Topics
Oracle Audit Vault and Database Firewall supports different types of secured targets by providing a plug-in for each secured target type. Oracle Audit Vault and Database Firewall ships with a set of plug-ins out-of-the-box. These plug-ins are packaged and deployed with the Audit Vault Server.
You can also develop your own plug-ins, or get new available plug-ins, and add them to your Oracle Audit Vault and Database Firewall installation.
This appendix contains high-level data for each plug-in shipped with Oracle Audit Vault and Database Firewall. The appendix also contains look-up information you will need to complete the procedures for registering secured targets and configuring audit trails. These procedures link directly to the relevant section of this appendix.
See Also:
Oracle Big Data Appliance Owner's Guide. Oracle Audit Vault and Database Firewall also supports Oracle Big Data Appliance as a secured target.
This section describes each plug-in shipped with Oracle Audit Vault and Database Firewall.
See Also:
Oracle Audit Vault and Database Firewall Installation Guide for the latest detailed platform support for the current release.
In addition, you can find platform information for prior releases in Article 1536380.1 at My Oracle Support.
Topics
Oracle Audit Vault and Database Firewall out-of-the-box plug-ins support the secured target versions listed in Table B-1. Click the link for each secured target to get detailed information.
Table B-1 Out-of-the-Box Plug-ins and Features Supported in Oracle Audit Vault and Database Firewall
Note:
Audit data can also be collected from Solaris version 2.3 or later (contact Oracle Support for guidance).
Table B-2 lists features of the Oracle Database Plug-in.
Table B-2 Oracle Database Plug-in
Plug-in Specification | Description |
---|---|
Plug-in directory |
|
Secured Target Versions |
Oracle 10g Oracle 11g Oracle 12c Release 1 (12.1) Oracle 12c Release 2 (12.2) Note: Oracle 12c Release 2 (12.2) as a secured target is supported from Oracle Audit Vault and Database Firewall release 12.2.0.4.0 and onwards for audit data collection. 18c (18.3) in release 12.2.0.9.0 and later 19c in release 12.2.0.11.0 and later |
Secured Target Platforms |
Linux/x86-64 Solaris /x86-64 Solaris /SPARC64 AIX/Power64 Windows /x86-64 HP-UX Itanium See Audit Vault Agent: Supported Platforms and Versions in Oracle Audit Vault and Database Firewall Installation Guide for complete details on supported target platforms and versions. |
Setup Script(s) |
Yes. See "Oracle Database Setup Scripts" for instructions. |
Secured Target Location (Connect String) |
|
Collection Attribute(s) |
ORCLCOLL.NLS_LANGUAGE ORCLCOLL.NLS_TERRITORY ORCLCOLL.NLS_TERRITORY ORCLCOLL.MAX_PROCESS_TIME ORCLCOLL.MAX_PROCESS_RECORDS ORCLCOLL.RAC_INSTANCE_ID ORCLCOLL.HEARTBEAT_INTERVAL ORCLCOLL.HEARTBEAT_INTERVAL See Table B-19 for details. |
AVDF Audit Trail Types |
See Table B-17 for descriptions of audit trail types. |
For For For For Note: Oracle Audit Vault and Database Firewall queries and collects records from Unified Audit trail which fetches unified audit records from operating system spillover audit files. The Database Audit Management manages the clean up of Unified Audit trail and the underlying operating system spillover audit files. |
|
Audit Trail Cleanup Support |
Yes. See Oracle Database Audit Trail Cleanup for instructions. |
OS user running the Agent |
For Oracle Database Directory Audit Trail: Any user who has read permission on audit files, i.e oracle user, or user in DBA group. For Table Trail: Any database user (preferably not DBA). For any other directory audit trail: Any user who has read permission on audit files. |
Cluster support |
Yes |
Table B-3 lists the features of the Microsoft SQL Server plug-in.
Table B-3 Microsoft SQL Server Plug-in
Plug-in Specification | Description |
---|---|
Plug-in directory |
|
Secured Target Versions |
Enterprise Edition 2000, 2005, 2008, 2008 R2, 2012, 2014. Enterprise Edition 2016 is supported in release 12.2.0.2.0 and later. Enterprise Edition 2017 is supported in release 12.2.0.10.0 and later. |
Secured Target Platforms |
Windows/x86-64 See Audit Vault Agent: Supported Platforms and Versions in Oracle Audit Vault and Database Firewall Installation Guide for complete details on supported target platforms and versions. |
Setup Script(s) |
Yes. "Microsoft SQL Server Setup Scripts" for instructions. |
Secured Target Location (Connect String for SQL server authentication) |
|
Secured Target Location (Connect String for Windows Authentication) |
Use Windows user credentials along with domain. For example:
|
Collection Attribute(s) |
None |
AVDF Audit Trail Types |
See Table B-17 for descriptions of audit trail types. |
For DIRECTORY audit trail:
For
For EVENT LOG audit trail:
|
|
Audit Trail Cleanup Support |
Yes. See "SQL Server Audit Trail Cleanup" for instructions. |
Cluster support |
Yes |
Secured Target Platform for Cluster |
Windows 2012 R2 Version 2012 R2 for audit collection on Windows platform, starting Oracle Audit Vault and Database Firewall release 12.2.0.12.0 |
Cluster Collection Attribute |
Attribute Name: Attribute Value: |
Note:
Oracle Audit Vault and Database Firewall does not support audit collection and Database Firewall monitoring of Microsoft SQL Server cluster.Table B-4 lists the features of the Sybase ASE plug-in.
