C Plug-In Reference

You can use plug-ins to incorporate additional functionality for your Audit Vault and Database Firewall tasks.

C.1 About Oracle Audit Vault and Database Firewall Plug-ins

Learn about the plug-ins supported by Oracle Audit Vault and Database Firewall.

Oracle Audit Vault and Database Firewall supports different types of targets by providing a plug-in for each target type. Oracle Audit Vault and Database Firewall ships with a set of plug-ins out-of-the-box. These plug-ins are packaged and deployed with the Audit Vault Server.

You can also develop your own plug-ins, or get new available plug-ins, and add them to your Oracle Audit Vault and Database Firewall installation.

This appendix contains high-level data for each plug-in shipped with Oracle Audit Vault and Database Firewall. The appendix also contains look-up information you will need to complete the procedures for registering targets and configuring audit trails. These procedures link directly to the relevant section of this appendix.

See Also:

C.2 Plug-ins That are Shipped with Oracle Audit Vault and Database Firewall

Oracle Audit Vault and Database Firewall supports plug-ins for a variety of different platforms, such as Oracle Solaris, Linux, and Microsoft Windows.

C.2.1 About Plug-ins

Oracle Audit Vault and Database Firewall supports plug-ins for many platforms and third-party products.

Oracle Audit Vault and Database Firewall plug-ins support the target versions listed in Table C-1. Click the link for each target to get detailed information.

Table C-1 Out-of-the-Box Plug-ins and Features Supported in Oracle Audit Vault and Database Firewall

Target Version Audit Trail Collection Audit Policy Creation, Entitlement Auditing Stored Procedure Auditing Audit Trail Cleanup Database Firewall Host Monitor Database Interrogation

Oracle Database Plug-in for Oracle Audit Vault and Database Firewall

11.2

Yes

Yes (except Unified Audit Policies)

Yes

Yes

Yes

Yes

Yes

Oracle Database Plug-in for Oracle Audit Vault and Database Firewall

12c, 18c, 19c

Yes

Yes (including Unified Audit Policies)

Yes

Yes

Yes

Yes

Yes

Microsoft SQL Server Plug-in for Oracle Audit Vault and Database Firewall (Windows)

2012, 2014, 2016, 2017

Yes

No

Yes (Versions 2000, 2005, 2008, 2008 R2)

Yes

Yes

Yes (on Microsoft Windows 2008 and onwards)

Yes (Microsoft SQL Server 2005, 2008, 2008 R2)

Microsoft SQL Server Plug-in for Oracle Audit Vault and Database Firewall (Windows Clustered)

2012 R2

Yes

No

Yes (Versions 2012 R2)

Yes

No

No

No

Sybase ASE Plug-in for Oracle Audit Vault and Database Firewall

15.7, 16

Yes

No

Yes

No

Yes

Yes

No

IBM DB2 Plug-in for Oracle Audit Vault and Database Firewall for LUW

10.5, 11.1, 11.5

Yes

No

Yes

No

Yes

Versions 9.1 - 10.5

Yes

No

MySQL Plug-in for Oracle Audit Vault and Database Firewall

5.6, 5.7, 8.0

Yes

No

Yes

Yes

Yes

Yes

No

Oracle Solaris Plug-in for Oracle Audit Vault and Database Firewall

11.x upto 11.4 on x86-64 platforms

Yes

No

No

No

No

Yes Versions 11, 11.1, 11.2

No

Oracle Solaris Plug-in for Oracle Audit Vault and Database Firewall

11.x upto 11.4 on SPARC64 platforms

Yes

No

No

No

No

Yes Versions 11, 11.1, 11.2

No

Oracle Linux

6.0 - 6.10

7.0 - 7.3, 7.4, 7.5, 7.8

Yes

No

No

No

No

Yes

No

Red Hat Enterprise Linux

6.8 - 6.10

7.3 - 7.8

Yes

No

No

No

No

Yes

No

IBM AIX Plug-in for Oracle Audit Vault and Database Firewall

7.1 TL5, 7.2 TL2, TL3, TL4 on Power Systems (64-bit)

Yes

No

No

Yes

No

Yes

No

Microsoft Windows Plug-in for Oracle Audit Vault and Database Firewall

Microsoft Windows Server 2012, 2012 R2, and 2016 on x86-64

Yes

No

No

No

No

No

No

Microsoft Active Directory Plug-in for Oracle Audit Vault and Database Firewall

2012, 2012 R2, and 2016 on 64 bit

Yes

No

No

No

No

No

No

Oracle ACFS Plug-in for Oracle Audit Vault and Database Firewall

12c

Yes

No

No

No

No

No

No

C.2.2 Oracle Database Plug-in for Oracle Audit Vault and Database Firewall

Learn about the Oracle Database plug-in for Oracle Audit Vault and Database Firewall.

Table C-2 lists features of the Oracle Database Plug-in.

Table C-2 Oracle Database Plug-in

Plug-in Specification Description

Plug-in directory

AGENT_HOME/av/plugins/com.oracle.av.plugin.oracle

Target Versions

Oracle 11.2.0.4

Oracle 12c Release 1 (12.1)

Oracle 12c Release 2 (12.2)

Oracle 18c

Oracle 19c

Target Platforms

Linux/x86-64

Solaris /x86-64

Solaris /SPARC64

AIX/Power64

Windows /86-64

HP-UX Itanium

See Platform Support Matrix in Oracle Audit Vault and Database Firewall Installation Guide for complete details on supported target platforms and versions.

Setup Script(s)

Yes. See "Oracle Database Setup Scripts" for instructions.

Target Location (Connect String)

jdbc:oracle:thin:@//hostname:port/service

Collection Attributes

None.

ORCLCOLL.NLS_LANGUAGE, ORCLCOLL.NLS_TERRITORY and ORCLCOLL.NLS_CHARSET: These will be deprecated in the future.

ORCLCOLL.NLS_CHARSET attribute is replaced by AV.COLLECTOR.DATABASECHARSET.

See Table C-22 for details.

AV.COLLECTOR.TIMEZONEOFFSET

Note: This attribute must be set to timezone offset of Oracle Database. It is mandatory if Transaction Log audit trail is going to be configured for the target.

AVDF Audit Trail Types

TABLE

DIRECTORY

TRANSACTION LOG

SYSLOG (Linux only)

EVENT LOG (Windows only)

NETWORK

See Table C-20 for descriptions of audit trail types.

Audit Trail Location

For TABLE audit trails: SYS.AUD$, SYS.FGA_LOG$, DVSYS.AUDIT_TRAIL$, UNIFIED_AUDIT_TRAIL, CDB_UNIFIED_AUDIT_TRAIL.

For DIRECTORY audit trails: Full path to directory containing AUD or XML files.

For SYSLOG audit trails: Use DEFAULT or the full path to directory containing the syslog file.

For EVENT LOG and NETWORK audit trails: no trail location required.

For TRANSACTION LOG: Full path to directory containing Golden Gate Integrated Extract file.

Note:

Oracle Audit Vault and Database Firewall queries and collects records from Unified Audit trail which fetches unified audit records from operating system spillover audit files. The Database Audit Management manages the clean up of Unified Audit trail and the underlying operating system spillover audit files.

Audit Trail Cleanup Support

Yes. See Oracle Database Audit Trail Cleanup for instructions.

OS user running the Agent

For Oracle Database Directory Audit Trail: Any user who has read permission on audit files, i.e oracle user, or user in DBA group.

For Table Trail: Any database user (preferably not DBA).

For Transaction Log trail : Any user who has read permission on Golden Gate Integrated Extract XML files.

For any other directory audit trail: Any user who has read permission on audit files.

Supported Character Sets for DIRECTORY and SYSLOG audit trails

The DIRECTORY and SYSLOG audit trails use Java character set to open audit files based on the database character sets. This ensures the audit files are processed using the right character sets and to avoid data loss.

The database character set is read from the following sources in the same order:

  1. Target attribute AV.COLLECTOR.DATABASECHARSET
  2. Target attribute ORCLCOLL.NLS_CHARSET (deprecated)
  3. The target Oracle database

Note: An exception to the above process is XML audit files with Java character set specified in XML declaration. Refer to the known issues for a list of character sets that are not supported.

Cluster support (Oracle Real Application Clusters)

Yes

C.2.3 MySQL Plug-in for Oracle Audit Vault and Database Firewall

Learn how to use the MySQL plug-in for Oracle Audit Vault and Database Firewall.

Table C-3 lists the features of the MySQL plug-in.

Table C-3 MySQL Plug-in

Plug-in Specification Description

Plug-in directory

AGENT_HOME/av/plugins/com.oracle.av.plugin.mysql

Target Versions

5.6, 5.7, 8.0

Target Platforms

Linux (x86-64): OL 5.x, 6.x, 7.x and RHEL 6.x, 7.x

Microsoft Windows (x86-64): 8

Microsoft Windows Server (x86-64): 2012, 2012R2, 2016

Setup Script(s)

Yes. See "MySQL Setup Scripts".

