Audit Trail Collection AVCLI Commands

The audit trail collection AVCLI commands enable you to perform tasks such as starting and stopping audit trail collections.

About Oracle Audit Trail AVCLI Commands

The AVCLI target audit trial collection commands enable you to manage the audit trail collections for the targets.

DROP TRAIL FOR TARGET

This command drops a trail that no longer needs to be monitored.

Note: An audit trail must be in a STOPPED state in order for it to be dropped. A trail that has previously collected audit data associated with it cannot be dropped.

Syntax

DROP TRAIL FOR TARGET <target_name> USING HOST <hostname> FROM <location> [WITH CONNECTION <connection_name>]

Arguments

Argument Description
target_name The name of the target whose audit trail you want to drop.
hostname

The name of the host where the target agent resides.

For agentless collection of Oracle Database table trails and Microsoft SQL Server directory trails, use 'agentless collection' as the host name.

location

The location is one of following:

  • DIRECTORY directory name / mask

  • TABLE tablename

  • SYSLOG DEFAULT | filename / file mask

  • NETWORK

  • EVENT LOG [eventlog name]

  • TRANSACTION LOG directory name / mask

  • CUSTOM name

connection_name

Optional. Connection name.

For Oracle Database having Active Data Guard with Unified Auditing, the trails can connect to the current primary database using failover connection string. Or trails can connect to individual databases in Active Data Guard using connection name, specified using WITH CONNECTION directive. The WITH CONNECTION directive should be used only for Oracle Database having Active Data Guard with Unified Auditing.

The WITH CONNECTION directive should not be used for non Active Data Guard databases.

The WITH CONNECTION directive should not be used for Active Data Guard databases with Traditional Auditing.

The connection name can be either failover_connection or it can be audit collection attribute name in the format av.target.connection. specified during target creation. For additional information, refer to Additional Information for Audit Collection from Oracle Active Data Guard.

See Also:

Examples

avcli> DROP TRAIL FOR TARGET sample_source USING HOST foo FROM
   DIRECTORY /opt/audit_trail;

The audit trail from the directory /opt/audit_trail for target sample_source is dropped.

avcli> DROP TRAIL FOR TARGET sample_source USING HOST foo FROM TABLE sys.aud$;

The audit trail from table trail sys.aud$ for target sample_source is dropped.

avcli> DROP TRAIL FOR TARGET sample_source USING HOST foo FROM SYSLOG DEFAULT
   /usr/syslog/syslog*;

Syslog trail /usr/syslog/syslog* for target sample_source is dropped.

avcli> DROP TRAIL FOR TARGET sample_source USING HOST foo FROM TRANSACTION LOG /extract;

The transaction log trail from the directory /extract for target sample_source is dropped.

avcli> DROP TRAIL FOR TARGET mysource USING HOST foo FROM TABLE unified_audit_trail WITH CONNECTION failover_connection;

Deletes table trail unified_audit_trail for target mysource using failover connection specified during target registration. This is applicable only for Oracle Database having Active Data Guard with Unified Auditing.

avcli> DROP TRAIL FOR TARGET mysource USING HOST foo FROM TABLE unified_audit_trail WITH CONNECTION av.target.connection.<name>;

Deletes table trail unified_audit_trail for target mysource using connection name in the format av.target.connection.<name> specified during target registration. This is applicable only for Oracle Database having Active Data Guard with Unified Auditing.

LIST TRAIL FOR TARGET

Use the LIST TRAIL FOR TARGET command to list audit trails that have been started with the START COLLECTION command or stopped with the STOP COLLECTION command,

The LIST TRAIL FOR TARGET command lists the available audit trails that have been started with the START COLLECTION command or stopped with the STOP COLLECTION command.

Syntax

LIST TRAIL FOR TARGET <target_name>

Arguments

Argument Description
target_name

The name of the target.

To find a list of existing targets, see "LIST TARGET".

Usage Notes

LIST TRAIL FOR TARGET does not list audit trails have been created but not yet started or stopped.

Examples

LIST TRAIL FOR TARGET

The trails available for the target sample_souce are listed.