Table B-4 Sybase ASE Plug-in
Plug-in Specification | Description |
---|---|
Plug-in directory |
|
Target Versions |
15.7 16.0 is supported in release |
Secured Target Platforms |
All platforms |
Setup Script(s) |
Yes. See "Sybase ASE Setup Scripts" for instructions. |
Secured Target Location (Connect String) |
|
Collection Attribute(s) |
None |
AVDF Audit Trail Types |
See Table B-17 for descriptions of audit trail types. |
|
|
Audit Trail Cleanup Support |
No |
Cluster support |
No |
Sybase Password Encryption
In case you are using password encryption on SAP Sybase database, incorporate the following changes on Oracle Audit Vault and Database Firewall:
Use the following connection string in Audit Vault Server console while setting up the audit trail for SAP Sybase database:
jdbc:sybase:Tds:<host>:<port>/sybsecurity?ENCRYPT_PASSWORD=TRUE&JCE_PROVIDER_CLASS=com.sun.crypto.provider.SunJCE
Copy the jconn4.jar
file from /opt/sybase/jConnect-16_0/classes
in Sybase server to Agent_Home/av/jlib
.
Note:
If you are using Sybase 15.7, then fetch the jconn4.jar
file from the latest Sybase server version 16.0.
Restart the Audit Vault Agent.
Start the collection.
Table B-5 lists the features of the Sybase SQL Anywhere plug-in.
Table B-5 Sybase SQL Anywhere Plug-in
Plug-in Specification | Description |
---|---|
Plug-in directory |
|
Secured Target Versions |
10.0.1 |
Secured Target Platforms |
All platforms |
Setup Script(s) |
Yes. See "Sybase SQL Anywhere Setup Scripts" for instructions. |
Secured Target Location (Connect String) |
|
Collection Attributes |
None |
AVDF Audit Trail Types |
See Table B-17 for descriptions of audit trail types. |
Not required |
|
Audit Trail Cleanup Support |
No |
Table B-6 lists the features of the IBM DB2 plug-in.
Table B-6 IBM DB2 Plug-in
Plug-in Specification | Description |
---|---|
Plug-in directory |
|
Secured Target Versions |
9.1 - 11.1 |
Secured Target Platforms |
Linux (x86-64): OL 5.x, 6.x, 7.x and RHEL 5.x, 6.x, 7.x Microsoft Windows (x86-64): 8 Microsoft Windows Server (x86-64): 2008, 2008R2, 2012, 2012R2, 2016 IBM AIX on Power Systems (64-bit): 7.1 is supported from release 12.2.0.12.0 and onwards |
Setup Script(s) |
Yes. See "IBM DB2 for LUW Setup Scripts" for instructions. |
Secured Target Location (Connect String) |
Note:
|
Collection Attribute(s) |
|
AVDF Audit Trail Types |
See Table B-17 for descriptions of audit trail types. |
Path to a directory, for example: |
|
Audit Trail Cleanup Support |
No |
Cluster Support |
Yes HADR (High Availability and Disaster Recovery) |
Secured Target Platform for Cluster |
HADR on OL 7.x |
Table B-7 lists the features of the MySQL plug-in.
Table B-7 MySQL Plug-in
Plug-in Specification | Description |
---|---|
Plug-in directory |
|
Secured Target Versions |
For Database Firewall: Enterprise Edition 5.0, 5.1, 5.5, 5.6. For audit data collection the following Enterprise Edition versions are supported:
|
Secured Target Platforms |
Linux (x86-64): OL 5.x, 6.x, 7.x and RHEL 5.x, 6.x, 7.x Microsoft Windows (x86-64): 8 Microsoft Windows Server (x86-64): 2008, 2008R2, 2012, 2012R2, 2016 |
Setup Script(s) |
Yes. See "MySQL Setup Scripts". |
Secured Target Location (Connect String) |
Note: Connect string is not required from release 12.2.0.11.0 and onwards. |
Collection Attributes |
Note: Collection Attribute |
AVDF Audit Trail Types |
See Table B-17 for descriptions of audit trail types. |
Audit Trail Cleanup Support |
Yes. |
Audit Trail Location
The path to the directory where the converted files are created.