Target Location (Connect String)

jdbc:av:mysql://hostname:port/mysql

Collection Attribute(s)

av.collector.securedTargetVersion - (Required) Specifies the MySQL version.

av.collector.AtcTimeInterval - (Optional) Specifies the audit trail cleanup file update time interval in minutes. Default is 20.

AVDF Audit Trail Types

DIRECTORY

NETWORK

See Table C-20 for descriptions of audit trail types.

Audit Trail Cleanup Support

Yes.

Audit Trail Location

The path to the directory where the converted files are created.

The default audit format for MySQL 5.5 and 5.6 is old. The default audit format for MySQL 5.7 is new. The audit format can be changed by modifying the configuration on MySQL Server.

The Audit Trail Location is as follows:

  1. For old audit format, the path to the directory is where the converted XML files are created when you run the MySQL XML transformation utility.

  2. For new audit format, the path to the directory is where the audit.log files are generated by MySQL Server.

Table C-4 Old Audit Format

Audit Trail Location Value

Input path format before MySQL 5.7.21

<Path of the converted XML location.>

For example: \ConvertedXML

Input path format of MySQL 5.7.21 onwards

<Path of the converted XML location.>

For example: \ConvertedXML

Table C-5 New Audit Format

Audit Trail Location Value

Input path format before MySQL 5.7.21

<Path of the audit.log location.>

For example: \MySQLLog

Input path format for MySQL 5.7.21 onwards

<Path of the audit log file>/<log file name>.*.log

Where * is the time stamp in YYYYMMDDThhmmss format.

For example: MySQLLog/audit*.log

Note:

In the old format audit data is collected from converted XML files. In the new format audit data is collected from both active log and rotated logs.

Best Practice:

Enable automatic size-based audit log file rotation, by setting audit_log_rotate_on_size property. See Audit Log File Space Management and Name Rotation in MySQL Reference Manual for further details.

C.2.4 Microsoft SQL Server Plug-in for Oracle Audit Vault and Database Firewall

Learn about using the Microsoft SQL Server Plug-in for Oracle Audit Vault and Database Firewall

Table C-6 lists the features of the Microsoft SQL Server plug-in.

Table C-6 Microsoft SQL Server Plug-in

Plug-in Specification Description

Plug-in directory

AGENT_HOME\av\plugins\com.oracle.av.plugin.mssql

Target Versions

2012, 2014, 2016, 2017.

Target Platforms

Windows/x86-64

See Platform Support Matrix in Oracle Audit Vault and Database Firewall Installation Guide for complete details on supported target platforms and versions.

Setup Script(s)

Yes. "Microsoft SQL Server Setup Scripts" for instructions.

Target Location (Connect String for SQL server authentication)

jdbc:av:sqlserver://hostname:port

Target Location (Connect String for Windows Authentication)

jdbc:av:sqlserver://<Host Name>:<Port>;authenticationMethod=ntlmjava

Use Windows user credentials along with domain. For example:

<domain name>\<user name > and password

Collection Attribute(s)

None

AVDF Audit Trail Types

DIRECTORY

EVENT LOG

NETWORK

See Table C-20 for descriptions of audit trail types.

Audit Trail Location

For DIRECTORY audit trail: *.sqlaudit files, or *.trc (trace) files. Examples:

directory_path\*.sqlaudit

directory_path\prefix*.sqlaudit

directory_path\prefix*.trc

For prefix, you can use any prefix for the .trc or *.sqlaudit files.

#C2_DYNAMIC and #TRACE_DYNAMIC are only supported for SQL Server 2000, 2005, and 2008 versions.

For EVENT LOG audit trail:

  • application

  • security (SQL Server 2008 and 2012 only)

Audit Trail Cleanup Support

Yes. See "SQL Server Audit Trail Cleanup" for instructions.

Cluster support

Yes

Target Platform for Cluster

Windows 2012 R2 for audit collection

Cluster Collection Attribute

Attribute Name: av.collector.clusterEnabled

Attribute Value: 1

C.2.5 PostgreSQL Plug-in for Oracle Audit Vault and Database Firewall

Learn about using the PostgreSQL plug-in for Oracle Audit Vault and Database Firewall.

Table C-7 specifies the values or details required for the configuration.

Prerequisite: Ensure to enable pgaudit extension. The audit collection is incomplete and operational details are missed out from the reports in case this extension is not enabled.

Table C-7 PostgreSQL

Specification Description

Plug-in directory

AGENT_HOME/av/plugins/com.oracle.av.plugin.postgresql

Target Versions

9.6 to 11.3

Target Platforms

Linux/x86-64

Windows /86-64

Setup Scripts

None

Target Location (Connect String)

None

Collection Attributes (Required)

av.collector.securedTargetVersion

Specifies the target version.

Audit Trail Types

DIRECTORY

Audit Trail Location

The path to the directory containing CSV audit files.

Audit Trail Cleanup Support

No

C.2.6 IBM DB2 Plug-in for Oracle Audit Vault and Database Firewall

Learn about how to use the IBM DB2 plug-in for Oracle Audit Vault and Database Firewall.

Table C-8 lists the features of the IBM DB2 plug-in.

Table C-8 IBM DB2 Plug-in

Plug-in Specification Description

Plug-in directory

AGENT_HOME/av/plugins/com.oracle.av.plugin.db2

Target Versions

9.7, 9.8, 10.1, 10.5, 11.1

Target Platforms

Linux (x86-64): OL 5.x, 6.x, 7.x and RHEL 6.x, 7.x

Microsoft Windows (x86-64): 8

Microsoft Windows Server (x86-64): 2012, 2012R2, 2016

IBM AIX on Power Systems (64-bit): 7.1

Setup Script(s)

Yes. See "IBM DB2 for LUW Setup Scripts" for instructions.

Target Location (Connect String)

jdbc:av:db2://hostname:port/dbname

Note:

  • Connect string is not required for release 20.1.0.0.0.
  • Connect string is not required for IBM DB2 cluster.

Collection Attribute(s)

av.collector.databasename (case sensitive) - (Required) Specifies the IBM DB2 for LUW database name.

AVDF Audit Trail Types

DIRECTORY

NETWORK

See Table C-20 for descriptions of audit trail types.

Audit Trail Location

Path to a directory, for example: d:\temp\trace

Audit Trail Cleanup Support

No

Cluster Support

Yes

HADR (High Availability and Disaster Recovery)

Target Platform for Cluster

HADR on OL 7.x

C.2.7 Sybase ASE Plug-in for Oracle Audit Vault and Database Firewall

Learn how to use the Sybase ASE plug-in for Oracle Audit Vault and Database Firewall.

Table C-9 lists the features of the Sybase ASE plug-in.

Table C-9 Sybase ASE Plug-in

Plug-in Specification Description

Plug-in directory

AGENT_HOME/av/plugins/com.oracle.av.plugin.sybase

Target Versions

15.7

16.0

Target Platforms

All platforms

Setup Script(s)

Yes. See "Sybase ASE Setup Scripts for Oracle Audit Vault and Database Firewall" for instructions.

Target Location (Connect String)

jdbc:av:sybase://hostname:port

Collection Attribute(s)

None

AVDF Audit Trail Types

TABLE

NETWORK

See Table C-20 for descriptions of audit trail types.

Audit Trail Location

SYSAUDITS

Audit Trail Cleanup Support

No

Cluster support

No

Sybase Password Encryption

In case you are using password encryption on SAP Sybase database, incorporate the following changes on Oracle Audit Vault and Database Firewall:

  1. Use the following connection string in Audit Vault Server console while setting up the audit trail for SAP Sybase database:

    jdbc:sybase:Tds:<host>:<port>/sybsecurity?ENCRYPT_PASSWORD=TRUE&JCE_PROVIDER_CLASS=com.sun.crypto.provider.SunJCE

  2. Copy the jconn4.jar file from /opt/sybase/jConnect-16_0/classes in Sybase server to Agent_Home/av/jlib.

    Note:

    If you are using Sybase 15.7, then fetch the jconn4.jar file from the latest Sybase server version 16.0.

  3. Restart the Audit Vault Agent.

  4. Start the collection.

C.2.8 Sybase SQL Anywhere Plug-in for Oracle Audit Vault and Database Firewall

Learn about using the Sybase SQL Anywhere plug-in for Oracle Audit Vault and Database Firewall.

Table C-10 lists the features of the Sybase SQL Anywhere plug-in.

Table C-10 Sybase SQL Anywhere Plug-in

Plug-in Specification Description

Plug-in directory

AGENT_HOME/av/plugins/com.oracle.av.plugin.sqlanywhere

Target Versions

10.0.1

Target Platforms

All platforms

Setup Script(s)

Yes. See "Sybase SQL Anywhere Setup Scripts" for instructions.

Target Location (Connect String)

jdbc:av:sybase://hostname:port

Collection Attributes

None

AVDF Audit Trail Types

NETWORK (used for host monitoring only)

See Table C-20 for descriptions of audit trail types.

