22 Managing Auditing

This chapter covers only Oracle Internet Directory-specific information. See Oracle Fusion Middleware Application Security Guide for complete coverage of Audit Administration Tasks.

This chapter contains the following topics:

22.1 Introduction to Auditing

This introduction contains the following topics:

Auditing is the process that collects and stores information about security requests and the outcome of those requests, thus providing an electronic trail of selected system activity for non-repudiation purposes. Auditing can be configured to track particular security events and management operations based on specific audit criteria. Audit records are kept in a centralized repository (LDAP, database, or file) that allows the creation, viewing, and storage of audit reports.As of release 11g Release 1 (11.1.1), Oracle Internet Directory uses an audit framework that is integrated with Oracle Fusion Middleware. Oracle Internet Directory uses this framework to audit its critical security related operations.The features of the framework are:

  • APIs for collecting audit information from AS components

  • Common audit record format to be used by all AS components

  • Audit repository database that collects audit records produced by components in the enterprise. (The customer also has an option to use the Audit vault as a repository)

  • Administrative interface for controlling the type of information captured by the audit facility.

Before reading this chapter, please read the auditing chapters in the Oracle Fusion Middleware Application Security Guide.

The new Oracle Internet Directory audit framework has the following advantages:

  • It uses the same record format as other Oracle Application Server components.

  • Records are stored in Oracle Database tables for better performance and security.

  • Records can be stored in Audit Vault for increased security.

  • As administrator, you can configure the type of information captured in the audit records by using Enterprise Manager.

  • Configuration changes are effective immediately.

  • An administrator can view audit records:

    • In Enterprise Manager

    • In summary reports based on XML Publisher

All audit configuration performed by the instance administrator is audited. This cannot be disabled.

See Also:

Oracle Fusion Middleware Application Security Guide for information about configuring the audit repository and audit filters.

22.1.1 Configuring the Audit Store

You must configure an audit store to ensure that audit records are saved in a database. See the "Configuring and Managing Auditing" chapter in Oracle Fusion Middleware Application Security Guide for complete coverage of Audit Administration Tasks, including:

  • Managing the Audit Store

  • Advanced Management of Database Store

22.1.2 Oracle Internet Directory Audit Configuration

Audit configuration for Oracle Internet Directory consists of three attributes of the instance-specific entry:


Table 22-1 describes these attributes.

Table 22-1 Oracle Internet Directory Audit Configuration Attributes

Attribute Description


Presets are None, Low, Medium, All, and Custom, where Low specifies Account Management, Change Password and ModifyDataItemAttributes events and Medium specifies all events in Low plus Failed authentication events.


A comma-separated list of events and category names to be audited. Examples include:

Authorization(Permission -eq 'CSFPerfmission") 

Custom events are only applicable when orclAudFilterPreset is Custom.


A comma separated list of users for whom auditing is always enabled, even if orclAudFilterPreset is None. For example:


For more information, see the Oracle Fusion Middleware Application Security Guide.

22.1.3 Replication and Oracle Directory Integration Platform Audit Configuration

Replication and Oracle Directory Integration Platform auditing can be enabled by changing the value of the attribute orclextconfflag in the instance-specific configuration entry. The default value is 3, which disables both replication and Oracle Directory Integration Platform auditing. To enable both, change it to 7. This is the only change you can make to orclextconfflag, which is otherwise an internal attribute.

See "Enabling Replication and Oracle Directory Integration Platform Auditing".

22.1.4 Audit Record Fields

Audit records contain the following fields:

  • Event category–the class of event, such as authentication or authorization.

  • Event name

  • Initiator–the user who initiates the operation

  • Status–success or failure

  • Authentication method

  • Session ID–Connection ID

  • Target–the user on whom the operation is performed

  • Event date and time

  • Remote IP–source IP address of client

  • Component type–OID

  • ECID

  • Resource–entry or attribute on which operation is performed.

22.1.5 Audit Record Storage

Audit information is held temporarily in a location called a busstop before it is written to its final location.

The file is in the directory ORACLE_INSTANCE/auditlogs/componentType/componentName.

Audit files are permanently stored in either XML files or a database. XML files are the default storage mechanism for audit records. There is one XML repository for each Oracle instance. Audit records generated for all components running in a givenOracle instance are stored in the same repository. If using a database repository, audit records generated by all components in all Oracle instances in the domain are stored in the same repository.

22.1.6 Generating Audit Reports

See theOracle Fusion Middleware Application Security Guide chapter on audit analysis and reporting for information about generating audit reports.

