Archiving and Retrieving Audit Data

Learn how to archive and retrieve audit data.

Enabling Automatic Archival

Oracle Database Security Central supports automatic archival to an NFS configured location.

When the online period of the data on the tablespace expires, it is automatically archived without user’s intervention. The data is removed from the online location and is available in the archive location. The data cannot be deleted online manually.

Oracle recommends enabling Automatic Remote Archiving. To enable it, you must configure at least one NFS archive location.

Log in to the Oracle Database Security Central console as an administrator.
Select Data Retention.
Select Remote Archiving in the left navigation menu.
Select Enable Automatic Remote Archiving at the top.

Related Topics

Starting an Archive Job Manually

To start an archive job, you must have configured at least one archive location.

Oracle recommends that you use NFS to transfer data to an archive location. If you use Secure Copy (SCP) or Windows File Sharing (SMB) to transfer data to an archive location, then your data files are first copied to a staging area in the Audit Vault Server. Therefore, you must ensure that there is additional space in the file system. Else copying the data file may fail. Transferring large files using SCP or SMB may take long.

You can register a remote file system by using the AVCLI command REGISTER_REMOTE_FILESYSTEM.

Log in to the Oracle Database Security Central console as an administrator.
Select Data Status.
Select Remote Archiving in the left navigation menu.
Select Archived Data.
Select one or more archived data files from the list by clicking the box to the right of the target name.
Select Move to Remote.
In the dialog box that appears enter the job name.
Select a remote archive location from the drop down list. The selected archived data files will be moved to the remote archive location selection.
Select Save.
Tip:

If the archive job fails and you receive error OAV-46599, check your RMAN configuration as autobackup in the controlfile should be set to off.
```
rman /RMAN> configure controlfile autobackup off;
```

Related Topics

Retrieving Oracle Database Security Central Audit Data

You can retrieve data files for a specific target and time range.

The Months Archived value in a targets retention (archiving) policy determines how long the target’s data is available to retrieve to the Audit Vault Server. When the Months Archived period expires, the data is no longer available to retrieve, however, it continues to reside in the archive location.

Log in to the Audit Vault Server as an administrator.
Select Settings, and from the left navigation menu, select Archiving.
Select Retrieve sub on the main page.
Under Retrieve Request, enter the following:
- Target menu: Select the target.
- Start Date field: Enter the start date, optionally using the date icon to select from a calendar. The start and end dates are associated with the event time (the time the event occurred).
- End Date field: Enter the end date, optionally using the date icon to select from a calendar.
Select Retrieve .
Note:
- You can check the status of the retrieve job in the Jobs dialog that can be accessed from the System in the left navigation menu.
- When the retrieved data files are available, they are listed in the Retrieved Datafiles section of the Retrieve, and the data will be visible in reports.
- The datafiles archived in NFS locations are deleted from the location after the retrieve job completes.
To purge retrieved files when no longer needed, from the Retrieved Datafiles section. Select the files you want to unload from the system, and then select Release . Once the release is successful, the data is not visible in reports.
After the retrieved data files are released, they are now eligible to be archived again. If they are not needed anytime soon, then they should be archived to release disk space to the system.
Note:

Alternately, you can view or get the tablespaces archived by following these steps:
1. Connect to the primary Audit Vault Server using SSH.
2. Connect to SQLPlus* as administrator.
3. Run the following commands:
```
set linesize 100
```
```
column TABLESPACE_NAME format a30
```
```
column EVENT_MONTH format a15
```
```
SELECT * FROM TABLE(avsys.ilm.get_target_eventmonth_for_tablespaces);
```
4. The above query displays the results with TABLESPACE_NAME, SECURED_TARGET_ID and EVENT_MONTH indicating the month for which the data is stored for the respective target ID for each tablespace. This information can be used to retrieve data.

Related Topics