Audit Trail Location

Not required

Audit Trail Cleanup Support

No

C.2.9 Quick JSON Target Type for Oracle Audit Vault and Database Firewall

Learn how to configure and use the Quick JSON target type for Oracle Audit Vault and Database Firewall.

Quick JSON target type can be used to collect audit data from targets that store audit records in JSON format, by mapping few collection attributes.

Table C-11 specifies the values or details required for the configuration.

Table C-11 Quick JSON

Specification Description

Plug-in directory

AGENT_HOME/av/plugins/com.oracle.av.plugin.quickjson

Target Platforms

Linux/x86-64

Windows /86-64

Setup Scripts

None

Target Location (Connect String)

None

Collection Attributes (Required)

av.collector.securedTargetVersion

Specifies the target version.

Audit Trail Types

DIRECTORY

Audit Trail Location

The path to the directory containing JSON audit files.

Audit Trail Cleanup Support

No

QuickJSON collector relies on collection attributes to map JSON audit data to Oracle AVDF audit record fields. These collection attributes point to data within JSON audit file using JSON Path expressions. Following table lists the QuickJSON collection attributes.

Table C-12 Quick JSON Collection Attributes

Quick JSON Collection Attribute Name Description Attribute Value Type

av.collector.qck.starttag

Should be set to the first key of JSON audit record. This is not JSON Path expression. It is the name of the required key.

Static String

av.collector.qck.eventtime

Time when the event occurred.

JSON Path Expression

av.collector.qck.username

The user of the target who executed the event.

JSON Path Expression

av.collector.qck.os.username

Operating system login name of the target user who executed the event.

JSON Path Expression

av.collector.qck.eventname

Name of the event as recognized by the target.

JSON Path Expression

av.collector.qck.commandclass

Class of command issued by the target user who executed the event.

JSON Path Expression

av.collector.qck.client.ip

IP address of the client host.

JSON Path Expression

av.collector.qck.targetobject

Object affected by the event.

JSON Path Expression

av.collector.qck.targettype

Type of the target object. For example: Package, Type, or Table.

JSON Path Expression

av.collector.qck.eventstatus

Completion status of the event.

JSON Path Expression

av.collector.qck.errorid

Error number in case of event failure.

JSON Path Expression

av.collector.qck.errormessage

Error message in case of event failure.

JSON Path Expression

See Also:

C.2.10 Oracle Solaris Plug-in for Oracle Audit Vault and Database Firewall

Learn to use the Oracle Solaris plug-in for Oracle Audit Vault and Database Firewall.

Table C-13 lists the features of the Oracle Solaris plug-in.

Table C-13 Oracle Solaris Plug-in

Plug-in Specification Description

Plug-in directory

AGENT_HOME/av/plugins/com.oracle.av.plugin.solaris

Target Versions

Version 10, Version 11, on SPARC64 and x86-64 platforms

Target Platforms

Solaris/x86-64

Solaris/SPARC64

Setup Script(s)

No

Target Location (Connect String)

hostname (fully qualified machine name or IP address)

Collection Attribute(s)

None

AVDF Audit Trail Types

DIRECTORY

See Table C-20 for descriptions of audit trail types.

Audit Trail Location

hostname:path_to_trail

The hostname matches the hostname in the audit log names, which look like this:

timestamp1.timestamp2.hostname

Audit Trail Cleanup Support

No

C.2.11 Linux Plug-in for Oracle Audit Vault and Database Firewall

Learn how to benefit from using the Linux plug-in for Oracle Audit Vault and Database Firewall.

Table C-14 lists the features of the Linux plug-in that collects audit data from Oracle Linux (OL) and Red Hat Enterprise Linux (RHEL).

Table C-14 Linux Plug-in

Plug-in Specification Description

Plug-in directory

AGENT_HOME/av/plugins/com.oracle.av.plugin.linux

Target Versions

Oracle Linux (OL)

  • OL 5.8 (with auditd package 1.8)

  • OL 5.11

  • OL 6.0 (with auditd package 2.0)

  • OL 6.1 - 6.5 (with auditd package 2.2.2)

  • OL 6.6 - 6.7 (with auditd package 2.3.7)

  • OL 6.8 - 6.9 (with auditd package 2.4.5)

  • OL 7.0 (with auditd package 2.3.3)

  • OL 7.1 - 7.2 (with auditd package 2.4.1)

  • OL 7.3 (with auditd package 2.6.5)

  • OL 7.4 - 7.5 (with auditd package 2.7.6)

Red Hat Enterprise Linux (RHEL)

  • RHEL 6.7 (with auditd 2.3.7)

  • RHEL 6.8 (with auditd 2.4.5)

  • RHEL 6.9 (with auditd 2.4.5)

  • RHEL 6.10 (with auditd 2.4.5)

  • RHEL 7.0 (with auditd 2.3.3)

  • RHEL 7.1 (with auditd 2.4.1)

  • RHEL 7.2 (with auditd 2.4.1)

  • RHEL 7.3 (with auditd 2.6.5)

  • RHEL 7.4 (with auditd 2.7.6)

  • RHEL 7.5 (with auditd 2.7.6)

Run rpm -q audit to get the audit package version.

Target Platforms

Linux/x86-64

Setup Script(s)

No. However, the following user/group access rights are needed to start a Linux audit trail:

If the agent process is started with root user, no changes to access rights are needed.

If the agent process is started with a user other than root:

  1. Assign the group name of the Agent user (the one who will start the Agent process) to the log_group parameter in the /etc/audit/auditd.conf file.

  2. The Agent user and group must have read and execute permissions on the folder that contains the audit.log file (default folder is /var/log/audit).

  3. Restart the Linux audit service after you make the above changes.

Target Location (Connect String)

hostname (fully qualified machine name or IP address)

Collection Attribute(s)

None

AVDF Audit Trail Types

DIRECTORY

See Table C-20 for descriptions of audit trail types.

Audit Trail Location

Default location of audit.log (/var/log/audit/audit*.log) or any custom location configured in the /etc/audit/auditd.conf file

Audit Trail Cleanup Support

No

C.2.12 IBM AIX Plug-in for Oracle Audit Vault and Database Firewall

Learn about the IBM AIX plug-in for Oracle Audit Vault and Database Firewall.

Table C-15 lists the features of the IBM AIX plug-in.

Table C-15 IBM AIX Plug-in

Plug-in Specification Description

Plug-in directory

AGENT_HOME/av/plugins/com.oracle.av.plugin.aixos

Target Versions

AIX 6.1 - 7.2

Target Platforms

Power Systems (64-bit)

Setup Script(s)

No. However, the following user andgroup access rights are needed to start an AIX audit trail:

If the Agent process is started by the root user, then no changes to access rights are needed.

If the Agent process is started with a user other than root, then run the following commands in the AIX system as root to authorize another user:

  1. Create a new role and grant it the aix.security.audit authorization:

    mkrole authorizations= (aix.security.audit) (role_name)

  2. Alter the Agent user to assign the newly created role:

    chuser roles=role_name agent_user_name

  3. Update the kernel table with the newly created role by running the command: setkst

  4. Add the Agent user to the same group as that of the AIX audit files.

  5. Ensure you have set read permission on the /audit directory where the audit trail files are located.

  6. To start the Agent with the Agent user, log in to the AIX terminal with agent_user_name and switch to the role created in this procedure:

    swrole role_name

Target Location (Connect String)

hostname (fully qualified machine name or IP address)

Collection Attribute(s)

None

AVDF Audit Trail Types

DIRECTORY

See Table C-20 for descriptions of audit trail types.

Audit Trail Location

Default location of trail (/audit/trail) or any custom location configured in the /etc/security/audit/config file

Audit Trail Cleanup Support

Yes. The AIX plug-in will create a .atc file at:

AGENT_HOME/av/atc/SecuredTargetName_TrailId.atc

The .atc file contains the following information:

trail_location end_time_of_audit_event_collection

C.2.13 Microsoft Windows Plug-in for Oracle Audit Vault and Database Firewall

Learn about the Microsoft Windows plug-in for Oracle Audit Vault and Database Firewall.

Table C-16 lists the features of the Microsoft Windows plug-in.

Table C-16 Microsoft Windows Plug-in

Plug-in Specification Description

Plug-in directory

AGENT_HOME\av\plugins\com.oracle.av.plugin.winos

Target Versions

Microsoft Windows Server 2008, 2008 R2, 2012, 2012 R2, and 2016

Target Platforms

Windows/x86-64

Setup Script(s)

No

Target Location (Connect String)

hostname (fully qualified machine name or IP address)

Collection Attribute(s)

None

AVDF Audit Trail Types

EVENT LOG

See Table C-20 for descriptions of audit trail types.

Audit Trail Location

security (case-sensitive)

Audit Trail Cleanup Support

No

C.2.14 Microsoft Active Directory Plug-in for Oracle Audit Vault and Database Firewall

Learn about how to use the Microsoft Active Directory plug-in for Oracle Audit Vault and Database Firewall.