The default audit format for MySQL 5.5 and 5.6 is old. The default audit format for MySQL 5.7 is new. The audit format can be changed by modifying the configuration on MySQL Server.
The Audit Trail Location is as follows:
For old audit format, the path to the directory is where the converted XML files are created when you run the MySQL XML transformation utility.
For new audit format, the path to the directory is where the audit.log
files are generated by MySQL Server.
Table B-8 Old Audit Format
Audit Trail Location | Value |
---|---|
Input path format before MySQL 5.7.21 |
For example: |
Input path format of MySQL 5.7.21 onwards |
For example: |
Table B-9 New Audit Format
Audit Trail Location | Value |
---|---|
Input path format before MySQL 5.7.21 |
For example: |
Input path format for MySQL 5.7.21 onwards |
Where For example: |
Note:
In the old format audit data is collected from converted XML files. In the new format audit data is collected from both active log and rotated logs.
Best Practice:
Enable automatic size-based audit log file rotation, by setting audit_log_rotate_on_size
property. See Audit Log File Space Management and Name Rotation in MySQL Reference Manual for further details.
Table B-10 lists the features of the Oracle Solaris plug-in.
Table B-10 Oracle Solaris Plug-in
Plug-in Specification | Description |
---|---|
Plug-in directory |
|
Secured Target Versions |
Version 10, Version 11, on SPARC64 and x86-64 platforms |
Secured Target Platforms |
Solaris/x86-64 Solaris/SPARC64 |
Setup Script(s) |
No |
Secured Target Location (Connect String) |
|
Collection Attribute(s) |
None |
AVDF Audit Trail Types |
See Table B-17 for descriptions of audit trail types. |
The
|
|
Audit Trail Cleanup Support |
No |
Table B-11 lists the features of the Linux plug-in that collects audit data from Oracle Linux (OL) and Red Hat Enterprise Linux (RHEL).
Table B-11 Linux Plug-in
Plug-in Specification | Description |
---|---|
Plug-in directory |
|
Secured Target Versions |
Oracle Linux (OL)
Red Hat Enterprise Linux (RHEL)
Run |
Secured Target Platforms |
Linux/x86-64 |
Setup Script(s) |
No. However, the following user/group access rights are needed to start a Linux audit trail: If the agent process is started with If the agent process is started with a user other than
|
Secured Target Location (Connect String) |
|
Collection Attribute(s) |
None |
AVDF Audit Trail Types |
See Table B-17 for descriptions of audit trail types. |
Default location of |
|
Audit Trail Cleanup Support |
No |
Table B-12 lists the features of the IBM AIX plug-in.
Table B-12 IBM AIX Plug-in
Plug-in Specification | Description |
---|---|
Plug-in directory |
|
Secured Target Versions |
AIX 6.1 - 7.2 |
Secured Target Platforms |
Power Systems (64-bit) |
Setup Script(s) |
No. However, the following user/group access rights are needed to start an AIX audit trail: If the Agent process is started with If the Agent process is started with a user other than
|
Secured Target Location (Connect String) |
|
Collection Attribute(s) |
None |
AVDF Audit Trail Types |
DIRECTORY See Table B-17 for descriptions of audit trail types. |
Default location of trail ( |
|
Audit Trail Cleanup Support |
Yes. The AIX plug-in will create a
The
|
Table B-13 lists the features of the Microsoft Windows plug-in.
Table B-13 Microsoft Windows Plug-in
Plug-in Specification | Description |
---|---|
Plug-in directory |
|
Secured Target Versions |
Microsoft Windows Server 2008, 2008 R2, 2012, 2012 R2, and 2016 |
Secured Target Platforms |
Windows/x86-64 |
Setup Script(s) |
No |
Secured Target Location (Connect String) |
|
Collection Attribute(s) |
None |
AVDF Audit Trail Types |
See Table B-17 for descriptions of audit trail types. |
|
|
Audit Trail Cleanup Support |
No |
Table B-14 lists the features of the Microsoft Active Directory plug-in.
Table B-14 Microsoft Active Directory Plug-in
Plug-in Specification | Description |
---|---|
Plug-in directory |
|
Secured Target Versions |
2008, 2008 R2, 2012, and 2016 on 64 bit |
Secured Target Platforms |
Windows/x86-64 |
Setup Script(s) |
No |
Secured Target Location (Connect String) |
|
Collection Attribute(s) |
None |
AVDF Audit Trail Types |
See Table B-17 for descriptions of audit trail types. |
|
|
Audit Trail Cleanup Support |
No |
Table B-15 lists the features of the Oracle ACFS plug-in.
