Oracle® Enterprise Manager

System Monitoring Plug-in User's Guide

Release 12.1.0.3.0 for Audit Vault and Database Firewall

E50033-04

January 2015

Oracle Enterprise Manager System Monitoring Plug-in User's Guide, Release 12.1.0.3.0 for Audit Vault and Database Firewall

E50033-04

Copyright © 2015, Oracle and/or its affiliates. All rights reserved.

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Contents

Preface

- Audience

- Documentation Accessibility

- Related Documents

- Conventions

1 Introduction to the Oracle AVDF Plug-in

- 1.1 Versions Supported

- 1.2 Prerequisites

- 1.3 Known Issues

2 Installing the Enterprise Manager Management Agent

- 2.1 Manually Installing the Enterprise Manager Management Agent

- 2.1.1 Manually Installing the EM Management Agent on the Audit Vault Server

- 2.1.2 Manually Installing the EM Management Agent on the Database Firewall Appliance

3 Discovering the Oracle AVDF Target

- 3.1 Deploying the Plug-in

- 3.2 Discovering Targets

- 3.2.1 Discover Audit Vault Server 12.1 Target

- 3.2.2 Discover Database Firewall 12.1 Target

- 3.2.3 Discover Audit Vault Agent Target

4 Managing Oracle AVDF in Cloud Control

- 4.1 Installing the AV Agent

- 4.2 The AVDF Plug-in Home Page

- 4.3 Primary AVDF Plug-in Monitoring Overview

- 4.3.1 Audit Vault Agents

- 4.3.1.1 Audit Vault Agents List

- 4.3.1.2 Audit Vault Agent Summary Page

- 4.3.2 Audit Trails

- 4.3.2.1 Audit Trails List

- 4.3.2.2 Audit Trail Summary Page

- 4.3.3 Database Firewalls

- 4.3.3.1 Database Firewalls List

- 4.3.3.2 Database Firewall Summary Page

- 4.3.4 Enforcement Points

- 4.3.4.1 Enforcement Points List

- 4.3.4.2 Enforcement Points Summary Page

- 4.3.5 Secured Targets

- 4.3.5.1 Secured Targets Summary Page

- 4.4 Other AVDF Plug-in Monitoring

- 4.4.1 Summary Region

- 4.4.2 Auditor Activity Notifications

- 4.4.3 High Availability Information

- 4.4.4 Incidents and Problems

- 4.5 Upgrading the Plug-in

- 4.6 Undeploying the Plug-in

Index

Preface

This document provides the installation, configuration, and management instructions for the Oracle Audit Vault and Database Firewall plug-in through Enterprise Manager Cloud Control 12c.

Audience

This document is intended for administrators and users of Oracle Audit Vault and Database Appliance.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.

Related Documents

For more information about Oracle Audit Vault and Database Firewall or Oracle Enterprise Manager Cloud Control, see the following documentation:

- Oracle Audit Vault and Database Firewall documentation:

- Oracle Audit Vault and Database Firewall Administrator's Guide

- Oracle Audit Vault and Database Firewall Auditor's Guide

- Oracle Audit Vault and Database Firewall product page:

http://www.oracle.com/technetwork/database/database-technologies/audit-vault-and-database-firewall/overview/index.html

Visit the Oracle Audit Vault and Database Firewall documentation library:

http://docs.oracle.com/cd/E37100_01/index.htm

- Oracle Enterprise Manager Cloud Control documentation:

- Oracle Enterprise Manager Cloud Control Administrator's Guide

Visit the Oracle Enterprise Manager Cloud Control documentation library:

http://docs.oracle.com/cd/E24628_01/index.htm

Conventions

The following text conventions are used in this document:

Convention

Meaning

boldface

Boldface type indicates graphical user interface elements associated with an action, or terms defined in text or the glossary.

italic

Italic type indicates book titles, emphasis, or placeholder variables for which you supply particular values.

monospace

Monospace type indicates commands within a paragraph, URLs, code in examples, text that appears on the screen, or text that you enter.

1 Introduction to the Oracle AVDF Plug-in

The Oracle Audit Vault and Database Firewall (AVDF) plug-in provides an interface within Enterprise Manager Cloud Control for administrators to manage and monitor Audit Vault and Database Firewall components.

The following topics are discussed:

- Versions Supported

- Prerequisites

- Installing the Enterprise Manager Management Agent

- Discovering the Oracle AVDF Target

- Managing Oracle AVDF in Cloud Control

- Known Issues

1.1 Versions Supported

The Oracle AVDF plug-in supports the following versions of products:

- Enterprise Manager Cloud Control 12c Release 2 (12.1.0.3.0) or higher.

- Oracle Audit Vault and Database Firewall Release 12.1.1 or higher.

1.2 Prerequisites

The following prerequisites must be met before you can deploy the Management Agent:

- A user (such as, AVAdmin) on the Audit Vault (AV) Server that has Super Admin privileges (refer to the Oracle Audit Vault and Database Firewall Administrator's Guide).

- The password for the root user on the AV Server.

- The fully qualified names and IP addresses for each AVDF server.

- The password for the support user on the AVDF servers.

- There is no need for physical access to the servers. You will log in as the support user and run the su command to become the root user (and then later to become oracle user).

- Information about your Oracle Enterprise Manager Cloud Control 12c instance:

- OMS host name.

- OMS port.

This information can be obtained with the following command:

emctl status oms -details -sysman_pwd <password>

1.3 Known Issues

While the AVDF plug-in release 12.1.0.3 automates many of the installation steps, the AVDF plug-in for the Windows environment has a known issue where installation of the AV agent must be completed manually.

2 Installing the Enterprise Manager Management Agent

This chapter provides the instructions for installing the Enterprise Manager (EM) Management Agent onto the Audit Vault Server and Database Firewall Appliance.