Table C-17 lists the features of the Microsoft Active Directory plug-in.

Table C-17 Microsoft Active Directory Plug-in

Plug-in Specification Description

Plug-in directory

AGENT_HOME\av\plugins\com.oracle.av.plugin.msad

Target Versions

2008, 2008 R2, 2012, and 2016 on 64 bit

Target Platforms

Windows/x86-64

Setup Script(s)

No

Target Location (Connect String)

hostname (fully qualified machine name or IP address)

Collection Attribute(s)

None

AVDF Audit Trail Types

EVENT LOG

See Table C-20 for descriptions of audit trail types.

Audit Trail Location

directory service or security (case-sensitive)

Audit Trail Cleanup Support

No

C.2.15 Oracle ACFS Plug-in for Oracle Audit Vault and Database Firewall

Use the Oracle ACFS plug-in for Oracle Audit Vault and Database Firewall to implement Oracle ACFS in Oracle AVDF.

Table C-18 lists the features of the Oracle ACFS plug-in.

Table C-18 Oracle ACFS Plug-in

Plug-in Specification Description

Plug-in directory

AGENT_HOME/av/plugins/com.oracle.av.plugin.acfs

Target Versions

12c Release 1 (12.1)

Target Platforms

Linux/x86-64

Solaris/x86-64

Solaris/SPARC64

Windows 2008, 2008 R2 64-bit

Setup Script(s)

No

Target Location (Connect String)

hostname (fully qualified machine name or IP address)

Collection Attribute(s)

av.collector.securedtargetversion - (Required) Specify the Oracle ACFS version.

AVDF Audit Trail Types

DIRECTORY

See Table C-20 for descriptions of audit trail types.

Audit Trail Location

The path to the directory containing XML audit files. For example, for a file system mounted at $MOUNT_POINT, the audit trail location is:

$MOUNT_POINT/.Security/audit/

Audit Trail Cleanup Support

No

C.2.16 Oracle Big Data Appliance Plug-in for Oracle Audit Vault and Database Firewall

Learn how to deploy the Oracle Big Data Appliance plug-in for Oracle Audit Vault and Database Firewall.

Table C-19 lists the features of the Oracle Big Data Appliance.

Table C-19 Big Data Appliance Plug-in

Plug-in Specification Description

Plug-in directory

AGENT_HOME/av/plugins/com.oracle.av.plugin.bda

Target Versions

2.3, 4.3

Target Platforms

Linux x86-64

Setup Script(s)

No

Target Location (Connect String)

hostname (fully qualified machine name or IP address)

Collection Attribute(s)

av.collector.securedtargetversion - (Required) Specify the Oracle Big Data Appliance version.

AVDF Audit Trail Types

DIRECTORY

See Table C-20 for descriptions of audit trail types.

Audit Trail Location

/var/log/hadoop-hdfs/hdfs-audit.log

Audit Trail Cleanup Support

No

C.2.17 Summary of Data Collected for Each Audit Trail Type

Explore the summary of the types of data that Oracle AVDF collects for each audit trail type.

When you configure an audit trail for a target, you select the type of audit trail in the Audit Trail Type field. The audit trail type depends on your target type. Table C-20 describes the types of audit trails that can be configured for each target type.

Refer to the product documentation for your target type for details on its auditing features and functionality. Refer to the following documentation for Oracle products:

Table C-20 Summary of Audit Trail Types Supported for Each Target Type

Target Type Trail Type Description

Oracle Database

TABLE

Releases 10.2.x, 11.x, and 12.x

Collects from the following audit trails:

  • Oracle Database audit trail, where standard audit events are written to the SYS.AUD$ dictionary table

  • Oracle Database fine-grained audit trail, where audit events are written to the SYS.FGA_LOG$ dictionary table

  • Oracle Database Vault audit trail, where audit events are written to the DVSYS.AUDIT_TRAIL$ dictionary table

  • Oracle database 12.x Unified Audit trail, where audit events are written to the UNIFIED_AUDIT_TRAIL data dictionary view

Note:

The SYS.AUD$ and SYS.FGA_LOG$ tables have an additional column RLS$INFO. The Unified Audit trail table has RLS_INFO column. This column describes row level security policies configured. This is mapped to the extension field in Audit Vault and Database Firewall. In order to populate this column, the user needs to set the AUDIT_TRAIL parameter of the target to DB EXTENDED.

Oracle Database

DIRECTORY

Releases 10.2.x, 11.x, and 12.x

Collects data from the following audit trails:

  • On Linux and UNIX platforms: The Oracle database audit files written to the operating system (.aud and.xml) files

  • On Windows platforms: The operating systemXML (.xml) files

Oracle Database

TRANSACTION LOG

Enterprise Edition Releases 10.2.0.3 and later, 11.1.0.6 and later

11.2.0.4 for TRANSACTION LOG collection

Collects audit data from Golden Gate Integrated Extract files. If you plan to use this audit trail type, you can define the Golden Gate Integrated Extract rules, to audit the tables from which Golden Gate Integrated Extract will capture audit information. The Golden Gate Integrated Extract files will in turn be read by Transaction Log audit trail.

For versions prior to 12.2, Oracle GoldenGate Downstream Mining must be configured.

Oracle Database

SYSLOG

Collects Oracle audit records from either syslog or rsyslog audit files on Linux and Unix platforms only.

If the system has both syslog and rsyslog installed, the exact rsyslog audit file location must be specified in order to collect data from rsyslog files.

The following rsyslog formats are supported:

  • RSYSLOG_TraditionalFileFormat (has low-precision time stamps)

  • RSYSLOG_FileFormat (has high-precision time stamps and time zone information)

Events from both formats appear the same on reports, however with RSYSLOG_FileFormat, the AVSYS.EVENT_LOG table shows EVENT_TIME with microsecond precision.

See Also:

Oracle Audit Vault and Database Firewall Auditor's Guide for details on this table, and Audit Vault Server schema documentation.

Oracle Database

EVENT LOG

Collects Oracle audit records from Microsoft Windows Event Log on Windows platforms only

Oracle Database

NETWORK

Collects network traffic (all database operations using a TCP connection). Used for host monitor.

Microsoft SQL Server

DIRECTORY

Collects audit data from C2 audit logs, server-side trace logs, and sqlaudit log files

Microsoft SQL Server

EVENT LOG

Collects audit data from Windows Application Event Logs. For Microsoft SQL Server 2008 and 2012, collection from the Security Event Log is also supported.

Microsoft SQL Server

NETWORK

Collects network traffic (all database operations using a TCP connection). Used for host monitor.

Sybase ASE

TABLE

Collects audit data from system audit tables (sysaudits_01 through sysaudits_08) in the sybsecurity database

Sybase ASE

NETWORK

Collects network traffic (all database operations using a TCP connection). Used for host monitor.

Sybase SQL Anywhere

NETWORK

(For host monitoring only) Collects network traffic (all database operations using a TCP connection).

IBM DB2 for LUW

DIRECTORY

Collects audit data from ASCII text files extracted from the binary audit log (db2audit.log). These files are located in the security subdirectory of the DB2 database instance.

IBM DB2 for LUW

NETWORK

Collects network traffic (all database operations using a TCP connection). Used for host monitor.

MySQL

DIRECTORY

Collects XML-based audit data from a specified location

MySQL

NETWORK

Collects network traffic (all database operations using a TCP connection). Used for host monitor.

Oracle Solaris

DIRECTORY

Collects Solaris Audit records (version 2) generated by the audit_binfile plug-in of Solaris Audit

Linux

DIRECTORY

Collects audit data from audit.log

Windows OS

EVENT LOG

Collects audit data from Windows Security Event Log

Microsoft Active Directory

EVENT LOG

Collects audit data from Windows Directory Service, and Security Event Logs

Oracle ACFS

DIRECTORY

Collects audit data from ACFS encryption and ACFS security sources.

Oracle Linux

DIRECTORY

Collects audit data from audit.log

Oracle Big Data Appliance

DIRECTORY

Collects audit data from hdfs-audit.log

C.3 Scripts for Oracle AVDF Account Privileges on Targets

Oracle Audit Vault and Database Firewall provides scripts for Oracle Database, Sybase, Microsoft, IBM DB2 for LUW, and MySQL plug-ins.

C.3.1 About Scripts for Setting up Oracle Audit Vault and Database Firewall Account Privileges

You can use scripts to set up accounts and privileges for Oracle Audit Vault and Database Firewall.