22.2 Managing Auditing by Using Fusion Middleware Control

You can use Oracle Enterprise Manager Fusion Middleware Control to manage auditing. The interface is basically the same for all Oracle Fusion Middleware components, as documented in the Oracle Fusion Middleware Application Security Guide.

  1. From the Oracle Internet Directory menu, select Security, then Audit Policy Settings.

  2. From the Audit Policy list, select Custom to configure your own filters, or one of the filter presets, None, Low, or Medium. (You cannot set All from Fusion Middleware Control.)

  3. If you want to audit only failures, click Select Failures Only.

  4. To configure a filter, click the Edit icon next to its name. The Edit Filter dialog for the filter appears.

  5. Specify the filter condition using the buttons, selections from the menus, and strings that you enter. Condition subjects include HostID, HostNwaddr, InitiatorDN, TargetDN, Initiator, Remote IP, and Roles. Condition tests include -contains, -contains_case, endswith, endswith_case, -eq, -ne, -startswith, and -startswith-case. Enter values for the tests as strings. Parentheses are used for grouping and AND and OR for combining.

  6. To add a condition, click the Add icon.

  7. When you have completed the filter, click Apply to save the changes or Revert to discard the changes.

Oracle Internet Directory stores its audit configuration in the three instance-specific configuration entry attributes described in Table 22-1, "Oracle Internet Directory Audit Configuration Attributes". The correspondence between the fields on the Audit Policy Page and the attributes is shown in Table 22-2.

Table 22-2 Audit Configuration Attributes in Fusion Middleware Control

Field or Heading Configuration attribute

Audit Policy


Name, Select Failures Only, Enable Audit, Filter


Users to always audit


22.3 Managing Auditing by Using WLST

You can use wlst to manage auditing, as described in "Manage Audit Policies with WLST" in the Oracle Fusion Middleware Application Security Guide. You use the commands getAuditPolicy(),setAuditPolicy(), or listAuditEvents().

For component that manage their audit policy locally, such as Oracle Internet Directory, you must include an MBean name as an argument to the command. The name for an Audit MBean is of the form:


For example:


Another wlst command you must use is invoke(). As described in "Managing System Configuration Attributes by Using WLST", before you make any changes to attributes, you must ensure that the MBean has the current server configuration. To do that, you must use the invoke() command to load the configuration from Oracle Internet Directory server to the mbean. After making changes, you must use the invoke() command to save the MBean configuration to the Oracle Internet Directory server. In order to use invoke() in this way, you must navigate to the Root Proxy MBean in the tree. The name for a Root Proxy MBean is of the form:


For example:


Here is an example of a wlst session using setAuditPolicy() and invoke():

connect('username', 'password', 'localhost:7001')

22.4 Managing Auditing from the Command Line

You can manage auditing by using LDAP tools.

22.4.1 Viewing Audit Configuration from the Command Line

You can use ldapsearch to view audit configuration. For example:

ldapsearch -p 3060 -h myhost.example.com -D cn=orcladmin -q \ 
  -b "cn=oid1,cn=osdldapd,cn=subconfigsubentry" \
  -s base "objectclass=*" > /tmp/oid1-config.txt
grep orclaud oid1-config.txt
orclaudcustevents=UserLogin.FAILURESONLY, UserLogout, CheckAuthorization, 
 ModifyDataItemAttributes, CompareDataItemAttributes, ChangePassword.FAILURESONLY

22.4.2 Configuring Oracle Internet Directory Auditing from the Command Line

You can use ldapmodify commands to manage auditing. You must create an LDIF file to make the required changes to the attributes orclAudFilterPreset, orclAudCustEvents, and orclAudSplUsers.

The command is:

ldapmodify -D cn=orcladmin -q -p portNum -h hostname -f ldifFile

For example to enable auditing for user login events only, use this LDIF file with the preceding ldapmodify command:

dn: cn=componentname,cn=osdldapd,cn=subconfigsubentry
changetype: modify
replace: orclaudFilterPreset
orclaudFilterPreset: Custom
replace: orclaudcustevents
orclaudcustevents: UserLogin 

For more information, see the Oracle Fusion Middleware Application Security Guide.

22.4.3 Enabling Replication and Oracle Directory Integration Platform Auditing

The following LDIF file enables both replication and Oracle Directory Integration Platform auditing.

dn: cn=oid1,cn=osdldapd,cn=subconfigsubentry
changetype: modify
replace: orclextconfflag
orclextconfflag: 7

The following LDIF file disables both:

dn: cn=oid1,cn=osdldapd,cn=subconfigsubentry
changetype: modify
replace: orclextconfflag
orclextconfflag: 3

Use a command line similar to this:

ldapmodify -h host -p port -D "cn=orcladmin" -q -f ldiffile