Follow the steps below to install the EM Management Agent:

- Manually Installing the Enterprise Manager Management Agent

2.1 Manually Installing the Enterprise Manager Management Agent

Follow the steps below to install the Enterprise Manager (EM) Management Agent manually:

1. Manually Installing the EM Management Agent on the Audit Vault Server

2. Manually Installing the EM Management Agent on the Database Firewall Appliance

Once installed, you will then install or configure the EM Management Agent on each server where an AVDF agent resides.

2.1.1 Manually Installing the EM Management Agent on the Audit Vault Server

Before installing the EM Management Agent on the Audit Vault Server, the hostname must be set and the DNS must be configured:

1. Log in to the Audit Vault Server console as a user with the AV_ADMIN role.

2. Set the hostname to a fully qualified hostname (for example, location.mycompany.com). On the Audit Vault server console, click Settings, then Network under the Systems group header. On the Network page, set the hostname.

3. Configure the DNS on each appliance, which are to be monitored, to be the same as that on the OMS server. Click Settings, then Services under the System group header. On the Services page, configure the DNS.
By default, SSH access into Audit Vault Server and Database Firewall is disabled. For the following steps, SSH is required. Therefore, on the same Services page, replace disabled inside the SSH box either with the IP address of the machine from which you will connect or with all to allow SSH connections from all machines on the network.

Follow the steps below to download and install the EM Management Agent on the Audit Vault Server:

1. Log in to the operating system of the Audit Vault Server as the root user.

2. Unblock the network port through which the EM Management Agent and the Enterprise Manager server communicate:

Note:
Changes made here to the template-iptables file might be rolled back by a subsequent Oracle Audit Vault and Database Firewall patch or upgrade. If you notice after applying the next patch or upgrade that Enterprise Manager is no longer collecting information about AV Server correctly, then repeat steps 2a and 2b below.

1. Edit the file /usr/local/dbfw/templates/template-iptables file with the following entry:

Note:
By default, the permissions for this file is read-only. You must change the permissions to allow editing, edit the file, and then change the permissions back to read-only:

1. As root, change the permissions of the template-iptables file:

# chmod 644 template-iptables

2. Edit the line as described below.

3. Change the permissions of the template-iptables file back to read-only:

# chmod 444 template-iptables

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW --dport 3872 -j ACCEPT

There may be similar entries already for database listener ports. Make your entry below them.

WARNING:

Take extreme care when modifying the template-iptables file. Any mistakes here could make the system inoperable.

Only make this change and no other.

2. Run the following command as root:

# /usr/local/dbfw/bin/priv/configure-networking

3. Test your change. If port 3872 is used (this port is officially registered with IANA by Oracle for oem-agent), use:

iptables -L | grep oem

If another port was used, use:

iptables -L -n | grep <port number>

You will see that there is now an ACCEPT rule for the Management Agent.

3. While logged in as the root user on the Audit Vault Server, run the following command to become the oracle user:

# su - oracle

4. Download the AgentPull.sh script as follows:

$ cd /tmp
$ curl "https://<OMS_HOST>:<OMS_PORT>/em/install/getAgentImage" -k -o AgentPull.sh

5. Give execute permission to the AgentPull.sh script:

$ chmod +x AgentPull.sh

6. Create a response agent.rsp file:

LOGIN_USER=sysman
PLATFORM="Linux x86-64"

7. Run the AgentPull.sh script to download and install the Management Agent:

$ ./AgentPull.sh RSPFILE_LOC=/tmp/agent.rsp AGENT_BASE_DIR=/var/lib/oracle/emagent ORACLE_HOSTNAME=location.mycompany.com AGENT_PORT=3872

Where ORACLE_HOSTNAME is the fully qualified hostname of the Audit Vault Server where the EM Management Agent is being installed.

Note:
You will be prompted for two passwords immediately upon executing this command.

The installation of the EM Management Agent starts automatically as soon as the download has finished. At the end of the installation, you will be prompted to run a script as root.

After running that script, continue with Discovering the Oracle AVDF Target.

2.1.2 Manually Installing the EM Management Agent on the Database Firewall Appliance

Before installing the Enterprise Manager (EM) Management Agent on the Database Firewall appliances, the hostname must be set and the DNS must be configured:

1. Log in to Database Firewall appliance console as a user with Firewall Admin privileges.

2. Set the hostname to a fully qualified hostname (for example, location.mycompany.com). On the Database Firewall console, click Network under the System header, and then click the Change button on the lower right-hand corner of the page.

3. Configure the DNS to be the same as that on the OMS server. Click System and then Services. On the Services page, configure the DNS.
By default, SSH access into Database Firewall is disabled. For the following steps, SSH is required. Therefore, on the same Services page, replace disabled inside the SSH box either with the IP address of the machine from which you will connect or with all to allow SSH connections from all machines on the network.

Follow the steps below to download and install the EM Management Agent on the Database Firewall appliance:

1. Log in to the operating system of the Database Firewall appliance as the root user.

2. Unblock the network port through which the EM Management Agent and the Enterprise Manager server communicate:

Note:
Changes made here to the template-iptables file might be rolled back by a subsequent Oracle Audit Vault and Database Firewall patch or upgrade. If you notice after applying the next patch or upgrade that Enterprise Manager is no longer collecting information about Database Firewall correctly, then repeat steps 2a and 2b below.

1. Edit the file /usr/local/dbfw/templates/template-iptables file with the following entry:

Note:
By default, the permissions for this file is read-only. You must change the permissions to allow editing, edit the file, and then change the permissions back to read-only:

1. As root, change the permissions of the template-iptables file:

# chmod 640 template-iptables

2. Edit the line as described below.

3. Change the permissions of the template-iptables file back to read-only:

# chmod 440 template-iptables

-A RH-Firewall-1-INPUT -p tcp -m state --state NEW --dport 3872 -j ACCEPT

There may be similar entries already for database listener ports. Make your entry below them.