You must set up a user account with the correct privileges on each target for Oracle Audit Vault and Database Firewall to use to perform functions that are related to monitoring and collecting audit data. Oracle Audit Vault and Database Firewall provides setup scripts for this purpose so that you can configure your database targets. Depending on the type of target, the scripts set up user privileges that enable Oracle Audit Vault and Database Firewall to do the following functions:

  • Audit data collection

  • Audit policy management

  • Stored procedure auditing

  • User entitlement auditing

  • Database interrogation

  • Audit trail cleanup (for some targets)

When you deploy the Audit Vault Agent on a host computer (usually the same computer as the target), the setup scripts for creating the user permissions for Oracle Audit Vault and Database Firewall are in the following directory (Linux example below):

$AGENT_HOME/av/plugins/com.oracle.av.plugin.secured_target_type/config/

C.3.2 Oracle Database Setup Scripts

Learn about the Oracle Database setup scripts.

The Oracle Audit Vault and Database Firewall setup scripts for an Oracle Database target, oracle_user_setup.sql and oracle_drop_db_permissions.sql, are located in the following directory (Linux example below):

$AGENT_HOME/av/plugins/com.oracle.av.plugin.oracle/config/

These scripts are used to set up or revoke user privileges on Oracle Database in order for Oracle Audit Vault and Database Firewall to perform the following functions:

  • Audit data collection

  • Audit policy management

  • Stored procedure auditing (SPA)

  • User entitlement auditing

To set up or revoke Oracle Audit Vault and Database Firewall user privileges on an Oracle Database target:

  1. Create a user account for Oracle Audit Vault and Database Firewall on the Oracle Database. For example:

    SQL> CREATE USER username IDENTIFIED BY password

    You will use this username and password when registering this Oracle Database as a target in the Audit Vault Server.

  2. Connect as user SYS with the SYSDBA privilege. For example:

    SQL> CONNECT SYS / AS SYSDBA

  3. To set up Oracle Audit Vault and Database Firewall user privileges, run the setup script as follows:

    SQL> @oracle_user_setup.sql username mode

    • username: Enter the name of the user you created in Step 1.

    • mode: Enter one of the following:

      • SETUP: To set up privileges for managing the Oracle Database audit policy from Oracle Audit Vault and Database Firewall, and for collecting data from any audit trail type. For example, use this mode for a TABLE audit trail in Oracle Audit Vault and Database Firewall.

      • SPA: To enable stored procedure auditing for this database

      • ENTITLEMENT: To enable user entitlement auditing for this database

    Note:

    When setting up audit collection for a CDB, create a separate local user in the CDB and each PDB instance. Execute the oracle_user_setup.sql script for each user. For each PDB instance first alter the session to switch to the PDB before running the script.

  4. If Database Vault is installed and enabled on the Oracle database, log in as a user who has been granted the DV_OWNER role do the following:

    Grant the Oracle Audit Vault and Database Firewall user the DV_SECANALYST role on this Oracle Database. For example:

    SQL> GRANT DV_SECANALYST TO username;
    

    For username, enter the user name you created in Step 1.

    The DV_SECANALYST role enables Oracle Audit Vault and Database Firewall to monitor and collect audit trail data for Oracle Database Vault, and run Oracle Database Vault reports.

  5. To revoke Oracle Audit Vault and Database Firewall user privileges, connect to this database as user SYS with the SYSDBA privilege, and run the following script:

    SQL> @oracle_drop_db_permissions.sql username mode

    • username - Enter the name of the user you created in Step 1.

    • mode - Enter one of the following:

      • SETUP: To revoke privileges for managing the Oracle Database audit policy from Oracle Audit Vault and Database Firewall, and for collecting data from any audit trail type.

      • SPA: To disable stored procedure auditing for this database

      • ENTITLEMENT: To disable user entitlement auditing for this database

C.3.3 Sybase ASE Setup Scripts for Oracle Audit Vault and Database Firewall

The Sybase ASE setup scripts configure audit data collection privileges and auditing privileges for Sybase ASE targets.

C.3.3.1 About Sybase ASE Setup Scripts

Learn about Sybase ASE setup scripts for Oracle Audit Vault and Database Firewall.

The following scripts are provided for configuring necessary user privileges for Oracle Audit Vault and Database Firewall in a Sybase ASE target:

  • sybase_auditcoll_user_setup.sql
  • sybase_auditcoll_drop_db_permissions.sql
  • sybase_spa_user_setup.sql
  • sybase_spa_drop_db_permissions.sql

The scripts are located in the following directory (Linux example below):

$AGENT_HOME/av/plugins/com.oracle.av.plugin.sybase/config/

These scripts allow Oracle Audit Vault and Database Firewall to perform the following functions for Sybase ASE:

  • Audit data collection

  • Stored procedure auditing (SPA)

C.3.3.2 Setting Up Audit Data Collection Privileges for Sybase ASE Targets

Set up audit data collection privileges for Sybase ASE targets to enable you to analyze audit data.

To set up or revoke audit data collection privileges on a Sybase ASE target:

  1. Create a user account for Oracle Audit Vault and Database Firewall in Sybase ASE with the user name avdf_sybuser. For example:

    sp_addlogin avdf_sybuser, password

    You will use the user name av_sybuser and password when registering this Sybase ASE database as a target in the Audit Vault Server.

  2. Run the setup sybase_auditcoll_user_setup.sql script as follows:
    isql -S server_name -U sa -i sybase_auditcoll_user_setup.sql
    
    • server_name: Only use this argument if the database is remote. Enter the name of the remote server or its IP address. If you are running the script locally, then omit the -S server_name argument.

    • sa: Enter the system administrator user name.

  3. When prompted for a password, enter the system administrator password.
  4. To revoke the Oracle Audit Vault and Database Firewall user privileges, run the sybase_auditcoll_drop_db_permissions.sql script as follows:
    isql -S server_name -U sa -i sybase_auditcoll_drop_db_permissions.sql
    
    • server_name: Only use this argument if the database is remote. Enter the name of the remote server or its IP address. If you are running the script locally, then omit the -S server_name argument.

    • sa: Enter the system administrator user name.

    • When prompted for a password, enter the system administrator password.

C.3.3.3 Setting Up Stored Procedure Auditing Privileges for Sybase ASE Targets

You can configure stored procedure auditing privileges for Sybase ASE Targets.

To set up or revoke stored procedure auditing privileges on a Sybase ASE target:

  1. If you have not already done so, then create a user account for Oracle AVDF in Sybase ASE with the user name avdf_sybuser. For example:

    sp_addlogin avdf_sybuser, password

    You will use the user name av_sybuser and password when registering this Sybase ASE database as a target in the Audit Vault Server.

  2. Run the sybase_spa_user_setup.sql script as follows:
    isql -S server_name -U sa -i sybase_spa_user_setup.sql
    
    • server_name: Only use this argument if the database is remote. Enter the name of the remote server or its IP address. If you are running the script locally, then omit the -S server_name argument.

    • sa: Enter the system administrator user name.

  3. When prompted for a password, enter the system administrator password.
  4. To revoke the SPA user privileges, run the sybase_spa_drop_db_permissions.sql script as follows:
    isql -S server_name -U sa -i sybase_spa_drop_db_permissions.sql
    
    • server_name: Only use this argument if the database is remote. Enter the name of the remote server or its IP address. If you are running the script locally, then omit the -S server_name argument.

    • sa: Enter the system administrator user name.

    • When prompted for a password, enter the system administrator password.

C.3.4 Sybase SQL Anywhere Setup Scripts

Learn how to use the Sybase SQL Anywhere setup scripts.

The Oracle AVDF setup scripts for a Sybase SQL Anywhere target, sqlanywhere_spa_user_setup.sql and sqlanywhere_spa_drop_db_permissions.sql, are located in the following directory (Linux example below):

$AGENT_HOME/av/plugins/com.oracle.av.plugin.sqlanywhere/config/

These scripts are used to set up or revoke user privileges on the SQL Anywhere database for Oracle AVDF to do stored procedure auditing (SPA).

To set up or revoke stored procedure auditing for a SQL Anywhere target:

  1. Log in to the database as a user who has privileges to create users and set user permissions.
  2. Run the sqlanywhere_spa_user_setup.sql script as follows:
    isql -S server_name -U sa -i sqlanywhere_spa_user_setup.sql -v username="username" password="password"
    
    • server_name: Only use this argument if the database is remote. Enter the name of the remote server or its IP address. If you are running the script locally, then omit the -S server_name argument.

    • sa: Enter the system administrator user name.

    • username: Enter the name of the user you want to create for Oracle AVDF to use for SPA. Enclose this user name in double quotation marks.

    • password: Enter a password for the Oracle AVDF SPA user you are creating. Enclose the password in double quotation marks.

    After running the script, the user is created with privileges for SPA.

  3. When prompted for a password, enter the system administrator password.
  4. To revoke these privileges and remove this user from the database, run the sqlanywhere_spa_drop_db_permissions.sql as follows:
    isql -S server_name -U sa -i sqlanywhere_spa_drop_db_permissions.sql -v username="username"
    
    • server_name: Only use this argument if the database is remote. Enter the name of the remote server or its IP address. If you are running the script locally, then omit the -S server_name argument.

    • sa: Enter the system administrator user name.

    • username: Enter the name of the user you want to create for Oracle AVDF to use for SPA. Enclose this user name in double quotation marks.

