This chapter provides a general description of the kind of testing that you might want to do for your collection plug-ins. Be sure to analyze your database and audit trails for other issues that require testing.
This chapter contains:
You should prepare for testing by performing the following:
Deploy the Audit Vault Server and an Audit Vault Agent, as described in "Before You Set Up the Development Environment".
Have an available source system, a system that generates the audit events.
Ensure that the agent is deployed on the same computer where the audit trail resides if the audit trail must be collected locally (for example, if it is written to operating system files).
The typical testing process as follows:
Perform functional testing:
Deploy the collection plug-in in the generated .zip archive that you created in Chapter 4, "Packaging Audit Collection Plug-ins," in your test Oracle Audit Vault Server environment.
Redeploy the agent (containing the updated plug-in artifacts) into your test Oracle Audit Vault agent environment, as described in "Redeploying the Oracle Audit Vault Agent".
Register the source using the AVCLI utility. See Oracle Audit Vault and Database Firewall Administrator's Guide.
Issue an AVCLI START COLLECTION command to start gathering records from the audit trail supported by this collection plug-in. See Oracle Audit Vault and Database Firewall Administrator's Guide.
Validate the process, by looking at the data reports through the AVDF Console, to ensure that:
- Records in the source are now in the Oracle Audit Vault Server.
- The data makes sense.
- Fields are correctly mapped.
- Values are valid.
Issue an AVCLI STOP COLLECTION command. See Oracle Audit Vault and Database Firewall Administrator's Guide.
Undeploy the collection plug-in. See Oracle Audit Vault and Database Firewall Administrator's Guide.
Redeploy the agent as described in Step 1b.
Perform failure testing to see what happens when various things go wrong.
Some examples of failure are network failure, a source shutting down in the middle of collection, a power outage, and malformed input data. In all cases, the collection plug-in should not crash, and should be able to recover gracefully, continuing collection from where it left off. The guarantee you need to provide is that each audit record is sent to the Audit Vault Server once, and exactly once, regardless of failure.
Analyze performance by checking how many of these components the collection plug-in uses:
- The CPU
- The memory
- The disk I/O
- The network I/O
Check the performance under stress.
Some examples of stress are thirty days of continuous use, heavy event volume, or collection of trails for multiple sources at the same time, both on the same host, and on multiple hosts.
Perform security testing (for example, see if you can inject HTML or SQL).
Perform internationalization testing. Test the ability to handle data in multiple input languages.
If bugs are found, fix them and then repeat these steps.
This agent can be on the same computer as the Audit Vault Server or a different one.
To deploy the agent, follow these steps:
Register the agent host using the AVCLI command REGISTER HOST. See Oracle Audit Vault and Database Firewall Administrator's Guide.
Create a directory ($AGENT_HOME) on the agent host.
Copy the agent.jar from the Audit Vault Server $ORACLE_HOME/av/jlib/agent.jar to the $AGENT_HOME.
Install the agent using following command:
$ java -jar agent.jar -d $AGENT_HOME
Send the activation request to the Audit Vault Server Administrator using the following command:
$ $AGENT_HOME/bin/agentctl activate
The Audit Vault Server Administrator must approve the activation request using either the following command or the Administrator Console.
avcli> activate host '<agent host>';
The activation key generated during the activation approval process must be sent to agent administrator.
Start the agent using the activation key provided by the Audit Vault Administrator:
$ $AGENT_HOME/bin/agentctl start -key <activation key>
Subsequently, starting the agent does not require the user to provide the activation key. The agent can be started using the following command:
$ $AGENT_HOME/bin/agentctl start
The agent can be stopped anytime using the following command:
$ $AGENT_HOME/bin/agentctl stop
It may take several seconds before the agent comes to a complete stop and the agent process is shutdown.
Activation is a one-time activity. You will not have to do it again.
You may need to redeploy the agent for various reasons while testing the collection plug-in. It is assumed that an agent is already set up and a directory created.
To redeploy the agent, follow these steps:
Copy the agent.jar from the Audit Vault Server to a local directory.
Update the agent by using the following command:
$ java -jar agent.jar -d $AGENT_HOME
Start the agent by invoking the $AGENT_HOME/bin/agentctl start command.
Note:
The agent automatically determines if it is an upgrade or a new install depending on the destination directory provided to thejava -jar agent.jar command.