WARNING:

Take extreme care when modifying the template-iptables file. Any mistakes here could make the system inoperable.

Only make this change and no other.

2. Run the following command:

# /usr/local/dbfw/bin/priv/configure-networking

3. Test your change. If port 3872 is used (this port is officially registered with IANA by Oracle for oem-agent), use:

iptables -L | grep oem

If another port was used, use:

iptables -L -n | grep <port number>

You will see that there is now an ACCEPT rule for the Management Agent.

3. While logged in as the root user on the Audit Vault Server, run the following command to become the oracle user:

# su - oracle

4. Download the AgentPull.sh script as follows:

$ cd /tmp
$ curl "https://<OMS_HOST>:<OMS_PORT>/em/install/getAgentImage" -k -o AgentPull.sh

5. Give execute permission to the AgentPull.sh script:

$ chmod +x AgentPull.sh

6. Create a response agent.rsp file:

LOGIN_USER=sysman
PLATFORM="Linux x86-64"

7. Run the AgentPull.sh script to download and install the Management Agent:

$ ./AgentPull.sh RSPFILE_LOC=/tmp/agent.rsp AGENT_BASE_DIR=/var/lib/oracle/emagent ORACLE_HOSTNAME=location.mycompany.com AGENT_PORT=3872

Where ORACLE_HOSTNAME is the fully qualified hostname of the Database Firewall where the EM Management Agent is being installed.

Note:
You will be prompted for two passwords immediately upon executing this command.

The installation of the EM Management Agent starts automatically as soon as the download has finished. At the end of the installation, you will be prompted to run a script as root.

After running that script, continue with Discovering the Oracle AVDF Target.

3 Discovering the Oracle AVDF Target

Before you can begin monitoring Oracle Audit Vault and Database Firewall, it must first be discovered by Oracle Enterprise Manager Cloud Control 12c. This chapter describes the necessary steps for discovering the Oracle AVDF target:

1. Deploying the Plug-in.

2. Discovering Targets:

1. Discover Audit Vault Server 12.1 Target.

2. Discover Database Firewall 12.1 Target.

3. Discover Audit Vault Agent Target.

3.1 Deploying the Plug-in

You can deploy plug-ins to an OMS instance using the Enterprise Manager Cloud Control interface or the EM Command Line Interface (EMCLI). While the graphical interface mode enables you to deploy one plug-in at a time, the command line interface mode enables you to deploy multiple plug-ins at a time, thus saving plug-in deployment time and downtime, if applicable.

The Managing Plug-ins chapter in the Oracle Enterprise Manager Cloud Control Administrator's Guide provides instructions for deploying the plug-in:

http://docs.oracle.com/cd/E24628_01/doc.121/e24473/plugin_mngr.htm

Complete the following sections to deploy the AVDF plug-in on:

- Your Management Server (performed within Enterprise Manager Cloud Control). See the "Deploying Plug-Ins to Oracle Management Service" section for details:

http://docs.oracle.com/cd/E24628_01/doc.121/e24473/plugin_mngr.htm#CJGCDHFG

- Your Management Agent (AV Server, performed within Enterprise Manager Cloud Control). See the "Deploying Plug-Ins on Oracle Management Agent" section for details:

http://docs.oracle.com/cd/E24628_01/doc.121/e24473/plugin_mngr.htm#CJGBIAGJ

Once completed, return and continue with the instructions outlined in Discovering Targets.

3.2 Discovering Targets

After successfully installing the Management Agent and deploying the plug-in, follow the steps below to add the following targets to Enterprise Manager Cloud Control for central monitoring and management:

- Discover Audit Vault Server 12.1 Target

- Discover Database Firewall 12.1 Target

- Discover Audit Vault Agent Target

3.2.1 Discover Audit Vault Server 12.1 Target

Follow the steps below to add the Oracle Audit Vault Server 12.1 target:

1. Log in to Enterprise Manager Cloud Control.

2. Click Setup, then Add Targets, and finally Configure Auto Discovery.

3. On the next page, select to highlight All Discovery Modules (do not select Discover Audit Vault and Database Firewall Entities), as shown in Figure 3-1.

Figure 3-1 Configure Auto Discovery

4. Click the wrench icon to Configure Discovery on Hosts.

5. On the next page, highlight the row that contains the host name of your AV Server and click Configure Discovery Modules.

6. Confirm that Discover Audit Vault and Database Firewall Entities and Oracle Database, Listener and Automatic Storage Management are enabled.
Click OK.

7. Returning to the previous page, highlight the hostname of the Oracle Audit Vault Server and click Run Discovery Now. A pop-up window will appear while the discovery is in progress.

8. Rename the Audit Vault Server and Database Firewall instances:

1. Click Setup, then Add Target, and finally Auto Discovery Results.

2. Click the Agent-based Targets tab.

3. In the Target Type column, look for Oracle Audit Vault and Database Firewall, this is your Audit Vault Server. Highlight the row and click Rename to rename it to any meaningful name, such as AVServer_Legal_and_HR.

4. Next, highlight the row with Database Instance as a target type. Click Rename to rename it to any meaningful name, such as AVS_Repository.

9. Promote the Audit Vault Server (AV Server):

1. Highlight the row of the Audit Vault Server and click Promote.

2. On the next page, provide user name and password of the AV Server user with AV_ADMIN privilege. The Preferred Connect String should be populated already. However, if it is not, go to the AV Server Web administration console and log in as a user with the AV_ADMIN privilege. Click Settings, then Status, and copy the preferred connect string from there. The ORACLE_HOME is:

/var/lib/oracle/dbfw

3. Click Promote.

10. Promote AV Repository Database instance:

1. Highlight the row with the AVS_Repository database instance. Click on Promote.

2. On the next page, check AVS_Repository and click Configure.

3. Enter the Monitor password (user is dbsnmp, unlock the account in the AVS repository database), change the port from 1522 to 1521, and change the Listener Machine Name to the fully qualified hostname of your AV Server.