START COLLECTION FOR TARGET

This command starts the collection of specified audit trail data from a given target, optionally using the specified collection plug-in.

Note: If the audit trail does not already exist, then it is created and started.

Syntax

START COLLECTION FOR TARGET <target_name> USING HOST <host> FROM <location>
   [USING PLUGIN <plugin id>] [WITH CONNECTION <connection_name>]

Arguments

Argument Description
target_name The name of the target whose audit trail collection you want to begin.
host

The name of the host where the target agent resides.

For agentless collection of Oracle Database table trails and Microsoft SQL Server directory trails, use 'agentless collection' as the host name.

location

The location is one of following:

  • DIRECTORY directory name / mask

  • TABLE tablename

  • SYSLOG DEFAULT | filename / file mask

  • NETWORK

  • EVENT LOG [eventlog name]

  • TRANSACTION LOG directory name / mask

  • CUSTOM name

plugin id The collection plug-in id being used. Required if there is more than one possible plug-in. Optional if there is only one plug-in.
connection_name

Optional. Connection name.

For Oracle Database having Active Data Guard with Unified Auditing, the trails can connect to the current primary database using failover connection string. Or trails can connect to individual databases in Active Data Guard using the connection name specified using WITH CONNECTION directive.

The WITH CONNECTION directive should be used only for Oracle Database having Active Data Guard with Unified Auditing.

The WITH CONNECTION directive should not be used for non Active Data Guard databases.

The WITH CONNECTION directive should not be used for Active Data Guard databases with Traditional Auditing.

The connection name can be either failover_connection or it can be audit collection attribute name in the format av.target.connection. specified during target creation. For additional information, refer to Additional Information for Audit Collection from Oracle Active Data Guard.

See Also:

General Usage Notes

To start the trail, the agent process which manages the trail should also be in running state. If the collection process connects to the target, the target must up and running. When multiple plug-ins can process audit data from a target, use the optional USING PLUGIN directive to disambiguate the collection process.

A trail starts in the START_REQUESTED state and transitions to a starting state, followed by a running state. If there is no outstanding audit data to process from the given trail, the collection process switches to an idle state. The current state can be viewed using the LIST TRAIL command.

If a trail must be authenticated, the Audit Vault Server uses the credentials provided in the AUTHENTICATED BY argument of the REGISTER TARGET command.

After you run the START COLLECTION command, the Audit Vault Server begins to collect audit data from the configured targets. If you want to stop the collection, then run the STOP COLLECTION command.

See Also:

Windows Systems Usage Notes

On Windows systems, enter directory and file name locations in either double-quoted strings or as a nonquoted string using forward slashes. For example:

... FROM DIRECTORY "c:\app\oracle\product\11.1\av";

... FROM DIRECTORY c:/app/oracle/product/11.1/av;

General Examples

avcli> START COLLECTION FOR TARGET sample_source USING HOST foo FROM
   directory /opt/audit_trail;

Audit data collection from trail /opt/audit_trail for target sample_source starts.

avcli> START COLLECTION FOR TARGET sample_source USING HOST foo FROM TABLE sys.aud$;

Audit data collection from table trail sys.aud$ for target sample_source starts.

avcli> START COLLECTION FOR TARGET sample_source USING HOST foo FROM syslog
   /usr/syslog/syslog*;

Collecting syslog trail /usr/syslog/syslog* for target sample_source starts.

avcli> START COLLECTION FOR TARGET sample_source USING HOST foo FROM event
  log application;

Collecting application event log trail for target sample_source starts.

avcli> START COLLECTION FOR TARGET sample_source USING HOST foo FROM transaction log /extract;

Audit data collection from trail /extract for target sample_source.

