Audit Collection Consideration

Considerations for audit collection on other target types.

Additional Information for Audit Collection from Oracle Active Data Guard

Learn about additional information required to collect audit data from Oracle Active Data Guard.

Oracle Active Data Guard is a high availability solution which consists of one primary database and multiple standby databases. This section contains some additional information for configuring different audit trails.

Note:

When Unified Auditing is enabled, audit collection is supported from both the primary and standby databases of Oracle Active Data Guard. For Oracle Active Data Guard target, Unified Auditing is recommended for Oracle DBSecCentral latest release.

Traditional Auditing

Follow these steps for collecting audit data from databases in Oracle Active Data Guard with traditional auditing:

  1. Set AUDIT_TRAIL parameter to DB, EXTENDED on all target databases.

  2. Create a target in Oracle DBSecCentral with a single connection string that contains the connection details of all the databases. This ensures that Oracle DBSecCentral trail can read from sys.aud$ table of the current primary database even when failover or switchover occurs.

  3. For the above mentioned target configure Oracle Database table trail in Oracle DBSecCentral to read the records from sys.aud$.

  4. Create one target in Oracle DBSecCentral for every database in Oracle Active Data Guard with a connection string that contains connection details of only the specific database.

  5. Configure one directory trail in Oracle DBSecCentral for every target to collect data from *.aud log file for the specific target database in Oracle Active Data Guard.

Unified Auditing

Audit data can be collected from both the primary and standby databases in Oracle Active Data Guard with unified auditing. Follow these steps:

  1. Ensure to apply patch (33568223 and 33420490) on all the databases in the Oracle Active Data Guard setup.

  2. Create a failover connection string which always connects to the current primary database in Oracle Active Data Guard.

  3. Registration of a single target database is required in Oracle DBSecCentral to collect audit data from all the databases in Oracle Active Data Guard.

  4. Select Active Data Guard checkbox during target registration.

  5. In the Failover Connection String text box, enter the failover connection string which always connects to current primary database.

  6. Create an attribute in the Audit Collection Attributes for every database in the Oracle Active Data Guard configuration as follows:

    • Each attribute should be in the format av.target.connection.<name> where <name> can be any identifier defined by the user to identify the database.

    • The value corresponding to each attribute should be specified as the connection string of that specific database. For example, if there are three databases in Oracle Active Data Guard configuration, then the user can create these attributes:

      Attribute Name Attribute Value
      av.target.connection.first_db Dedicated connection string of the first database.
      av.target.connection.second_db Dedicated connection string of the second database.
      av.target.connection.third_db Dedicated connection string of the third database.

  7. For audit collection create one trail for every database in the Oracle Active Data Guard configuration. Create an additional trail that uses the failover connection string. The remaining trails must use the connection string specified in the Audit Collection Attributes.

  8. Select Add to create an audit trail and specify the following. This step has to be performed only once. There will be only one trail which uses the failover connection.

    Field Select or enter the value
    Audit Trail Type TABLE
    Trail Location UNIFIED_AUDIT_TRAIL
    Connection FAILOVER_CONNECTION

  9. Select Add to create the trails and select the following options. This step has to be performed for every database in the Oracle Active Data Guard.

    Field Select or enter the value
    Audit Trail Type TABLE
    Trail Location UNIFIED_AUDIT_TRAIL
    Connection av.target.connection.<name>

For cleanup of file based audit data on standby database, use DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL with AUDIT_TRAIL_TYPE as DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED_FILES.

For cleanup of file based audit data on primary database, use DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL with AUDIT_TRAIL_TYPE as DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED_FILES.

For cleanup of table based audit data on primary database, use DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL with AUDIT_TRAIL_TYPE as DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED_TABLE. Since the databases are in Active Data Guard configuration, this will also cleanup table based audit data from all the standby databases.

Additional Information for Audit Collection from Oracle Data Guard

Learn about additional information required to collect audit data from Oracle Data Guard.

Oracle Data Guard is a high availability solution which consists of one primary database and multiple standby databases. This section contains some additional information for configuring different audit trails.

Traditional Auditing

Audit data can be collected from the current primary database in Oracle Data Guard with traditional auditing. Follow these steps:

  1. Set AUDIT_TRAIL parameter to DB, EXTENDED, on all target databases.

  2. Create a target in Oracle DBSecCentral with a single connection string that contains the connection details of all the databases. This ensures that Oracle DBSecCentral trail can read from sys.aud$ table of the current primary database after failover or switchover occurs.

  3. Create Oracle Database table trail in Oracle DBSecCentral to read the records from sys.aud$. of the current primary database.

Unified Auditing

Audit data can be collected from the current primary database in Oracle Data Guard with unified auditing. Follow these steps:

  1. Create a target in Oracle DBSecCentral with single connection string that contains the connection details of all the databases. This ensures that Oracle DBSecCentral trail can read from unified_audit_trail table of the current primary database after failover or switchover occurs.

  2. Create Oracle Database table trail in Oracle DBSecCentral to read the records from unified_audit_trail of the current primary database.

Note: Oracle DBSecCentral supports audit collection from the traditional audit trail and unified audit trail for the current primary database only. In case of switchover or failover, audit collection starts on the new primary database, from the point at which the collection had stopped on the old primary database. Audit collection is not supported from the standby database.