4. Click Test Connection; when successful, click Save.

11. Back on the previous page, click Next. On the following page, click Save.

12. To navigate to your new AV Server home page in Enterprise Manager Cloud Control:

1. From the Targets menu, select All Targets.

2. Expand the Others list item.

3. Select Oracle Audit Vault and Database Firewall. The AV repository database is listed under Targets, Databases.

3.2.2 Discover Database Firewall 12.1 Target

Follow the steps below to add the Oracle Database Firewall 12.1 target:

1. Log in to Enterprise Manager Cloud Control.

2. Click Setup, then Add Targets, and finally Configure Auto Discovery.

3. On the next page, select to highlight All Discovery Modules (do not select Discover Audit Vault and Database Firewall Entities), as shown in Figure 3-1.

4. Click the wrench icon to Configure Discovery on Hosts.

5. On the next page, highlight the row that contains the host name of your DBFW Server and click Configure Discovery Modules.

6. Confirm that Discover Audit Vault and Database Firewall Entities and Oracle Database, Listener and Automatic Storage Management are enabled.
Click OK.

7. Returning to the previous page, highlight the hostname of the Oracle Database Firewall Server and click Run Discovery Now. A pop-up window will appear while the discovery is in progress.

8. Rename the Audit Vault Server and Database Firewall instances:

1. Click Setup, then Add Target, and finally Auto Discovery Results.

2. In the Target Type column, look for Database Firewall, this is your Database Firewall Server. Highlight the row and click Rename to rename it to any meaningful name, such as DBFW_Legal_and_HR.

3. Next, highlight the row with Database Instance as a target type. Click Rename to rename it to any meaningful name, such as DBFW_Repository.

9. Promote the Database Firewall Server (DBFW Server):

1. Highlight the row of the DBFW Server and click Promote.

2. On the next page, provide user name and password of the AV Server user with AV_ADMIN privilege. The Preferred Connect String should be populated already. However, if it is not, go to the AV Server Web administration console and log in as a user with the AV_ADMIN privilege. Click Settings, then Status, and copy the preferred connect string from there. Replace the IP address with the hostname of the AV Server; confirm ports are set to 1521.

Note:
The DBFW Server is managed through the AV Server. When promoting the DBFW Server, you will still provide all the credentials for the AV Server.

3. Click Promote. After clicking Promote, the console will ask for credentials again. Use the av_admin privilege credential of the AVDF Server.

Note:
There is no need to promote the Database Firewall Repository instance.

10. Back on the previous page, click Next. On the following page, click Save.

11. To navigate to your new AV Server home page in Enterprise Manager Cloud Control:

1. From the Targets menu, select All Targets.

2. Expand the Others list item.

3. Select Database Firewall. The DBFW repository database is listed under Targets, Databases.

3.2.3 Discover Audit Vault Agent Target

Discovery of the Audit Vault (AV) Agent also can be done using automated discovery. Similar to other AVDF targets, you can run discovery on the host where the AV Agent is installed. The discovery script identifies the AV Agent and includes it with the discovered targets, which could be promoted by providing the Oracle home of the AV Agent and AVDF server AV_Admin credential.

Note:
In order to manage an Audit Vault agent with Enterprise Manager Cloud Control, a Management Agent needs to be present on the machine where the Audit Vault agent is about to be deployed.

Follow the steps below to add the Oracle Audit Vault agent target:

1. Log in to Enterprise Manager Cloud Control.

2. Click Setup, then Add Targets, and finally Add Targets Manually.

3. Select Add Targets Declaratively by Specifying Target Monitoring Properties.

4. From the Target type drop-down select the Audit Vault Agent target type. Then, for the Monitoring Agent, select the Enterprise Manager agent installed on the host on which the AV Agent is installed.
For example, if the AV Agent is installed on host1.mycompany.com, then you would need to search for the Enterprise Manager Agent (Monitoring Agent) on host1.mycompany.com. To search for the Monitoring Agent, click on the search icon to open a pop-up window with all the Enterprise Manager agents associated with this instance of Enterprise Manager.

5. Click Add Manually.

6. Follow the prompts for the Add Targets wizard to complete the process, including the following property settings:

- AV Agent Name - The host agent name as it appears in AVDF console.

- AV Agent Home - The location where the AV Agent is installed.

- AVDF Monitor UserName - The user with the AV_ADMIN role on the AVDF repository.

- AVDF Monitor Password.

- AVDF Server Connect String.
You can get the connect string information from the AVDF server user interface:

1. Log in to the AVDF Server using AV_ADMIN credential.

2. Select Settings. In the left hand side list, under System, select click Status.

3. In the Status block, the AVDF Server Connect String is listed. It should look like this:

Connect String (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=<host IP>)(PORT=1521))(CONNECT_DATA= (SERVICE_NAME=DBFWDB.DBFWDB)))

- Associated Oracle AVDF Target - Optional. Name of the Enterprise Manager target of the corresponding AVDF.

4 Managing Oracle AVDF in Cloud Control

This chapter describes the various regions displayed on the Audit Vault and Database Firewall (AVDF) plug-in home page and includes the monitoring capabilities. The following topics are provided:

- Installing the AV Agent

- The AVDF Plug-in Home Page

- Primary AVDF Plug-in Monitoring Overview

- Primary AVDF Plug-in Monitoring Overview

- Audit Vault Agents

- Audit Trails

- Database Firewalls

- Enforcement Points

- Secured Targets

- Other AVDF Plug-in Monitoring

- Summary Region

- Auditor Activity Notifications

- High Availability Information

- Incidents and Problems

- Upgrading the Plug-in

- Undeploying the Plug-in

4.1 Installing the AV Agent

As part of the set up of Enterprise Manager Cloud Control 12c, most hosts and targets are already discovered by Enterprise Manager. As part of Enterprise Manager, you can use this setup to install Audit Vault Agents and Sources:

To install an Audit Vault Agent:

1. On the Audit Vault listing page, click Install.
A new page will display which has a hosts table and an Add/Remove button. Initially, the host table is blank.