Collecting transaction log data from trail location /extract for target sample_source starts.

avcli> START COLLECTION FOR TARGET sample_source USING HOST foo
  FROM TABLE sys.aud$ USING PLUGIN com.sample_plugin;

Audit data collection from table trail sys.aud$ for the target sample_source, using the com.sample_plugin, plug-in starts.

avcli> START COLLECTION FOR TARGET mysource USING HOST foo FROM TABLE unified_audit_trail WITH CONNECTION failover_connection;

Starts collecting audit data from table trail unified_audit_trail for target mysource using failover connection specified during target registration. This is applicable only for Oracle Database having Active Data Guard with Unified Auditing.

avcli> START COLLECTION FOR TARGET mysource USING HOST foo FROM TABLE unified_audit_trail WITH CONNECTION av.target.connection.<name>;

Starts collecting audit data from table trail unified_audit_trail for target mysource using connection name in the format av.target.connection.<name> specified during target registration. This is applicable only for Oracle database having Active Data Guard with Unified Auditing.

Oracle Database Target Usage Notes

Audit Trail Settings

For the operating system type of audit trail, use the following settings:

Type of Audit Trail trail_type Setting audit_trail Setting
Operating system directory DIRECTORY directory_location
Syslog file SYSLOG file_name
Windows event log EVENTLOG N/A

SQL Server Target Usage Notes

Audit Trail Settings

You can write the SQL Server audit trail to the Windows event log, C2 trace files, or server side trace files. The FROM trail_type audit_trail arguments are as follows:

Type of Audit Trail trail_type Setting audit_trail Setting
Windows event log EVENTLOG N/A
C2 trace file DIRECTORY file_wildcard
Server-side trace files DIRECTORY file_wildcard
SQLAUDIT files DIRECTORY file_wildcard

Tip: The user must have admin privileges to access the security event log collector system. The user has an option to choose the following properties as the maximum event log size.

avcli> START COLLECTION FOR TARGET hr_syb_db USING HOST sybserver
FROM TABLE SYSAUDITS;

MySQL Usage Notes

The trail location is the path to the directory where converted XML files are created by running the MySQL XML transformation utility.

See Also: Running the XML Transformation Utility for MySQL Audit Formats

IBM DB2 Usage Notes and Examples

For the IBM DB2 audit trail, set the trail_type audit_trail setting to DIRECTORY directory_location.

IBM DB2 Example

avcli> START COLLECTION FOR TARGET hr_db2_db USING HOST db2server
FROM DIRECTORY "d:\temp\trace";

Oracle Solaris Target Usage Notes

For an Oracle Solaris target, the trail location used in this command must be in the format:

hostname:path_to_trail

where hostname matches the host name in the audit log names, which look like this:

timestamp1.timestamp2.hostname

Windows Target Usage Notes

For a Windows target, the event log audit trail type collects data from the Windows Security Event Log. The trail location used in this command must be security.

Tip: The user must have admin privileges to access the security event log collector system. The user has an option to choose the following properties as the maximum event log size.

Active Directory Target Usage Notes

For Active Directory target, the event log audit trail type collects data from the security and directory service. The trail location used in this command must be security or directory service.

Tip: Use the following best practices for event log properties:

Event Log Properties When Maximum Event Log Size Is Reached To Accomplish
Overwrite event as needed

It is recommended to select Overwrite event as needed (Oldest event first) or Do not overwrite events.

To delete the oldest event first. It automatically clears events.
Do not overwrite events To avoid overwriting of existing events. In this case the user has to manually clear the event log.

Create Audit Trail for a Target

Learn how to create and start an audit trail.

To create a new audit trail, use the command syntax mentioned in START COLLECTION FOR TARGET. In case the audit trail does not already exist, then it is created and started.

STOP COLLECTION FOR TARGET

This command stops audit trail collection.

Syntax

STOP COLLECTION FOR TARGET <target_name> USING HOST <hostname> FROM <location>
 [USING PLUGIN <plugin_id>]] [WITH CONNECTION <connection_name>]

Arguments

Argument Description
target_name The name of the target for the trail collection you want to stop.
hostname

The name of the host where the target agent resides.

For agentless collection of Oracle Database table trails and Microsoft SQL Server directory trails, use 'agentless collection' as the host name.

location

The location is one of following:

  • DIRECTORY directory name / mask

  • TABLE tablename

  • SYSLOGDEFAULT | filename / file mask

  • NETWORK

  • EVENT LOG [eventlog name]

  • TRANSACTION LOG directory name / mask

  • CUSTOM name

plugin_id The collection plug-in id being used. Required if there is more than one possible plug-in. Optional if there is only one plug-in.
connection_name

Optional. Connection name.

