tracked with Oracle bug 7046074.

4.13 XML Audit Files Are Garbled When Collected by the OSAUD Collector

Multi-bye words collected by the XML collector are garbled if you do the following in the source database:

If the source database is configured to send the audit trail to XML or XML, EXTENDED audit files, and the audit trail contains multi-byte characters in non-UTF8 encodings, those characters are garbled in the Audit Vault repository.

Afterwards, data in the Audit Vault Repository is garbled. This problem occurs even if you start the agent and collector with the correct NLS_LANG set.

Workaround: None.

This issue is tracked with Oracle bug 7045602.

5 Documentation Accessibility

Our goal is to make Oracle products, services, and supporting documentation accessible, with good usability, to the disabled community. To that end, our documentation includes features that make information available to users of assistive technology. This documentation is available in HTML format, and contains markup to facilitate access by the disabled community. Accessibility standards will continue to evolve over time, and Oracle is actively engaged with other market-leading technology vendors to address technical obstacles so that our documentation can be accessible to all of our customers. For more information, visit the Oracle Accessibility Program Web site at http://www.oracle.com/accessibility/.

Accessibility of Code Examples in Documentation

Screen readers may not always correctly read the code examples in this document. The conventions for writing code require that closing braces should appear on an otherwise empty line; however, some screen readers may not always read a line of text that consists solely of a bracket or brace.

Accessibility of Links to External Web Sites in Documentation

This documentation may contain links to Web sites of other companies or organizations that Oracle does not own or control. Oracle neither evaluates nor makes any representations regarding the accessibility of these Web sites.

TTY Access to Oracle Support Services

Oracle provides dedicated Text Telephone (TTY) access to Oracle Support Services within the United States of America 24 hours a day, 7 days a week. For TTY support, call 800.446.2398. Outside the United States, call +1.407.458.2479.

Oracle Audit Vault Release Notes, Release 10.2.3

E11061-01

Copyright © 2008, Oracle. All rights reserved.

The Programs (which include both the software and documentation) contain proprietary information; they are provided under a license agreement containing restrictions on use and disclosure and are also protected by copyright, patent, and other intellectual and industrial property laws. Reverse engineering, disassembly, or decompilation of the Programs, except to the extent required to obtain interoperability with other independently created software or as specified by law, is prohibited.

The information contained in this document is subject to change without notice. If you find any problems in the documentation, please report them to us in writing. This document is not warranted to be error-free. Except as may be expressly permitted in your license agreement for these Programs, no part of these Programs may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose.

If the Programs are delivered to the United States Government or anyone licensing or using the Programs on behalf of the United States Government, the following notice is applicable:

U.S. GOVERNMENT RIGHTS Programs, software, databases, and related documentation and technical data delivered to U.S. Government customers are "commercial computer software" or "commercial technical data" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the Programs, including documentation and technical data, shall be subject to the licensing restrictions set forth in the applicable Oracle license agreement, and, to the extent applicable, the additional rights set forth in FAR 52.227-19, Commercial Computer Software--Restricted Rights (June 1987). Oracle USA, Inc., 500 Oracle Parkway, Redwood City, CA 94065.

The Programs are not intended for use in any nuclear, aviation, mass transit, medical, or other inherently dangerous applications. It shall be the licensee's responsibility to take all appropriate fail-safe, backup, redundancy and other measures to ensure the safe use of such applications if the Programs are used for such purposes, and we disclaim liability for any damages caused by such use of the Programs.

Oracle, JD Edwards, PeopleSoft, and Siebel are registered trademarks of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.

The Programs may provide links to Web sites and access to content, products, and services from third parties. Oracle is not responsible for the availability of, or any content provided on, third-party Web sites. You bear all risks associated with the use of such content. If you choose to purchase any products or services from a third party, the relationship is directly between you and the third party. Oracle is not responsible for: (a) the quality of third-party products or services; or (b) fulfilling any of the terms of the agreement with the third party, including delivery of products or services and warranty obligations related to purchased products or services. Oracle is not responsible for any loss or damage of any sort that you may incur from dealing with any third party.

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2014, Oracle and/or its affiliates. All rights reserved.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information on content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services.

Alpha and Beta Draft Documentation Notice

If this document is in preproduction status:

This documentation is in preproduction status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.