2. Click Add to bring up a pop-up window to search and add hosts for which the installation should happen. The pop-up window should only show those hosts where the AVDF plug-in is installed and where the host does not yet have the AV Agent installed.

3. Enterprise Manager will auto compute the AV Agent installation directory based on the Enterprise Manager Agent installation directory. You will have an option to change the directory.

4. Select the hosts you want to install the AV Agent. For those hosts you select, Enterprise Manager will show:

- Host name, operating system, and platform details.

- Agent installation directory.

- A drop-down with all the credentials stored in Enterprise Manager. If none of those are credentials for the particular host, then click on the new credential and provide new credential information in the pop-up window. This information will be saved for future reference.
You can either chose credentials for each host individually or click the default host credential and provide one credential applicable on all hosts.

Note:
If you choose the default host credential and still provide a credential for some other host in the host details table, then the credential provided in the column will override the default credential.

5. Click Submit to initiate the job (one per host) for the AV Agent setup.
After the job is submitted, the AV listing page is displayed.

6. To monitor the progress, click the refresh button to see the new AV Agents added to the system.
For any jobs that fail, use the EM Jobs page to diagnose the failure. As part of the job execution, Enterprise Manager will log any relevant information to aid the AV Administrator for diagnosing the issue.

4.2 The AVDF Plug-in Home Page

Once installed and configured, you can monitor Oracle Audit Vault and Database Firewall from Enterprise Manager Cloud Control, as shown in Figure 4-1. Each section and region of this page is described in Primary AVDF Plug-in Monitoring Overview.

Figure 4-1 Oracle AVDF Plug-in Home Page in Cloud Control

4.3 Primary AVDF Plug-in Monitoring Overview

The regions described below provide high-level information about the status or performance of the Audit Vault Server and Database Firewall Appliance.

From the Oracle Audit Vault and Database Firewall plug-in home page, you can monitor the following information:

- Audit Vault Agents

- Audit Trails

- Database Firewalls

- Enforcement Points

- Secured Targets

4.3.1 Audit Vault Agents

This region shows the status information and configuration issues of all Audit Vault Agents monitored by Audit Vault and Database Firewall, not only monitored by Enterprise Manager as an Enterprise Manager target. It also shows the information about the Audit Vault Agents not monitored by Enterprise Manager as an Enterprise Manager target.

A graph shows if the agent is down, in progress, unreachable, or up. (See Figure 4-2.)

Figure 4-2 Audit Vault Agents Region

For a detailed report (Audit Vault Agents List), select Audit Vault Agents from the Oracle Audit Vault and Database Firewall menu or click the Audit Vault Agents title on the Oracle AVDF home page.

4.3.1.1 Audit Vault Agents List

This page lists all of the Audit Vault Agents monitored by Audit Vault and Database Firewall. The following information is available:

- Name: The name of the Audit Vault Agent. Click the link in this column for a detailed Audit Vault Agent Summary Page of the Audit Vault agent.

- Version: The version of the Audit Vault Agent

- Status: Identifies if the agent is Up, Down, Unreachable, Not Activated, etc.

- Audit Vault Agent Location: The directory path for where the Audit Vault Agent is located.

- Activation Key: Key using which Audit Vault Agent has been activated.

- Activation Time: Time since when the Audit Vault Agent has been activated.

- Incidents: The number of incidents logged against a particular agent (it may or may not be monitored by Enterprise Manager Cloud Control) and all the audit trails managed by it. Incidents have a state of Fatal, Critical, Warning, and Escalated.

4.3.1.2 Audit Vault Agent Summary Page

This page provides detailed information about a particular Audit Vault Agent.

From the Audit Vault Agent home page, you can monitor the following information:

Errors & Messages

This region shows a high-level list of any important messages about the status and activity of the Audit Vault Agent.

Summary

This region shows high-level information about the Audit Vault Agent, including:

- Name: the name of the Audit Vault Agent

- Version: the version of the Audit Vault Agent

- Audit Vault Server: the name of the Audit Vault Server to which the Audit Vault Agent is associated

- Creation Time:

- Activation Time:

- Activation Key:

- Platform: the operating system of the Audit Vault Agent

- Audit Trails: the number of audit trails associated with the Audit Vault Agent

- Secured Targets: the number of secured targets monitored by the Audit Vault Agent

Audit Trails

This region provides a high-level summary of any audit trail available for the Audit Vault Agent. The following information is provided:

- Audit Trail ID: the unique identifier for any audit trail available for the Audit Vault Agent. Click the link in this column for a detailed audit trail summary.

- Secured Target

- Status

- Type

- Time Since Last Upload

- Throughput (records/sec): the number of records per second the Audit Trail is uploading to the Audit Vault Server

- Incidents

Incidents and Problems

This region provides a summary of any reported incident or problem. If there is an incident or problem listed, click the link in the Message column to show details in the Incident Manager feature of Enterprise Manager Cloud Control.

4.3.2 Audit Trails

Like Audit Vault Agents region, the Audit Trails region (Figure 4-3) shows status information for all the audit trails in the Audit Vault and Database Firewall system. It shows since how long the data upload issues exist.

Figure 4-3 Audit Trails Region

For a detailed report (Audit Trails List), select Audit Trails from the Oracle Audit Vault and Database Firewall menu or select the Audit Trails title from the Oracle AVDF home page.

4.3.2.1 Audit Trails List

This page lists all of the audit trails monitored by the Audit Vault and Database Firewall plug-in. The following information is available:

- Audit Trail ID: the unique identifier for any audit trail available for an Audit Vault Agent. Click the link in this column for a detailed Audit Trail Summary Page.

- Location:

- Secured Target:

- Status: identifies if the secured target is Up, Down, Idle, Unreachable, Not Activated, etc.