Table B-15 Oracle ACFS Plug-in
Plug-in Specification | Description |
---|---|
Plug-in directory |
|
Secured Target Versions |
12c Release 1 (12.1) |
Secured Target Platforms |
Linux/x86-64 Solaris/x86-64 Solaris/SPARC64 Windows 2008, 2008 R2 64-bit |
Setup Script(s) |
No |
Secured Target Location (Connect String) |
|
Collection Attribute(s) |
|
AVDF Audit Trail Types |
See Table B-17 for descriptions of audit trail types. |
The path to the directory containing XML audit files. For example, for a file system mounted at
|
|
Audit Trail Cleanup Support |
No |
Table B-16 lists the features of the Oracle Big Data Appliance.
Table B-16 Big Data Appliance Plug-in
Plug-in Specification | Description |
---|---|
Plug-in directory |
|
Secured Target Versions |
2.3, 4.3 |
Secured Target Platforms |
Linux x86-64 |
Setup Script(s) |
No |
Secured Target Location (Connect String) |
|
Collection Attribute(s) |
|
AVDF Audit Trail Types |
See Table B-17 for descriptions of audit trail types. |
|
|
Audit Trail Cleanup Support |
No |
When you configure an audit trail for a secured target, you select the type of audit trail in the Audit Trail Type field. The audit trail type depends on your secured target type. Table B-17 describes the types of audit trails that can be configured for each secured target type.
Refer to the product documentation for your secured target type for details on its auditing features and functionality. Refer to the following documentation for Oracle products:
Oracle Database 12c Release 1 (12.1): Oracle Database Security Guide
Oracle Database 11g Release 2 (11.2): Oracle Database Security Guide
Oracle ACFS 12c Release 1 (12.1): Oracle Automatic Storage Management Administrator's Guide
Table B-17 Summary of Audit Trail Types Supported for Each Secured Target Type
Secured Target Type | Trail Type | Description |
---|---|---|
Oracle Database |
TABLE Releases 10.2.x, 11.x, and 12.x |
Collects from the following audit trails:
Note: The SYS.AUD$ and SYS.FGA_LOG$ tables have an additional column RLS$INFO. The Unified Audit trail table has RLS_INFO column. This column describes row level security policies configured. This is mapped to the extension field in Audit Vault and Database Firewall. In order to populate this column, the user needs to set the |
Oracle Database |
DIRECTORY Releases 10.2.x, 11.x, and 12.x |
|
Oracle Database |
TRANSACTION LOG 11.2 for REDO connection |
Collects audit data from logical change records (LCRs) from the REDO logs. If you plan to use this audit trail type, you can define the data to audit by creating capture rules for the tables from which the Transaction Log trail type will capture audit information. See Also: Oracle Audit Vault and Database Firewall Auditor's Guide for more information. Note:
|
Oracle Database |
SYSLOG |
Collects Oracle audit records from either If the system has both The following
Events from both formats appear the same on reports, however with See Also: Oracle Audit Vault and Database Firewall Auditor's Guide for details on this table, and Audit Vault Server schema documentation. |
Oracle Database |
EVENT LOG |
Collects Oracle audit records from Microsoft Windows Event Log on Windows platforms only |
Oracle Database |
NETWORK |
Collects network traffic (all database operations using a TCP connection). Used for host monitor. |
Microsoft SQL Server |
DIRECTORY |
Collects audit data from C2 audit logs, server-side trace logs, and |
Microsoft SQL Server |
EVENT LOG |
Collects audit data from Windows Application Event Logs. For Microsoft SQL Server 2008 and 2012, collection from the Security Event Log is also supported. |
Microsoft SQL Server |
NETWORK |
Collects network traffic (all database operations using a TCP connection). Used for host monitor. |
Sybase ASE |
TABLE |
Collects audit data from system audit tables ( |
Sybase ASE |
NETWORK |
Collects network traffic (all database operations using a TCP connection). Used for host monitor. |
Sybase SQL Anywhere |
NETWORK |
(For host monitoring only) Collects network traffic (all database operations using a TCP connection). |
IBM DB2 for LUW |
DIRECTORY |
Collects audit data from ASCII text files extracted from the binary audit log ( |
IBM DB2 for LUW |
NETWORK |
Collects network traffic (all database operations using a TCP connection). Used for host monitor. |
MySQL |
DIRECTORY |
Collects XML-based audit data from a specified location |
MySQL |
NETWORK |
Collects network traffic (all database operations using a TCP connection). Used for host monitor. |
Oracle Solaris |
DIRECTORY |
Collects Solaris Audit records (version 2) generated by the |
Linux |
DIRECTORY |
Collects audit data from |
Windows OS |
EVENT LOG |
Collects audit data from Windows Security Event Log |
Microsoft Active Directory |
EVENT LOG |
Collects audit data from Windows Directory Service, and Security Event Logs |
Oracle ACFS |
DIRECTORY |
Collects audit data from ACFS encryption and ACFS security sources. |
Oracle Linux |
DIRECTORY |
Collects audit data from |
Oracle Big Data Appliance |
DIRECTORY |
Collects audit data from |
Topics
You must set up a user account with appropriate privileges on each secured target for Oracle Audit Vault and Database Firewall to use in performing functions related to monitoring and collecting audit data. Oracle Audit Vault and Database Firewall provides setup scripts for database secured targets. Depending on the type of secured target, the scripts set up user privileges that allow Oracle Audit Vault and Database Firewall to do the following functions:
Audit data collection
Audit policy management
Stored procedure auditing
User entitlement auditing
Database interrogation
Audit trail cleanup (for some secured targets)
When you deploy the Audit Vault Agent on a host computer (usually the same computer as the secured target), the setup scripts for creating the user permissions for Oracle Audit Vault and Database Firewall are located in the following directory (Linux example below):
$AGENT_HOME/av/plugins/com.oracle.av.plugin.