    • When prompted for a password, enter the system administrator password.

C.3.5 Microsoft SQL Server Setup Scripts

The Microsoft SQL Server setup scripts manage audit data collection and auditing privileges for Microsoft SQL Server targets.

C.3.5.1 About the SQL Server Setup Script

Use the SQL Server setup script to set up or revoke user privileges for Oracle AVDF.

The Oracle AVDF setup scripts for a Microsoft SQL Server target, mssql_user_setup.sql and mssql_drop_db_permissions.sql, are located in the following directory:

AGENT_HOME\av\plugins\com.oracle.av.plugin.mssql\config\

The scripts set up or revoke user privileges for Oracle AVDF to perform the following functions for SQL Server:

  • Audit data collection

  • Stored procedure auditing (SPA)

C.3.5.2 Setting Up Audit Data Collection Privileges for SQL Server Targets

You can set up audit data collection privileges for SQL Server targets.

To set up or revoke Oracle AVDF user privileges for audit data collection:

  1. Create a user account for Oracle Audit Vault and Database Firewall in SQL Server or use Windows authenticated user. For example:

    In SQL Server 2000:

    exec sp_addlogin 'username', 'password'
    

    In SQL Server 2005, 2008, 2012, 2014, 2016:

    exec sp_executesql N'create login username with password = ''password'', 
    check_policy= off'
    
    exec sp_executesql N'create user username for login username'
    

    Use this user name and password when registering this SQL Server database as a target in the Audit Vault Server.

  2. Run the mssql_user_setup.sql script as follows:

    For SQL Server authentication:

    sqlcmd -S server_name -U sa -i mssql_user_setup.sql -v username="username" mode="AUDIT_COLL" all_databases="NA" database="NA"
    

    For Windows Authentication:

    sqlcmd -S localhost -U sa -i mssql_user_setup.sql -v username="[<domain name>\<user name>]" mode="AUDIT_COLL" all_databases="NA" database="NA"

    • server_name: Only use this argument if the database is remote. Enter the name of the remote server or its IP address. If you are running the script locally, then omit the -S server_name argument.

    • sa: Enter the system administrator user name.

    • username: Enter the name of the user you created in Step 1.

  3. When prompted for a password, enter the system administrator password.
  4. To revoke audit data collection privileges run the mssql_drop_db_permissions.sql script as follows:

    For SQL Server Authentication:

    sqlcmd -S server_name -U sa -i mssql_drop_db_permissions.sql -v username="username" mode="AUDIT_COLL" all_databases="NA" database="NA"
    

    For Windows Authentication:

    1. sqlcmd -S server_name -U sa -i mssql_drop_db_permissions.sql -v username="[<domain name>\<user name>]" mode="AUDIT_COLL" all_databases="NA" database="NA"

      • server_name: Only use this argument if the database is remote. Enter the name of the remote server or its IP address. If you are running the script locally, then omit the -S server_name argument.

      • sa: Enter the system administrator user name.

      • username: Enter the name of the user you created in Step 1.

    2. When prompted for a password, enter the system administrator password.

C.3.5.3 Setting Up Stored Procedure Auditing Privileges for SQL Server Targets

You can set up stored procedure auditing privileges for SQL Server targets.

To set up or revoke Oracle AVDF user privileges for stored procedure auditing:

  1. If you have not already done so, create a user account for Oracle AVDF in SQL Server. For example:

    In SQL Server 2000:

    exec sp_addlogin 'username', 'password'
    

    In SQL Server 2005 and 2008:

    exec sp_executesql N'create login username with password = ''password'', 
    check_policy= off'
    
    exec sp_executesql N'create user username for login username'
    

    You will use this user name and password when registering this SQL Server database as a target in the Audit Vault Server.

  2. Run the mssql_user_setup.sql script as follows:
    sqlcmd -S server_name -U sa -i mssql_user_setup.sql -v username="username" mode="SPA" all_databases="Y/N" 
    database="NA/database_name"
    • server_name: Only use this argument if the database is remote. Enter the name of the remote server or its IP address. If you are running the script locally, then omit the -S server_name argument.

    • sa: Enter the system administrator user name.

    • username: Enter the name of the user you created in Step 1.

    • Y/N: Enter Y if all databases should be audited for stored procedures. Enter N to specify one database name in the database parameter.

    • NA/database_name: If you entered Y for all_databases, enter NA. If you entered N for all_databases, enter the database name that should be audited for stored procedures.

  3. When prompted for a password, enter the system administrator password.
  4. To revoke SPA privileges run the mssql_drop_db_permissions.sql script as follows:
    sqlcmd -S server_name -U sa -i mssql_drop_db_permissions.sql -v username="username" mode="SPA" all_databases="Y/N" 
    database="NA/database_name"
    
    • server_name: Only use this argument if the database is remote. Enter the name of the remote server or its IP address. If you are running the script locally, then omit the -S server_name argument.

    • sa: Enter the system administrator user name.

    • sa_password: Enter the system administrator password.

    • Y/N: Enter Y if SPA privileges for all databases should be revoked. Enter N to specify one database name in the database parameter.

    • NA/database_name: If you entered Y for all_databases, enter NA. If you entered N for all_databases, enter the database name for which SPA privileges should be revoked.

    • When prompted for a password, enter the name of the user you created in Step 1.

C.3.6 IBM DB2 for LUW Setup Scripts

The IBM DB2 for LUW setup scripts manage privileges for audit data collection and stored procedure auditing (SPA) privileges for IBM DB2 for LUW targets.

C.3.6.1 About the IBM DB2 for LUW Setup Scripts

Learn how to use the IBM DB2 for LUW setup scripts.

The Oracle Audit Vault and Database Firewall setup scripts for a DB2 target, db2_auditcoll_user_setup.sql and db2_spa_user_setup.sql, are located in the following directory (Linux example below):

$AGENT_HOME/av/plugins/com.oracle.av.plugin.db2/config/

Note:

Connect string is not required from release 12.2.0.11.0 and onwards.

These scripts are used to set up or revoke user privileges on the DB2 database for Oracle AVDF to do the following functions:

  • Audit data collection

  • Stored procedure auditing (SPA)

C.3.6.2 Setting Up Audit Data Collection Privileges for IBM DB2 for LUW

You can configure audit data collection privileges for IBM DB2 for LUW to control access to the audit data.

To set up or revoke Oracle AVDF user privileges for audit data collection:

  1. Create a new user account in DB2 to be used by Oracle AVDF for audit data collection.

    You will use this user name and password when registering this DB2 database as a target in the Audit Vault Server.

  2. In the $AGENT_HOME/av/plugins/com.oracle.av.plugin.db2/config/ directory, locate the db2_auditcoll_user_setup.sql script and open it for editing.

  3. In the script, put the user name of the account from Step 1 in the grant statement, then save the modified script.

  4. Execute the modified script as follows:

    $> db2 -tvf db2_auditcoll_user_setup.sql

  5. To revoke audit collection privileges:

    1. Modify the db2_auditcoll_drop_db_permissions.sql script as in Step 3 above.

    2. Run the script as follows:

      $> db2 -tvf db2_auditcoll_drop_db_permissions.sql

C.3.6.3 Setting Up SPA Privileges for an IBM DB2 for LUW Target

You can set up SPA privileges for IBM DB2 for LUW targets.

To set up or revoke Oracle AVDF user privileges for stored procedure auditing:

  1. Create a new user account in DB2 to be used by Oracle AVDF for stored procedure auditing.

    You will use this user name and password when registering this DB2 database as a target in the Audit Vault Server.

  2. In the $AGENT_HOME/av/plugins/com.oracle.av.plugin.db2/config/ directory, locate the db2_spa_user_setup.sql script and open it for editing.

  3. In the script, put the user name of the account from Step 1 in the grant statement, then save the modified script.

  4. Execute the modified script as follows:

    $> db2 -tvf db2_spa_user_setup.sql

  5. To revoke SPA privileges:

    1. Modify the db2_spa_drop_db_permissions.sql script as in Step 3 above.

    2. Run the script as follows:

      $> db2 -tvf db2_spa_drop_db_permissions.sql

C.3.7 MySQL Setup Scripts

The MySQL setup scripts manage user privileges on the MySQL database for Oracle AVDF to perform stored procedure auditing (SPA).

The Oracle Audit Vault and Database Firewall setup scripts for a MySQL target, linebreak mysql_spa_user_setup.sql and mysql_spa_drop_db_permissions.sql, are located in the following directory (Linux example below):

$AGENT_HOME/av/plugins/com.oracle.av.plugin.mysql/config/

To set up or revoke stored procedure auditing for a MySQL target:

  1. Log in to MySQL as a user who can create users and set user privileges.

  2. Create a user for stored procedure auditing. For example:

    create user 'username'@'hostname' identified by 'password'

    You will use this user name and password when registering this MySQL database as a target in the Audit Vault Server.