- Audit Vault Agent: lists the host name of the Audit Vault Agent. Click the link to display that agent's home page summary.

- Type:

- Time Since Last Updated: The elapsed time since the last upload. This represents the time since when the audit trails has not uploaded any audit data into Audit Vault and Database Firewall repository.

- Throughput: shows the number of queries audited per second.

- Incidents: Identifies the number of incidents logged against an audit trail. Incidents have a state of Critical, Warning, and Escalated.

4.3.2.2 Audit Trail Summary Page

This page provides detailed information about a particular audit trail for an Audit Vault Agent. The following sections are provided:

Audit Trail Summary

This region shows high-level information about the audit trail of an Audit Vault Agent, including

- Audit Trail Status: identifies if the Audit Vault Agent is Up, Down, Unreachable, Not Activated, etc.

- Unreachable Since: shows a timestamp of when the Audit Vault Agent was first identified as unreachable

- Audit Trail Type:

- Audit Trail Location:

- Time Since Last Upload: the elapsed time since the last upload. This represents the time since when the audit trails has not uploaded any audit data into Audit Vault and Database Firewall repository

- Audit Vault Server: the name of the server where the Audit Vault Agent is installed

Secured Targets Details

This region shows a high-level summary of a particular Secured Target, including:

- Name: the name of the Secured Target

- Type: the type of the Secured Target

- Host: the IP address of the Secured Target

- Port:

Performance

This region provides a graph of the throughput per second data over a particular time. Click the Duration drop-down menu to select a time frame.

Errors & Messages

This region shows a high-level list of any important messages about the status and activity of the Audit Vault Agent.

Incidents and Problems

This region provides a summary of any reported incident or problem. If there is an incident or problem listed, click the link in the Message column to show details in the Incident Manager feature of Enterprise Manager Cloud Control.

4.3.3 Database Firewalls

Like the Audit Vault Agents region, the Database Firewalls region (Figure 4-4) shows all of the firewalls in the Audit Vault and Database Firewall system, not only the one monitored by Enterprise Manager as an Enterprise Manager target. This section also shows the count of Database Firewalls not monitored by Enterprise Manager as an Enterprise Manager target.

Figure 4-4 Database Firewalls Region

For a detailed report (Database Firewalls List), select Database Firewalls from the Oracle Audit Vault and Database Firewall menu.

4.3.3.1 Database Firewalls List

This page lists all of the Database Firewalls monitored by the Audit Vault and Database Firewall plug-in. The following information is available:

- Firewall: The Database Firewall name for all Database Firewalls in the Audit Vault and Database Firewall system - whether they are monitored by Enterprise Manager or not. Click the link for a detailed Database Firewall Summary Page for the selected Database Firewall.

- Status: Identifies if the firewall is Up, Down, Idle, Unreachable, Not Activated, etc.

- Firewall Host: Depending on the information available, this field displays:

- The host name when available. The IP address of the Database Firewall host is shown as a tooltip of the host name.

- The IP address of the Database Firewall host.

- Role: This field shows whether the firewall has primary or secondary role in a High Availability (HA) configuration. If the Database Firewall is not HA configured, then this would be standalone.

- Incidents: Identifies the number of incidents logged against a particular Database Firewall, whether monitored by Enterprise Manager Cloud Control or not. Incidents have a state of Critical, Warning, and Escalated

4.3.3.2 Database Firewall Summary Page

This page provides detailed information about a particular Database Firewall. The following sections are provided:

Summary

This region shows high-level information about the Database Firewall, including:

- Name: the name of the Database Firewall

- Version: the version of the Database Firewall

- Audit Vault Server: the name of the server where the Database Firewall is installed

- Firewall Host: Depending on the information available, this field displays:

- The host name when available. The IP address of the Database Firewall host is shown as a tooltip of the host name.

- The IP address of the Database Firewall host.

- Role: This field shows whether the firewall has primary or secondary role in a High Availability (HA) configuration. If the Database Firewall is not HA configured, then this would be standalone.

- Enforcement Points: the number of enforcement points associated with the Database Firewall

- Secured Targets: the number of secured targets protected by the Database Firewall

Enforcement Points

This region shows a high-level, table summary for all enforcement points associated with a particular Database Firewall. The information displayed includes:

- Enforcement Point: the name of the enforcement point for a particular Database Firewall. Click the link for a detailed summary of the enforcement point.

- Status: identifies if the enforcement point is Up, Down, Idle, Unreachable, Not Activated, etc.

- Monitoring Mode:

- Database Activity Monitoring (DAM): monitors the activity of the database.

- Database Policy Enforcement Mode (DPM): blocks activity if a policy violation occurs.

- Firewalls: lists the Database Firewalls associated with a particular enforcement point.

- Secured Target: identifies the name of the secured target. Click the link for a pop-up window with a detail summary.

- Time Since Last scan: The time since the enforcement point last scanned any query.

- Throughput: shows the number of queries audited per second.

- Incidents: Identifies the number of incidents logged against an enforcement point. Incidents have a state of Critical, Warning, and Escalated

High Availability

This region shows a high-level summary of the high availability (HA) support provided for the Database Firewall, including:

- Secondary Firewall:

- Secondary Firewall Host: Depending on the information available, this field displays:

- The host name when available. The IP address of the secondary Database Firewall host is shown as a tooltip of the host name.

- The IP address of the secondary Database Firewall host.

Incidents and Problems

This region provides a summary of any reported incident or problem. If there is an incident or problem listed, click the link in the Message column to show details in the Incident Manager feature of Enterprise Manager Cloud Control.

4.3.4 Enforcement Points

This region (Figure 4-5) shows a high-level status of the enforcement points in the Audit Vault and Database Firewall system data. A timestamp shows since how long enforcement points have not scanned any queries (from the last hour to the last week).