For Oracle Database having Active Data Guard with Unified Auditing, the trails can connect to the current primary database using failover connection string. Or trails can connect to individual databases in Active Data Guard using connection name, specified using WITH CONNECTION directive.

The WITH CONNECTION directive should be used only for Oracle Database having Active Data Guard with Unified Auditing.

The WITH CONNECTION directive should not be used for non Active Data Guard databases.

The WITH CONNECTION directive should not be used for Active Data Guard databases with Traditional Auditing.

The connection name can be either failover_connection or it can be audit collection attribute name in the format av.target.connection. specified during target creation. For additional information, refer to Additional Information for Audit Collection from Oracle Active Data Guard.

See Also:

General Usage Notes

Since the command is sent to the trail directly, the agent process does not need to be in running state. When multiple plug-ins process audit data from a target, use the optional USING PLUGIN directive to disambiguate the process.

A trail will be in a STOP_REQUESTED state when stopped and transitions to a stopping state, followed by a stopped state.

Windows Systems Usage Notes

On Windows systems, enter directory and file name locations in either double-quoted strings or as a nonquoted string using forward slashes. For example:

... FROM DIRECTORY "c:\app\oracle\product\11.1\av";

... FROM DIRECTORY c:/app/oracle/product/11.1/av;

General Examples

avcli> STOP COLLECTION FOR TARGET sample_source USING HOST sample_host FROM directory /opt/audit_trail;

Audit data collection from trail /opt/audit_trail for target sample_source stops.

avcli> STOP COLLECTION FOR TARGET sample_source USING HOST sample_host FROM TABLE sys.aud$;

Audit data collection from table trail sys.aud$ for target sample_source stops.

avcli> STOP COLLECTION FOR TARGET sample_source USING HOST sample_host FROM syslog
  /usr/syslog/syslog*;

Collecting syslog trail /usr/syslog/syslog* for target sample_source stops.

avcli> STOP COLLECTION FOR TARGET sample_source USING HOST sample_host FROM event log application;

Collecting application event log trail for target sample_source stops

avcli> STOP COLLECTION FOR TARGET sample_source USING HOST sample_host FROM transaction log /extract;

Collecting transaction log data from trail location /extract for target sample_source stops

avcli> STOP COLLECTION FOR TARGET sample_source USING HOST sample_host FROM TABLE sys.aud$ USING PLUGIN com.sample_plugin;

Audit data collection from table sys.aud$ for the target, sample_source, using the com.sample_plugin, plug-in stops

avcli> STOP COLLECTION FOR TARGET mysource USING HOST foo FROM TABLE unified_audit_trail WITH CONNECTION failover_connection;

Stops collecting audit data from table trail unified_audit_trail for target mysource using failover connection specified during target registration. This is applicable only for Oracle Database having Active Data Guard with Unified Auditing.

avcli> STOP COLLECTION FOR TARGET mysource USING HOST foo FROM TABLE unified_audit_trail WITH CONNECTION av.target.connection.<name>;

Stops collecting audit data from table trail unified_audit_trail for target mysource using connection name in the format av.target.connection.<name> specified during target registration. This is applicable only for Oracle Database having Active Data Guard with Unified Auditing.

Oracle Database Usage Notes and Examples

Audit Trail Settings

For the operating system type of audit trail, use the following settings:

Oracle Database Examples

Operating system directory example:

avcli> STOP COLLECTION FOR TARGET hr_sql_db USING HOST hrdb.example.com
FROM DIRECTORY $ORACLE_HOME/logs;

Operating system syslog file example:

avcli> STOP COLLECTION FOR TARGET hr_sql_db USING HOST hrdb.example.com
FROM SYSLOG /etc/syslog.conf;

Operating system Windows event log example:

avcli> STOP COLLECTION FOR TARGET hr_sql_db USING HOST hrdb.example.com
FROM EVENTLOG;

