1.2.4 Monitor System Activity

System security stands on three legs: good security protocols, proper system configuration and system monitoring. Auditing and reviewing audit records address this third requirement. Each component within a system has some degree of monitoring capability. Follow audit advice and regularly monitor audit records.

As an Oracle VM administrator you have access inside the Oracle VM Manager GUI to events and statistics. These are your first indicators of potential problems, including security risks. Particularly important errors to investigate are Oracle VM Server disconnect and offline events, as they indicate unexpected connectivity issues.

Oracle VM keeps a number of log files on different components in the environment. These log files are important for the manageability and supportability of Oracle VM. The following tables provide an overview of the log files that can assist you in troubleshooting and security auditing:

Oracle VM Manager Logs

Log Files	Location	Description
Oracle VM Manager installation or upgrade log	/tmp/install-yyyy-mm-dd-<id>.log - and/or - /tmp/upgrade-yyyy-mm-dd-<id>.log	All actions and operations that take place during an installation or upgrade procedure are saved to this file. Some log entries are simply informative, but a lot of debugging information is included.
Oracle VM Manager logs	/u01/app/oracle/ovm-manager-3/domains/ovm_domain/servers/AdminServer/logs/	The `access.log` file contains information about Oracle VM domain access and status. These logs actually come from the WebLogic server. The `AdminServer.log` file contains information similar to the events and statistics in Oracle VM Manager, but the logging is more detailed and more verbose.
CLI logs	/u01/app/oracle/ovm-manager-3/domains/ovm_domain/servers/AdminServer/logs/CLIAudit.log /u01/app/oracle/ovm-manager-3/domains/ovm_domain/servers/AdminServer/logs/CLI.log	In `CLIAudit.log`, located on the Oracle VM Manager host, the CLI maintains a full audit log of all executed commands. The `CLI.log` file contains CLI component entries.

Log Files

Location

Description

Oracle VM Manager installation or upgrade log

/tmp/install-yyyy-mm-dd-<id>.log

- and/or -

/tmp/upgrade-yyyy-mm-dd-<id>.log

All actions and operations that take place during an installation or upgrade procedure are saved to this file. Some log entries are simply informative, but a lot of debugging information is included.

Oracle VM Manager logs

/u01/app/oracle/ovm-manager-3/domains/ovm_domain/servers/AdminServer/logs/

The access.log file contains information about Oracle VM domain access and status. These logs actually come from the WebLogic server.

The AdminServer.log file contains information similar to the events and statistics in Oracle VM Manager, but the logging is more detailed and more verbose.

CLI logs

/u01/app/oracle/ovm-manager-3/domains/ovm_domain/servers/AdminServer/logs/CLIAudit.log

/u01/app/oracle/ovm-manager-3/domains/ovm_domain/servers/AdminServer/logs/CLI.log

In CLIAudit.log, located on the Oracle VM Manager host, the CLI maintains a full audit log of all executed commands.

The CLI.log file contains CLI component entries.

Oracle VM Server Logs

Log Files	Location	Description
Oracle VM Agent log	/var/log/ovs-agent.log	The Oracle VM Agent log is essential for auditing of internal communications and connectivity of the physical servers in your environment. From a security point of view, entries from authentication and connection failures with bad credentials, or an unusual number of access attempts could indicate unauthorized access attempts.
Oracle VM Agent notification log	/var/log/devmon.log	This file contains all details of what the Oracle VM Agent sends to Oracle VM Manager: all events from the server, including storage device events, network events etc.
Oracle VM console log	/var/log/ovm-consoled.log	[need info]
Oracle VM Storage Connect plug-in log	/var/log/osc.log	This file logs all installation activities related to Oracle VM Storage Connect plug-in. It shows which plug-ins have been installed, which version is in use, and when exactly the installation has taken place.
Xen hypervisor logs	/var/log/xen/	The `xend.log` file contains detailed information about Xen-specific operations. It is particularly useful to track errors related to virtual machines, such as start or migration failures.

In the context of product security and auditability, the various log files show which operations have been performed by each Oracle VM Manager administrator account. Also, any unauthorized login attempt on Oracle VM Manager or SSH connection failure to an Oracle VM Server is reflected in the log files. Monitor the logs actively in order to detect security issues as early as possible.