Figure 4-5 Enforcement Points Region

For a detailed report (Enforcement Points List), select Enforcement Points from the Oracle Audit Vault and Database Firewall menu.

4.3.4.1 Enforcement Points List

This page lists all of the enforcement points monitored by the Audit Vault and Database Firewall plug-in. The following information is available:

- Enforcement Point: the name of the enforcement point for a particular Database Firewall. Click the link for a detailed Enforcement Points Summary Page of the enforcement point.

- Status: identifies if the enforcement point is Up, Down, Idle, Unreachable, Not Activated, etc.

- Monitoring Mode:

- Database Activity Monitoring (DAM): monitors the activity of the database.

- Database Policy Enforcement Mode (DPM): blocks activity if a policy violation occurs.

- Firewalls: lists the Database Firewalls associated with a particular enforcement point.

- Secured Target: identifies the name of the secured target. Click the link for a pop-up window with a detail summary.

- Time Since Last scan: The time since the enforcement point last scanned any query.

- Throughput: shows the number of queries audited per second.

- Incidents: Identifies the number of incidents logged against an enforcement point. Incidents have a state of Critical, Warning, and Escalated

4.3.4.2 Enforcement Points Summary Page

This page provides detailed information about a particular enforcement point associated with a Database Firewall. The following sections are provided:

Summary

This region shows high-level information about the enforcement points for a Database Firewall, including:

- Status: identifies if the enforcement point is Up, Down, Idle, Unreachable, Not Activated, etc.

- Active Since: the time the enforcement point was made active.

- Monitoring Mode:

- Database Activity Monitoring (DAM): monitors the activity of the database.

- Database Policy Enforcement Mode (DPM): blocks activity if a policy violation occurs.

- Firewalls: lists the Database Firewalls associated with a particular enforcement point.

- Time Since Last scan: The time since the enforcement point last scanned any query.

- Audit Vault Server: the name of the server to which the Database Firewall is associated.

Enforcement Point Source

This region provides a high-level summary of the enforcement point associated with a Database Firewall, including:

- Source Name

- Type

- Source Host

- Port

Performance

This region provides a graph of the throughput per second data over a particular time. Click the Duration drop-down menu to select a time frame.

Incidents and Problems

This region provides a summary of any reported incident or problem. If there is an incident or problem listed, click the link in the Message column to show details in the Incident Manager feature of Enterprise Manager Cloud Control.

4.3.5 Secured Targets

This region (see Figure 4-6) shows number of Secured Targets:

- Contained in the Audit Vault and Database Firewall system.

- Monitored by the Audit Trails in Audit Vault and Database Firewall system.

- Protected by the enforcement points in the Audit Vault and Database Firewall system.

Figure 4-6 Secured Targets Region

For a detailed report (Secured Targets Summary Page), select Secured Targets from the Oracle Audit Vault and Database Firewall menu or click the Secured Targets title on the Oracle AVDF home page.

4.3.5.1 Secured Targets Summary Page

Secured targets can be supported databases or operating systems that Audit Vault and Database Firewall monitors. You must register all secured targets in Oracle Audit Vault and Database Firewall.

On the Secured Targets list page, the following information is available:

- Secured Target: name of the target.

- Type: the type of the supported database or operating system (such as, Oracle Database or Microsoft SQL Server).

- Status: shows whether the database is Up or Down.

- Connection String:

- Monitored by: identifies the Audit Vault Agent and Audit Trails that are monitoring this Secure Target.

- Protected by: identifies the Database Firewall and enforcement points that are protecting this Secure Target.

4.4 Other AVDF Plug-in Monitoring

The regions described below may provide links for additional information about the target. For example, the links in the Summary Region takes you to the corresponding component listing page which has the summary of all the components of that type. Other link and chart sections are also clickable, which will take you to the corresponding component listing page after applying the appropriate filter.

From the Oracle Audit Vault and Database Firewall plug-in home page, you can monitor the following information:

- Summary Region

- Auditor Activity Notifications

- High Availability Information

- Incidents and Problems

4.4.1 Summary Region

This region shows high-level information including the Oracle Audit Vault Server version and the number and type of components monitored by the plug-in (as shown in Figure 4-7).

Figure 4-7 Summary Region

4.4.2 Auditor Activity Notifications

This region (Figure 4-8) shows the number of Auditor Activity Notifications. A notification can be Ready to be Sent, Pending, or Failed/Expired. These notifications are generated by Audit Trails in the Audit Vault and Database system.

Figure 4-8 Auditor Activity Notifications Region

4.4.3 High Availability Information

This region shows the associated high-availability pair of IP address for the Audit Vault Server and shows the number of high-availability configured Database Firewalls.

If the paired high-availability server is added to Enterprise Manager as an Enterprise Manager target, this region would show the Enterprise Manager target name (instead of the IP addresses) and would provide a link to navigate to that target. (See Figure 4-9.)

Figure 4-9 High Availability Information Region

4.4.4 Incidents and Problems

This region (Figure 4-10) provides a summary of any incident or problem for the components monitored by the plug-in. If there is an incident or problem listed, click the link in the Message column to show details in the Incident Manager feature of Enterprise Manager Cloud Control.