secured_target_type
/config/
The Oracle Audit Vault and Database Firewall setup scripts for an Oracle Database secured target, oracle_user_setup.sql
and oracle_drop_db_permissions.sql
, are located in the following directory (Linux example below):
$AGENT_HOME/av/plugins/com.oracle.av.plugin.oracle/config/
These scripts are used to set up or revoke user privileges on the Oracle Database in order for Oracle Audit Vault and Database Firewall to do the following functions:
Audit data collection
Audit policy management
Stored procedure auditing (SPA)
User entitlement auditing
To set up or revoke Oracle Audit Vault and Database Firewall user privileges on an Oracle Database secured target:
Create a user account for Oracle Audit Vault and Database Firewall on the Oracle Database. For example:
SQL> CREATE USER
username
IDENTIFIED BY
password
You will use this username and password when registering this Oracle Database as a secured target in the Audit Vault Server.
Connect as user SYS
with the SYSDBA
privilege. For example:
SQL> CONNECT SYS / AS SYSDBA
To set up Oracle Audit Vault and Database Firewall user privileges, run the setup script as follows:
SQL> @
oracle_user_setup.sql
username
mode
username
: Enter the name of the user you created in Step 1.
mode
: Enter one of the following:
SETUP
: To set up privileges for managing the Oracle Database audit policy from Oracle Audit Vault and Database Firewall, and for collecting data from any audit trail type except the REDO logs. For example, use this mode for a TABLE audit trail in Oracle Audit Vault and Database Firewall.
REDO_COLL
: To set up privileges for collecting audit data from the REDO logs. Use this mode only for a TRANSACTION LOG audit trail in Oracle Audit Vault and Database Firewall.
SPA
: To enable stored procedure auditing for this database
ENTITLEMENT
: To enable user entitlement auditing for this database
Note:
When setting up audit collection for a CDB, create a separate local user in the CDB and each PDB instance. Execute the oracle_user_setup.sql
script for each user. For each PDB instance first alter the session to switch to the PDB before running the script.
If Database Vault is installed and enabled on the Oracle database, log in as a user who has been granted the DV_OWNER
role do the following:
Grant the Oracle Audit Vault and Database Firewall user the DV_SECANALYST
role on this Oracle Database. For example:
SQL> GRANT DV_SECANALYST TO username;
For username
, enter the user name you created in Step 1.
The DV_SECANALYST
role enables Oracle Audit Vault and Database Firewall to monitor and collect audit trail data for Oracle Database Vault, and run Oracle Database Vault reports.
For REDO_COLL
mode (TRANSACTION LOG audit trail) only, execute one of these procedures depending on your Oracle Database version:
For Oracle Database 12c:
SQL> GRANT DV_STREAMS_ADMIN TO username;
For username
, enter the user name you created in Step 1.
For all other supported Oracle Database versions:
SQL> EXEC DBMS_MACADM.ADD_AUTH_TO_REALM('Oracle Data Dictionary', 'username', null, dbms_macutl.g_realm_auth_participant);
SQL> COMMIT;
For username
, enter the user name you created in Step 1.
To revoke Oracle Audit Vault and Database Firewall user privileges, connect to this database as user SYS
with the SYSDBA
privilege, and run the following script:
SQL> @
oracle_drop_db_permissions.sql
username
mode
username
- Enter the name of the user you created in Step 1.
mode
- Enter one of the following:
SETUP
: To revoke privileges for managing the Oracle Database audit policy from Oracle Audit Vault and Database Firewall, and for collecting data from any audit trail type except the REDO logs.
REDO_COLL
: To revoke privileges for collecting audit data from the REDO logs.