  3. In the $AGENT_HOME/av/plugins/com.oracle.av.plugin.mysql/config/ directory, locate the mysql_spa_user_setup.sql script and open it for editing.

  4. Modify the script to provide the same values for username, hostname, and password that you used in Step 1.

  5. Execute the mysql_spa_user_setup.sql script.

  6. To revoke SPA privileges:

    1. Modify the mysql_spa_drop_db_permissions.sql script as in Step 4 above.

    2. Execute the mysql_spa_drop_db_permissions.sql script.

C.4 Audit Trail Cleanup

Some Oracle Audit Vault and Database Firewall plug-ins include audit trail cleanup utilities.

C.4.1 Oracle Database Audit Trail Cleanup

Oracle Database provides the ability to purge audit trails both manually and with scheduled jobs.

C.4.1.1 About Purging the Oracle Database Target Audit Trail

You can use the DBMS_AUDIT_MGMT PL/SQL package to purge the database audit trail.

The DBMS_AUDIT_MGMT package lets you perform audit trail cleanup tasks such as scheduling purge jobs, moving the audit trail to a different tablespace, setting archive timestamps in the audit trail, and so on. You must have the EXECUTE privilege for DBMS_AUDIT_MGMT before you can use it.

Oracle Database 11g release 2 (11.2) or later includes the DBMS_AUDIT_MGMT package and its associated data dictionary views installed by default. If your target database does not have this package installed, then you can download the package and data dictionary views from My Oracle Support.

Search for Article ID 731908.1.

For details about using the DBMS_AUDIT_MGMT PL/SQL package and views, refer to the following Oracle Database 11g Release 2 (11.2) documentation:

C.4.1.2 Scheduling Automated Purge Jobs

Simplify maintenance by scheduling automated jobs to purge unneeded audit data.

Oracle Audit Vault and Database Firewall is integrated with the DBMS_AUDIT_MGMT package on an Oracle Database. This integration automates the purging of audit records from the UNIFIED_AUDIT_TRAIL, AUD$, and FGA_LOG$ tables, and from the operating system .aud and .xml files after they have been successfully inserted into the Audit Vault Server repository.

After the purge is completed, the Audit Vault Agent automatically sets a timestamp on audit data that has been collected. Therefore, you must set the USE_LAST_ARCH_TIMESTAMP property to TRUE to ensure that the right set of audit records are purged. You do not need to manually set a purge job interval.

To schedule an automated purge job for an Oracle Database target:

  1. Log in to SQL*Plus on the target database as a user who has been granted the EXECUTE privilege for the DBMS_AUDIT_MGMT PL/SQL package.

    For example:

    sqlplus tjones
    Enter password: password
    
  2. Initialize the audit trail cleanup operation.

    In the following example, the DEFAULT_CLEANUP_INTERVAL setting runs the job every two hours:

    BEGIN
     DBMS_AUDIT_MGMT.INIT_CLEANUP(
      AUDIT_TRAIL_TYPE            => DBMS_AUDIT_MGMT.AUDIT_TRAIL_ALL,
      DEFAULT_CLEANUP_INTERVAL    => 2 );
    END;
    /
    

    Note:

    • In case you are collecting audit data from CDB, then execute this step every time there is any change in the PDB instance.
    • In case you are using a CDB unified audit trail, then use CONTAINER_ALL parameter in the above command.
  3. Verify that the audit trail is initialized for cleanup.

    For example:

    SET SERVEROUTPUT ON
    BEGIN
     IF
       DBMS_AUDIT_MGMT.IS_CLEANUP_INITIALIZED(DBMS_AUDIT_MGMT.AUDIT_TRAIL_ALL)
     THEN
       DBMS_OUTPUT.PUT_LINE('Database and OS audit are initialized for cleanup');
     ELSE
       DBMS_OUTPUT.PUT_LINE('Database and OS audit are not initialized for cleanup.');
     END IF;
    END;
    /
    
  4. Use the DBMS_AUDIT_MGMT.CREATE_PURGE_JOB procedure to create and schedule the purge job.

    In this procedure, ensure that you set the USE_LAST_ARCH_TIMESTAMP property to TRUE, so all records older than the timestamp can be deleted.

    The following procedure creates a purge job called CLEANUP_OS_DB_AUDIT_RECORDS that will run every two hours to purge the audit records.

    BEGIN
      DBMS_AUDIT_MGMT.CREATE_PURGE_JOB (
       AUDIT_TRAIL_TYPE            => DBMS_AUDIT_MGMT.AUDIT_TRAIL_ALL,
       AUDIT_TRAIL_PURGE_INTERVAL  => 2,
       AUDIT_TRAIL_PURGE_NAME      => 'CLEANUP_OS_DB_AUDIT_RECORDS',
       USE_LAST_ARCH_TIMESTAMP     => TRUE );
    END;
    /

C.4.2 SQL Server Audit Trail Cleanup

Learn about cleaning up your SQL Server audit trail.

If the SQL Server audit trail has collected data from a trace or sqlaudit file and that file is inactive, then you can clean up this file. The SQL Server audit trail writes the names of the SQL Server audit text files to a plain text file with the .atc extension. The .atc file resides in the AGENT_HOME\av\atc directory on the computer on which the agent is installed.

To manually clean up files that Oracle AVDF has completed extracting audit records from:

  1. Go to the AGENT_HOME\av\plugins\com.oracle.av.plugin.mssql\bin directory of the computer where the Audit Vault Agent is installed.

    Ensure that the AGENT_HOME environment variable is correctly set to the directory path where the agent.jar file is extracted.

  2. Run the following utility:
    SQLServerCleanupHandler secured_target_name
    

    For example:

    SQLServerCleanupHandler mssqldb4
    

    If you do not set the AGENT_HOME environment variable, you can provide the agent home location in the command line using the following syntax:

    SQLServerCleanupHandler -securedtargetname secured_target_name agent_home_location
    

    For example:

    SQLServerCleanupHandler mssqldb4 c:\AV_agent_installation
    

    Important: If the name of the Audit Vault Agent installation directory contains spaces, enclose the name in double quotes, for example "C:\Agent Directory".

To automate the cleanup of SQL Server trace files, you can use the Windows Scheduler.

Note:

If the SQL Server trace definition is redefined or reinitialized, then you must ensure that the file names of the trace files do not overlap with trace files that were created earlier.

For example, suppose you start SQL Server with a trace definition in which the trace files names use the following format:

c:\serversidetraces.trc
c:\serversidetraces_1.trc
c:\serversidetraces_2.trc
...
c:\serversidetraces_259.trc

Then you restart the SQL Server with a new trace definition. This new trace definition must use a different file name from the current trace files (for example, the current one named c:\serversidetraces.trc). If you do not, then when you purge the audit trail, the new trace files that have same names as the old ones will be deleted.

C.4.3 MySQL Audit Trail Cleanup

Use the MySQL audit trail cleanup utility to simplify maintenance.

To run the MySQL audit trail cleanup utility:

  1. On the host machine, go to the directory AGENT_HOME\av\plugins\com.oracle.av.plugin.mysql\bin
  2. Run the following command:

    MySQLServerCleanupHandler.bat secured_target_name AGENT_HOME

    The above command has the following variables:

    • secured_target_name - the name of the MySQL target

    • AGENT_HOME - the path to the directory where the Audit Vault Agent is deployed.

C.5 Procedure Look-Ups: Connect Strings, Collection Attributes, Audit Trail Locations

Procedure lookups enable you to fine tune and customize audit records generation.

C.5.1 Target Locations (Connect Strings)

Use connect strings to register target locations in the Oracle Audit Vault Server console.

When registering a target in the Audit Vault Server console, you enter a connect string in the Target Location field. Use a connect string format from Table C-21 depending on the target type.

Note: A connect string is not required for a Database Firewall-only deployment.

Table C-21 Target Connect Strings (for Target Location Field)

Target Type Connect String

Oracle Database

jdbc:oracle:thin:@//hostname:port/service

Sybase ASE

jdbc:av:sybase://hostname:port

Sybase SQL Anywhere

jdbc:av:sybase://hostname:port

Microsoft SQL Server (SQL Server Authentication)

jdbc:av:sqlserver://hostname:port

When SSL Encryption is used with MSSQL sever and the server certificate validation is required.

jdbc:av:sqlserver://<MSSQL Host name>:<Port number>;encryptionMethod=SSL;validateServerCertificate=true;trustStore=<key store jks path>;trustStorePassword=<keystore password>;extendedOptions=enableCipherSuites=SSL_RSA_WITH_RC4_128_MD5,SSL_RSA_WITH_RC4_128_SHA

When SSL Encryption is used with MSSQL sever and the server certificate validation is not required.

jdbc:av:sqlserver://<MSSQL Host name>:<Port number>;encryptionMethod=SSL;validateServerCertificate=false

Microsoft SQL Server (Windows Authentication)

jdbc:av:sqlserver://<Host Name>:<Port>;authenticationMethod=ntlmjava

(Use Windows user credentials along with domain. For example, <domain name>\<user name > and password.)

