Application Auditing

Learn how to monitor the DBSecCentral application in Oracle DBSecCentral.

Application auditing which audits administrator and auditor operations on both the Audit Vault Server and the Database Firewall is enabled by default. The following operations are audited:

Administrator operations
- User management and activities
- Target management
- Audit trail management
- Audit Vault Agent management
- Database Firewall management
Auditor operations
- User management
- Global Sets management
- Audit, Database Firewall, and Alert policy activities
- Alert status changes
- Assessment report
- Target - Schedule Retrieval Jobs

Application audit records are automatically collected and available as reports for analysis. These reports are purged after six months from the date of the event.

By default, the application audit trail is purged every seven days by the AVS_MAINTENANCE_JOB.

Oracle recommends a minimum of 12 GB and a maximum of 30 GB of free space on the EVENTDATA disk for application auditing.

Viewing DBSecCentral Application Auditing Reports

The application audit reports can be viewed by a super auditor on the DBSecCentral System Report page.

Log in to Oracle Database Security Central Console as a super auditor.
Select Reports.
Select DBSecCentral System Reports.
Select either the All Activity or Application Auditing report.

The All Activity report includes all the audited activities of the DBSecCentral appliance’s application, embedded repository, and operating system.

The Application Auditing report includes all the audited activities of the DBSecCentral appliance’s application.

Records in the DBSecCentral System Reports will be purged after six months.

You can schedule and generate these reports, Scheduling and Generating PDF or XLS Reports.

Related Topics

DBSecCentral System Reports - Auditor Guide

Disable DBSecCentral Application Auditing

Perform the following steps to disable DBSecCentral application auditing which is enabled by default in DBSecCentral.

Note: Disabling application auditing is not recommended, but if application auditing is causing operational issues then it may be necessary to temporarily disable it.

Log in to the Audit Vault Server through SSH and switch to the root user.

See Logging In to Oracle DBSecCentral Appliances Through SSH.
Unlock the avsys account.
1. Switch to the dvaccountmgr user.
```
su - dvaccountmgr
```
2. Start SQL*Plus without the user name and password.
```
sqlplus /
```
3. Run the following command to unlock avsys:
```
alter user avsys identified by <password> account unlock;
```
4. Exit SQL*Plus.
```
exit
```
Note: Remember to relock the avsys account when you’ve completed this task.
Log in to the Audit Vault Server through SSH and switch to the root user.

See Logging In to Oracle DBSecCentral Appliances Through SSH.
Switch to the oracle user.
```
su - oracle
```
Start SQL*Plus as the avsys user.
```
sqlplus avsys@dbfwdb
```
Run the following to stop the DBSecCentral application audit trail:
```
execute avsys.app_audit.disable;
```
If this trail is stopped, the AVS_MAINTENANCE_JOB will purge the records after 28 days.
(Optional) Run the following to stop the collection of the audit trail:
```
execute avsys.avdf_system_audit.stop_app_audit_trail
```
If the application audit trail is stopped then it is redundant to stop the collection of the audit trail as the trail will be empty.
Lock the avsys account.
1. Switch to the dvaccountmgr user.
```
su - dvaccountmgr
```
2. Start SQL*Plus without the user name and password.
```
sqlplus /
```
3. Run the following command to lock avsys:
```
alter user avsys account lock;
```
4. Exit SQL*Plus.
```
exit
```

Enable DBSecCentral Application Auditing

Perform the following steps to re-enable DBSecCentral application auditing which is enabled by default in DBSecCentral.

Log in to the Audit Vault Server through SSH and switch to the root user.

See Logging In to Oracle DBSecCentral Appliances Through SSH.
Unlock the avsys account.
1. Switch to the dvaccountmgr user.
```
su - dvaccountmgr
```
2. Start SQL*Plus without the user name and password.
```
sqlplus /
```
3. Run the following command to unlock avsys:
```
alter user avsys identified by <password> account unlock;
```
4. Exit SQL*Plus.
```
exit
```
Note: Remember to relock the avsys account when you’ve completed this task.
Log in to the Audit Vault Server through SSH and switch to the root user.

See Logging In to Oracle DBSecCentral Appliances Through SSH.
Switch to the oracle user.
```
su - oracle
```
Start SQL*Plus as the avsys user.
```
sqlplus avsys@dbfwdb
```
Run the following to start the DBSecCentral application audit trail:
```
execute avsys.app_audit.enable;
```
If you previously stopped the collection of the application audit trail, run the following to re-start the collection:
```
execute avsys.avdf_system_audit.start_app_audit_trail
```
Lock the avsys account.
1. Switch to the dvaccountmgr user.
```
su - dvaccountmgr
```
2. Start SQL*Plus without the user name and password.
```
sqlplus /
```
3. Run the following command to lock avsys:
```
alter user avsys account lock;
```
4. Exit SQL*Plus.
```
exit
```