SPA
: To disable stored procedure auditing for this database
ENTITLEMENT
: To disable user entitlement auditing for this database
Topics
The following scripts are provided for configuring necessary user privileges for Oracle Audit Vault and Database Firewall in a Sybase ASE secured target:
sybase_auditcoll_user_setup.sql
sybase_auditcoll_drop_db_permissions.sql
sybase_spa_user_setup.sql
sybase_spa_drop_db_permissions.sql
The scripts are located in the following directory (Linux example below):
$AGENT_HOME/av/plugins/com.oracle.av.plugin.sybase/config/
These scripts allow Oracle Audit Vault and Database Firewall to perform the following functions for Sybase ASE:
Audit data collection
Stored procedure auditing (SPA)
The Oracle AVDF setup scripts for a Sybase SQL Anywhere secured target, sqlanywhere_spa_user_setup.sql
and sqlanywhere_spa_drop_db_permissions.sql
, are located in the following directory (Linux example below):
$AGENT_HOME/av/plugins/com.oracle.av.plugin.sqlanywhere/config/
These scripts are used to set up or revoke user privileges on the SQL Anywhere database for Oracle AVDF to do stored procedure auditing (SPA).
To set up or revoke stored procedure auditing for a SQL Anywhere secured target:
Topics
The Oracle AVDF setup scripts for a Microsoft SQL Server secured target, mssql_user_setup.sql
and mssql_drop_db_permissions.sql
, are located in the following directory:
AGENT_HOME
\av\plugins\com.oracle.av.plugin.mssql\config\
The scripts set up or revoke user privileges for Oracle AVDF to perform the following functions for SQL Server:
Audit data collection
Stored procedure auditing (SPA)
Topics
The Oracle Audit Vault and Database Firewall setup scripts for a DB2 secured target, db2_auditcoll_user_setup.sql
and db2_spa_user_setup.sql
, are located in the following directory (Linux example below):
$AGENT_HOME/av/plugins/com.oracle.av.plugin.db2/config/
Note:
Connect string is not required from release 12.2.0.11.0 and onwards.
These scripts are used to set up or revoke user privileges on the DB2 database for Oracle AVDF to do the following functions:
Audit data collection
Stored procedure auditing (SPA)
To set up or revoke Oracle AVDF user privileges for audit data collection:
Create a new user account in DB2 to be used by Oracle AVDF for audit data collection.
You will use this user name and password when registering this DB2 database as a secured target in the Audit Vault Server.
In the $AGENT_HOME/av/plugins/com.oracle.av.plugin.db2/config/
directory, locate the db2_auditcoll_user_setup.sql
script and open it for editing.
In the script, put the user name of the account from Step 1 in the grant
statement, then save the modified script.
Execute the modified script as follows:
$> db2 -tvf db2_auditcoll_user_setup.sql
To revoke audit collection privileges:
Modify the db2_auditcoll_drop_db_permissions.sql
script as in Step 3 above.
Run the script as follows:
$> db2 -tvf db2_auditcoll_drop_db_permissions.sql
To set up or revoke Oracle AVDF user privileges for stored procedure auditing:
Create a new user account in DB2 to be used by Oracle AVDF for stored procedure auditing.
You will use this user name and password when registering this DB2 database as a secured target in the Audit Vault Server.
In the $AGENT_HOME/av/plugins/com.oracle.av.plugin.db2/config/
directory, locate the db2_spa_user_setup.sql
script and open it for editing.
In the script, put the user name of the account from Step 1 in the grant
statement, then save the modified script.
Execute the modified script as follows:
$> db2 -tvf db2_spa_user_setup.sql
To revoke SPA privileges:
Modify the db2_spa_drop_db_permissions.sql
script as in Step 3 above.
Run the script as follows:
$> db2 -tvf db2_spa_drop_db_permissions.sql
The Oracle AVDF setup scripts for a MySQL secured target, mysql_spa_user_setup.sql
and mysql_spa_drop_db_permissions.sql
, are located in the following directory (Linux example below):
$AGENT_HOME/av/plugins/com.oracle.av.plugin.mysql/config/
These scripts are used to set up or revoke user privileges on the MySql database for Oracle AVDF to do stored procedure auditing (SPA).
To set up or revoke stored procedure auditing for a MySql secured target:
Log in to MySQL as a user who can create users and set user privileges.
Create a user for stored procedure auditing. For example:
create user '
username
'@'
hostname
' identified by '
password
'
You will use this user name and password when registering this MySQL database as a secured target in the Audit Vault Server.
In the $AGENT_HOME/av/plugins/com.oracle.av.plugin.mysql/config/
directory, locate the mysql_spa_user_setup.sql
script and open it for editing.
Modify the script to provide the same values for username
, hostname
, and password
that you used in Step 1.
Execute the mysql_spa_user_setup.sql
script.
To revoke SPA privileges:
Modify the mysql_spa_drop_db_permissions.sql
script as in Step 4 above.
Execute the mysql_spa_drop_db_permissions.sql
script.
Considerations for audit collection on other target types.
Learn about additional information required to collect audit data from Oracle Active Data Guard.