Figure 4-10 Incidents and Problems Region

4.5 Upgrading the Plug-in

The Self Update feature allows you to expand Enterprise Manager's capabilities by updating Enterprise Manager components whenever new or updated features become available. Updated plug-ins are made available via the Enterprise Manager Store, an external site that is periodically checked by Enterprise Manager Cloud Control to obtain information about updates ready for download. See the Updating Cloud Control chapter in the Oracle Enterprise Manager Cloud Control Administrator's Guide for steps to update the plug-in:

http://docs.oracle.com/cd/E24628_01/doc.121/e24473/self_update.htm

4.6 Undeploying the Plug-in

See the Managing Plug-ins chapter in the Oracle Enterprise Manager Cloud Control Administrator's Guide for steps to undeploy the plug-in:

http://docs.oracle.com/cd/E24628_01/doc.121/e24473/plugin_mngr.htm#CJGEFADI

Index
A  D  E  H  I  M  O  P  S  T  V

A

Audit Trail summary page, 4.3.2.2

Audit Trails list, 4.3.2.1

Audit Trails region, 4.3.2

Audit Vault Agent summary page, 4.3.1.2

Audit Vault Agents list, 4.3.1.1

Audit Vault Agents region, 4.3.1

Auditor Activity Notifications region, 4.4.2

D

Database Firewall summary page, 4.3.3.2

Database Firewalls list, 4.3.3.1

Database Firewalls region, 4.3.3

deploy plug-in, 3.1

discovery, 3

Audit Vault Agent target, 3.2.3

Audit Vault Server 12.1 target, 3.2.1

Database Firewall 12.1 target, 3.2.2

E

Enforcement Points list, 4.3.4.1

Enforcement Points List region, 4.3.4

Enforcement Points summary page, 4.3.4.2

H

High Availability Information region, 4.4.3

I

Incidents and Problems region, 4.4.4

M

Management Agent

install, 2

install on AV Server, 2.1.1

install on DB Firewall appliance, 2.1.2

O

Oracle AVDF plug-in

deploy, 3.1

introduction, 1

prerequisites, 1.2

versions supported, 1.1

P

prerequisites, 1.2

S

Secured Targets region, 4.3.5

Secured Targets summary page, 4.3.5.1

summary region, 4.4.1

T

targets

discovery, 3.2

V

versions supported, 1.1

Oracle Legal Notices

Copyright Notice

Copyright © 1994-2016, Oracle and/or its affiliates. All rights reserved.

License Restrictions Warranty/Consequential Damages Disclaimer

This software and related documentation are provided under a license agreement containing restrictions on use and disclosure and are protected by intellectual property laws. Except as expressly permitted in your license agreement or allowed by law, you may not use, copy, reproduce, translate, broadcast, modify, license, transmit, distribute, exhibit, perform, publish, or display any part, in any form, or by any means. Reverse engineering, disassembly, or decompilation of this software, unless required by law for interoperability, is prohibited.

Warranty Disclaimer

The information contained herein is subject to change without notice and is not warranted to be error-free. If you find any errors, please report them to us in writing.

Restricted Rights Notice

If this is software or related documentation that is delivered to the U.S. Government or anyone licensing it on behalf of the U.S. Government, then the following notice is applicable:

U.S. GOVERNMENT END USERS: Oracle programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, delivered to U.S. Government end users are "commercial computer software" pursuant to the applicable Federal Acquisition Regulation and agency-specific supplemental regulations. As such, use, duplication, disclosure, modification, and adaptation of the programs, including any operating system, integrated software, any programs installed on the hardware, and/or documentation, shall be subject to license terms and license restrictions applicable to the programs. No other rights are granted to the U.S. Government.

Hazardous Applications Notice

This software or hardware is developed for general use in a variety of information management applications. It is not developed or intended for use in any inherently dangerous applications, including applications that may create a risk of personal injury. If you use this software or hardware in dangerous applications, then you shall be responsible to take all appropriate fail-safe, backup, redundancy, and other measures to ensure its safe use. Oracle Corporation and its affiliates disclaim any liability for any damages caused by use of this software or hardware in dangerous applications.

Trademark Notice

Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.

Intel and Intel Xeon are trademarks or registered trademarks of Intel Corporation. All SPARC trademarks are used under license and are trademarks or registered trademarks of SPARC International, Inc. AMD, Opteron, the AMD logo, and the AMD Opteron logo are trademarks or registered trademarks of Advanced Micro Devices. UNIX is a registered trademark of The Open Group.

Third-Party Content, Products, and Services Disclaimer

This software or hardware and documentation may provide access to or information about content, products, and services from third parties. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to third-party content, products, and services unless otherwise set forth in an applicable agreement between you and Oracle. Oracle Corporation and its affiliates will not be responsible for any loss, costs, or damages incurred due to your access to or use of third-party content, products, or services, except as set forth in an applicable agreement between you and Oracle.

Alpha and Beta Draft Documentation Notice

If this document is in preproduction status:

This documentation is in preproduction status and is intended for demonstration and preliminary use only. It may not be specific to the hardware on which you are using the software. Oracle Corporation and its affiliates are not responsible for and expressly disclaim all warranties of any kind with respect to this documentation and will not be responsible for any loss, costs, or damages incurred due to the use of this documentation.

Private Alpha and Beta Draft Documentation Notice

If this document is in private preproduction status:

The information contained in this document is for informational sharing purposes only and should be considered in your capacity as a customer advisory board member or pursuant to your beta trial agreement only. It is not a commitment to deliver any material, code, or functionality, and should not be relied upon in making purchasing decisions. The development, release, and timing of any features or functionality described in this document remains at the sole discretion of Oracle.

This document in any form, software or printed matter, contains proprietary information that is the exclusive property of Oracle. Your access to and use of this confidential material is subject to the terms and conditions of your Oracle Master Agreement, Oracle License and Services Agreement, Oracle PartnerNetwork Agreement, Oracle distribution agreement, or other license agreement which has been executed by you and Oracle and with which you agree to comply. This document and information contained herein may not be disclosed, copied, reproduced, or distributed to anyone outside Oracle without prior written consent of Oracle. This document is not part of your license agreement nor can it be incorporated into any contractual agreement with Oracle or its subsidiaries or affiliates.

Documentation Accessibility

For information about Oracle's commitment to accessibility, visit the Oracle Accessibility Program website at http://www.oracle.com/pls/topic/lookup?ctx=acc&id=docacc.

Access to Oracle Support

Oracle customers that have purchased support have access to electronic support through My Oracle Support. For information, visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=info or visit http://www.oracle.com/pls/topic/lookup?ctx=acc&id=trs if you are hearing impaired.