Database audit trail example:

avcli> START COLLECTION FOR TARGET hr_sql_db USING HOST hrdb.example.com
FROM TABLE sys.aud$;

TRANSACTION LOG example:

avcli> START COLLECTION FOR TARGET hr_sql_db USING HOST hrdb.example.com FROM TRANSACTION LOG /extract;

SQL Server Usage Notes and Example

The SQL Server audit trail can be in the Windows event log, C2 trace files, or server side trace files. The FROM trail_type audit_trail arguments are as follows:

Type of Audit Trail trail_type Setting audit_trail Setting
Windows event log EVENTLOG n/a
C2 trace file C2TRACE file_wildcard
Server-side trace files SERVERSIDETRACE file_wildcard

SQL Server Examples

Windows event log example:

avcli> STOP COLLECTION FOR TARGET hr_sql_db USING HOST mssqlserver
FROM EVENTLOG;

C2 trace example:

avcli> STOP COLLECTION FOR TARGET hr_sql_db USING HOST mssqlserver
FROM DIRECTORY "c:\SQLAuditFile*.trc";

Server-side trace example:

avcli> STOP COLLECTION FOR TARGET hr_sql_db USING HOST mssqlserver
FROM DIRECTORY "c:\SQLAuditFile*.trc";

MySQL Usage Notes

The trail location is the path to the directory where converted XML files are created by running the MySQL XML transformation utility.

See Also: Running the XML Transformation Utility for MySQL Audit Formats

IBM DB2 Usage Notes and Example

For the IBM DB2 audit trail, set the trail_type audit_trail setting to DIRECTORY directory_location.

IBM DB2 Example

avcli> STOP COLLECTION FOR TARGET hr_db2_db USING HOST db2server
FROM DIRECTORY "d:\temp\trace";

Oracle Solaris Usage Notes

For Oracle Solaris, the trail location must be in the format:

hostname:path_to_trail

where hostname matches the host name in the audit log names, which look like this:

timestamp1.timestamp2.hostname

Windows Target Usage Notes

For a Windows target, the event log audit trail type collects data from the Windows Security Event Log. The trail location used in this command must be security.

MOVE COLLECTION FOR TARGET

This command moves the audit collection for the specified trail from one audit agent to another.

Syntax

MOVE COLLECTION FOR TARGET <target name> ON <location> [WITH CONNECTION <connection name>] FROM AGENT <current agent> TO AGENT <another agent>

The can be either: `DIRECTORY <directory name/mask>` or `TABLE <table name>`.

Usage Notes

Examples

Move audit collection of directory trail /opt/audit_trail for target mysource from agent1 to agent2.

MOVE COLLECTION FOR TARGET mysource ON DIRECTORY /opt/audit_trail FROM AGENT agent1 TO AGENT agent2

Move audit collection of table trail sys.aud$ for target mysource from agent1 to agent2.

MOVE COLLECTION FOR TARGET mysource ON TABLE sys.aud$ FROM AGENT agent1 TO AGENT agent2

Move audit collection of table trail unified_audit_trail for target mysource using failover connection from agent1 to agent2. This is applicable only for Oracle database having Active Data Guard with Unified Auditing. Failover connection string is specified during Active Data Guard target registration.

MOVE COLLECTION FOR TARGET mysource ON TABLE unified_audit_trail WITH CONNECTION failover_connection FROM AGENT agent1 TO AGENT agent2

Move audit collection of table trail unified_audit_trail for target mysource using connection av.target.connection.<name> from agent1 to agent2. This is applicable only for Oracle database having Active Data Guard with Unified Auditing. Connection av.target.connection.<name> is specified using audit collection attribute during target registration.

MOVE COLLECTION FOR TARGET mysource ON TABLE unified_audit_trail WITH CONNECTION  av.target.connection.<name> FROM AGENT agent1 TO AGENT agent2

Related Topics

LIST COLLECTION

This command lists the audit collections present on a given agent.

Syntax

LIST COLLECTION FOR AGENT <agent name>

Example

List the audit collections present on agent1.

LIST COLLECTION FOR AGENT agent1