Oracle Active Data Guard is a high availability solution which consists of one primary database and multiple standby databases. This section contains some additional information for configuring different audit trails.
Traditional Auditing
Follow these steps for collecting audit data from databases in Oracle Active Data Guard with traditional auditing:
AUDIT_TRAIL
parameter to DB, EXTENDED
, on all target databases.sys.aud$
table of the current primary database even when failover or switchover occurs.sys.aud$
.*.aud
log file for the specific target database in Oracle Active Data Guard.Unified Auditing
Audit data can be collected from the primary database in Oracle Active Data Guard with unified auditing. Follow these steps:
unified_audit_trail
table of the primary database even when failover or switchover occurs.unified_audit_trail
of the primary database.Note:
Oracle AVDF supports audit collection from the traditional audit trail in both the primary and standby databases of Oracle Active Data Guard. When unified audit is enabled, audit collection is supported only from the unified audit trail of the primary database, and not from the standby database.Some Oracle AVDF plug-ins support audit trail cleanup. This section describes the available audit trail cleanup (ATC) utilities:
Topics
You can use the DBMS_AUDIT_MGMT
PL/SQL package to purge the database audit trail.
The DBMS_AUDIT_MGMT
package lets you perform audit trail cleanup tasks such as scheduling purge jobs, moving the audit trail to a different tablespace, setting archive timestamps in the audit trail, and so on. You must have the EXECUTE
privilege for DBMS_AUDIT_MGMT
before you can use it.
Oracle Database 11g Release 2 (11.2) or higher, includes the DBMS_AUDIT_MGMT
package and its associated data dictionary views installed by default. If your secured target database does not have this package installed, then you can download the package and data dictionary views from My Oracle Support.
Search for Article ID 731908.1.
For details about using the DBMS_AUDIT_MGMT
PL/SQL package and views, refer to the following Oracle Database 11g Release 2 (11.2) documentation:
The section "Purging Audit Trail Records" in Oracle Database Security Guide for conceptual and procedural information
Oracle Database PL/SQL Packages and Types Reference for reference information about the DBMS_AUDIT_MGMT
PL/SQL package
Oracle Database Reference for information about the DBA_AUDIT_MGMT_*
data dictionary views
Oracle Audit Vault and Database Firewall is integrated with the DBMS_AUDIT_MGMT
package on an Oracle Database. This integration automates the purging of audit records from the UNIFIED_AUDIT_TRAIL
, AUD$
, and FGA_LOG$
tables, and from the operating system .aud
and .xml
files after they have been successfully inserted into the Audit Vault Server repository.
After the purge is completed, the Audit Vault Agent automatically sets a timestamp on audit data that has been collected. Therefore, you must set the USE_LAST_ARCH_TIMESTAMP
property to TRUE
to ensure that the right set of audit records are purged. You do not need to manually set a purge job interval.
To schedule an automated purge job for an Oracle Database secured target:
If the SQL Server audit trail has collected data from a trace or sqlaudit file and that file is inactive, then you can clean up this file. The SQL Server audit trail writes the names of the SQL Server audit text files to a plain text file with the .atc
extension. The .atc
file resides in the AGENT_HOME
\av\atc
directory on the computer on which the agent is installed.
To manually clean up files that Oracle AVDF has completed extracting audit records from:
To automate the cleanup of SQL Server trace files, you can use the Windows Scheduler.
Note:
If the SQL Server trace definition is redefined or reinitialized, then you must ensure that the file names of the trace files do not overlap with trace files that were created earlier.
For example, suppose you start SQL Server with a trace definition in which the trace files names use the following format:
c:\serversidetraces.trc c:\serversidetraces_1.trc c:\serversidetraces_2.trc ... c:\serversidetraces_259.trc
Then you restart the SQL Server with a new trace definition. This new trace definition must use a different file name from the current trace files (for example, the current one named c:\serversidetraces.trc
). If you do not, then when you purge the audit trail, the new trace files that have same names as the old ones will be deleted.
This section contains reference information you will need to complete procedures in this manual for registering secured targets and configuring audit trails. The procedural steps include links to the topics in this section.
Topics
When registering a secured target in the Audit Vault Server console, you enter a connect string in the Secured Target Location field. Use a connect string format from Table B-18 depending on the secured target type.
Note: A connect string is not required for a Database Firewall-only deployment.
Table B-18 Secured Target Connect Strings (for Secured Target Location Field)
Secured Target Type | Connect String |
---|---|
Oracle Database |
|
Sybase ASE |
|
Sybase SQL Anywhere |
|
Microsoft SQL Server (SQL Server Authentication) |
When SSL Encryption is used with MSSQL sever and the server certificate validation is required.