OR

jdbc:av:sqlserver://<Host Name>:<Port>;authenticationMethod=ntlmjava;domain=<domain name>

Use Windows user credentials without domain. For example, <user name > and password.

IBM DB2 for LUW

jdbc:av:db2://hostname:port

Note: Connect string is not required from release 12.2.0.11.0 and onwards.

MySQL

jdbc:av:mysql://hostname:port/mysql

Note: Connect string is not required from release 12.2.0.11.0 and onwards.

Oracle Solaris

hostname (fully qualified machine name or IP address)

Oracle Linux

hostname (fully qualified machine name or IP address)

Microsoft Windows

hostname (fully qualified machine name or IP address)

Microsoft Active Directory Server

hostname (fully qualified machine name or IP address)

Oracle ACFS

hostname (fully qualified machine name or IP address)

C.5.2 Collection Attributes

Oracle Audit Vault and Database Firewall provides collection attributes that are specific to the target platform, such as Oracle Database or MySQL.

C.5.2.1 About Collection Attributes

Specify collection attributes when configuring targets.

Some types of targets have optional or required audit trail collection attributes. You can specify collection attributes when registering or modifying targets in the Collection Attributes fields.

The following target types do not require collection attributes:

  • Microsoft SQL Server

  • Sybase ASE

  • Oracle Solaris

  • Windows

  • Linux

  • Microsoft Active Directory Server

C.5.2.2 Oracle Database Collection Attributes

Specify collection attributes to control the types of data that Oracle Audit Vault collects.

You can specify collection attributes for a DIRECTORY audit trail for Oracle Database. Table C-22 describes the collection attributes you can use if you select DIRECTORY as the Audit Trail Type when registering an Oracle Database target in Oracle Audit Vault and Database Firewall.

Table C-22 Collection Attributes for DIRECTORY Audit Trail for Oracle Database

Attribute Name and Description Required? Default Comments

ORCLCOLL.NLS_LANGUAGE

The NLS language of the data source

Yes: If the started audit trail cannot establish a connection to the Oracle target (for example, target is not running)

No: If the started audit trail is able to connect to the Oracle target and get these parameter values from the target (for example, the target is running when the trail is started)

NA

The value is not case sensitive.

ORCLCOLL.NLS_TERRITORY

The NLS territory of the data source

Yes: If the started audit trail cannot establish a connection to the Oracle target (for example, target is not running)

No: If the started audit trail is able to connect to the Oracle target and get these parameter values from the target (for example, the target is running when the trail is started)

NA

The value is not case sensitive.

ORCLCOLL.NLS_CHARSET

The NLS character set of the data source

Yes: If the started audit trail cannot establish a connection to the Oracle target (for example, target is not running)

No: If the started audit trail is able to connect to the Oracle target and get these parameter values from the target (for example, the target is running when the trail is started)

NA

The value is not case sensitive.

ORCLCOLL.RAC_INSTANCE_ID

The instance ID in an Oracle RAC environment

No

1

None.

AV.COLLECTOR.DATABASECHARSET

The NLS character set of the data source.

Yes: If the audit trail started cannot establish a connection to the target Oracle Database. For example, the target is not running.

No: If the audit trail started is able to connect to the target Oracle Database and get these parameter values from the target. For example, the target is running when the trail is started.

NA

None.

ORCLCOLL.HEARTBEAT_INTERVAL

The interval, in seconds, to store the metric information

No

60

Cannot be reconfigured at run time.

This interval determines how frequently metric information is updated. If the value is too low it creates overhead for sending metrics to the Audit Vault Server. If the value is too high it will skew the average metric information.

ORCLCOLL.NT_ORACLE_SID

The Oracle SID name on a Microsoft Windows systems

No

No default

The value is not case sensitive. If no value is specified then the audit trail queries the value from the target.

AV.COLLECTOR.TIMEZONEOFFSET

Timezone offset of Oracle Database target

Yes: It is a mandatory target attribute for Transaction Log audit collection.

NA

None.

C.5.2.3 IBM DB2 for LUW Collection Attribute

Learn about the IBM DB2 for LUW collection attribute.

Table C-23 describes the collection attribute required when you register an IBM DB2 for LUW target in Oracle AVDF.

Table C-23 Collection Attribute for IBM DB2 for LUW Database

Attribute Name and Description Required? Default Comments

av.collector.databasename

The IBM DB2 for LUW database name

Yes

NA

This parameter is case sensitive.

Note: The collection attribute is not required from release 12.2.0.11.0 and onwards.

C.5.2.4 MySQL Collection Attributes

Learn about the MySQL collection attributes.

Table C-24 describes the required and optional collection attributes when you register a MySQL target in Oracle Audit Vault and Database Firewall.

Table C-24 Collection Attributes for MySQL Database

Attribute Name and Description Required? Default Comments

av.collector.securedTargetVersion

The MySQL database version

Yes

NA

NA

av.collector.AtcTimeInterval

Specifies a time interval, in minutes, at which the audit trail cleanup time is updated

No

20

Example: If this value is 20, the audit trail cleanup time is updated every 20 minutes. Audit log files that have a time stamp before the audit trail cleanup time will be cleaned from the source folder when you run the audit trail cleanup utility.

C.5.2.5 Oracle ACFS Collection Attribute

Learn about the Oracle ACFS target collection attribute.

Table C-25 describes the collection attribute required when you register an Oracle ACFS target in Oracle Audit Vault and Database Firewall.

Table C-25 Collection Attribute for Oracle ACFS

Attribute Name and Description Required? Default Comments

av.collector.securedtargetversion

The version number of Oracle ACFS

Yes

NA

Five integer values separated by dots, for example 12.1.0.0.0.

C.5.3 Audit Trail Locations

Learn about the considerations for configuring Oracle Audit Vault audit trail locations.

When you configure an audit trail for a target in the Audit Vault Server, you must specify a Trail Location. The trail location depends on the type of target. Use the format below that corresponds to your target type.

Important: Trail locations are case sensitive. To avoid duplicate data collection, we recommend that you provide the entire trail location either in all capital letters or all small letters.

Note: If you selected DIRECTORY for Audit Trail Type, the Trail Location must be a directory mask.

Table C-26 shows the supported formats for Trail Location.

Table C-26 Supported Trail Locations for Targets

Target Type Trail Type Supported Trail Locations

Oracle Database

Table

SYS.AUD$, SYS.FGA_LOG$, DVSYS.AUDIT_TRAIL$, UNIFIED_AUDIT_TRAIL

Oracle Database

Directory

Full path to directory containing AUD or XML files.

Oracle Database

syslog

Full path to directory containing the syslog or rsyslog file. Include the syslog or rsyslog file prefix in the path. For example, if the file names are messages.0, messages.1, and so on, an example path might be:

/scratch/user1/rsyslogbug/dbrecord/messages

You can also enter Default and the system will search for either the syslog or rsyslog location. If both are present, entering Default causes the audit trail to collect data from the syslog files.

Oracle Database

Event log and Network

No trail location required.

Oracle Database

Transaction Log

Full path to directory containing Golden Gate Integrated Extract XML trail file.

Microsoft SQL Server

Directory

*.sqlaudit files, or *.trc (trace) files.

Examples:

directory_path\*.sqlaudit

directory_path\prefix*.sqlaudit

directory_path\prefix*.trc

For prefix, you can use any prefix for the .trc or *.sqlaudit files.

#C2_DYNAMIC and #TRACE_DYNAMIC are only supported for SQL Server 2000, 2005, 2008, 2012, 2014, 2016.

Microsoft SQL Server

Event log

application or security (SQL Server 2008, 2012, 2014, and 2016)

Sybase ASE

Table

SYSAUDITS

IBM DB2 for LUW

Directory

Path to a directory, for example: d:\temp\trace

MySQL

Directory

The path to the directory where converted XML files are created when you run the MySQL XML transformation utility.

Oracle Solaris

Directory

hostname:path_to_trail

The hostname matches the hostname in the audit log names, which look like this:

timestamp1.timestamp2.hostname

Microsoft Windows

Event log

security (case-insensitive)

You can use any case combination in the word security. However, once you start collecting a trail using a particular case case combination, you must use the same combination in subsequent collections, otherwise, a new audit trail will start collecting records from the start of the security event log.

Microsoft Active Directory Server

Event log

directory service or security (case-insensitive)

You can use any case combination in the words directory service or security. However, once you start collecting a trail using a particular case combination, you must use the same combination in subsequent collections, otherwise, a new audit trail will start collecting records from the start of the security event log.

Oracle ACFS

Directory

The path to the directory containing XML audit files. For example, for a file system mounted at $MOUNT_POINT, the audit trail location is:

$MOUNT_POINT/.Security/audit/

Linux

Directory

Default location of audit.log (/var/log/audit/audit*.log) or any custom location configured in the /etc/audit/auditd.conf file

AIX

Directory

/audit/trail