When SSL Encryption is used with MSSQL sever and the server certificate validation is not required.
|
Microsoft SQL Server (Windows Authentication) |
OR
|
IBM DB2 for LUW |
Note: Connect string is not required from release 12.2.0.11.0 and onwards. |
MySQL |
Note: Connect string is not required from release 12.2.0.11.0 and onwards. |
Oracle Solaris |
|
Oracle Linux |
|
Microsoft Windows |
|
Microsoft Active Directory Server |
|
Oracle ACFS |
|
Topics
You can specify collection attributes for a DIRECTORY audit trail for Oracle Database. Table B-19 describes the collection attributes you can use if you select DIRECTORY as the Audit Trail Type when registering an Oracle Database secured target in Oracle Audit Vault and Database Firewall.
Table B-19 Collection Attributes for DIRECTORY Audit Trail for Oracle Database
Attribute Name and Description | Required? | Default | Comments |
---|---|---|---|
The NLS language of the data source |
Yes: If the started audit trail cannot establish a connection to the Oracle secured target (e.g., secured target is not running) No: If the started audit trail is able to connect to the Oracle secured target and get these parameter values from the secured target (e.g., the secured target is running when the trail is started) |
NA |
The value is not case sensitive. |
The NLS territory of the data source |
Yes: If the started audit trail cannot establish a connection to the Oracle secured target (e.g., secured target is not running) No: If the started audit trail is able to connect to the Oracle secured target and get these parameter values from the secured target (e.g., the secured target is running when the trail is started) |
NA |
The value is not case sensitive. |
The NLS character set of the data source |
Yes: If the started audit trail cannot establish a connection to the Oracle secured target (e.g., secured target is not running) No: If the started audit trail is able to connect to the Oracle secured target and get these parameter values from the secured target (e.g., the secured target is running when the trail is started) |
NA |
The value is not case sensitive. |
The maximum processing time, in centiseconds, for each call to process the audit trail |
No |
600 |
A valid value is an integer value from 10 to 10000. Cannot be reconfigured at run time. Indicates the maximum time for which the collection process records before sending a batch of records to the Audit Vault Server. If the value is too low it can affect performance. If the value is too high, it will take a longer time to stop the audit trail. |
The maximum number of records to be processed during each call to process the audit trail |
No |
1000 |
A valid value is an integer value from 10 to 10000. Cannot be reconfigured at run time. Indicates the maximum number of records processed before sending a batch of records to the Audit Vault Server. If the value is too low it can affect performance. If the value is too high, it will take a longer time to stop the audit trail. |
The instance ID in an Oracle RAC environment |
No |
1 |
None. |
The interval, in seconds, to store the metric information |
No |
60 |
Cannot be reconfigured at run time. This interval determines how frequently metric information is updated. If the value is too low it creates overhead for sending metrics to the Audit Vault Server. If the value is too high it will skew the average metric information. |
The Oracle SID name on a Microsoft Windows systems |
No |
No default |
The value is not case sensitive. If no value is specified then the audit trail queries the value from the secured target. |
Table B-20 describes the collection attribute required when you register an IBM DB2 for LUW secured target in Oracle AVDF.
Table B-20 Collection Attribute for IBM DB2 for LUW Database
Attribute Name and Description | Required? | Default | Comments |
---|---|---|---|
The IBM DB2 for LUW database name |
Yes |
NA |
This parameter is case sensitive. Note: The collection attribute is not required from release 12.2.0.11.0 and onwards. |
Table B-21 describes the required and optional collection attributes when you register a MySQL secured target in Oracle Audit Vault and Database Firewall.
Table B-21 Collection Attributes for MySQL Database
Attribute Name and Description | Required? | Default | Comments |
---|---|---|---|
The MySQL database version |
Yes |
NA |
NA |
Specifies a time interval, in minutes, at which the audit trail cleanup time is updated |
No |
20 |
Example: If this value is 20, the audit trail cleanup time is updated every 20 minutes. Audit log files that have a time stamp before the audit trail cleanup time will be cleaned from the source folder when you run the audit trail cleanup utility. |
See Also:
Table B-22 describes the collection attribute required when you register an Oracle ACFS secured target in Oracle Audit Vault and Database Firewall.
Table B-22 Collection Attribute for Oracle ACFS
Attribute Name and Description | Required? | Default | Comments |
---|---|---|---|
The version number of Oracle ACFS |
Yes |
NA |
Five integer values separated by dots, for example |
When you configure an audit trail for a secured target in the Audit Vault Server, you must specify a Trail Location. The trail location depends on the type of secured target. Use the format below that corresponds to your secured target type.
Important: Trail locations are case sensitive. To avoid duplicate data collection, we recommend that you provide the entire trail location either in all capital letters or all small letters.
Note: If you selected DIRECTORY for Audit Trail Type, the Trail Location must be a directory mask.
Table B-23 shows the supported formats for Trail Location.
Table B-23 Supported Trail Locations for Secured Targets