Configuring Audit Vault Server Syslog Destinations

Learn how to configure the types of syslog messages to send from Audit Vault Server. Configuring Syslog enables integration with popular SIEM vendors such as Splunk, IBM QRadar, LogRhythm, ArcSight and others.

The message categories are Debug, Info, or System. You can also forward Alert messages to the syslog.

Ensure that the IP addresses provided for syslog destinations are on a different host than the Audit Vault Server.

Note:

• Syslog message is sent to the destination machine. The message is not written to the Audit Vault Server /var/log/message file.

• If you’ve deployed DBSecCentral using RAC, these settings are inaccessible though the UI. See [Syslog Settings] (deploying-dbseccentral-high-availability-configuration-using-oracle-real-application-cluster.md#GUID-F7539E5C-D385-49A8-B4C6-3EA7B3683DD6) for instructions on how to configure syslog using AVCLI commands.

1. Log in to the Oracle Database Security Central console as a super administrator. See Using Oracle Database Security Central Console for more information.

2. Select Settings.

3. Select System in the left navigation menu.

4. Under the Configuration section, select Connectors.

5. In the Connectors dialog, select Syslog.

6. Complete the fields, as necessary:

   • Syslog Destinations (UDP): Use this box if you are using User Datagram Protocol (UDP) to communicate syslog messages from Audit Vault Server. Enter the IP address and port combinations of each server, separated by a space. Be sure to specify the port number explicitly, even if you are using the default port 514.

   • Syslog Destinations (TCP): Use this box if you are using Transmission Control Protocol (TCP) to communicate syslog messages from Audit Vault Server. Enter the IP address and port combinations of each server that is permitted to receive the syslog messages, separated by spaces.

   • Syslog Categories: You can select the types of messages to be sent to Syslog as follows:

     • Alert: Alerts based on alert conditions that an Oracle Database Security Central auditor specifies.

       To forward Oracle Database Security Central alerts to syslog. In addition to this setting, the Oracle Database Security Central auditor must configure alert forwarding.

     • Debug: Engineering debug messages (for Oracle support use only).

     • Info: General Oracle Database Security Central messages and property changes.

     • System: System messages generated by Oracle Database Security Central or other software that has a syslog priority level of at least INFO.

7. Select Save.

8. Repeat the initial system settings and options set on the second Audit Vault Server, in case of high availability.

   See Also:

   • Specifying Initial System Settings and Options on Audit Vault Server (Required)

   • Oracle Database Security Central Auditor’s Guide for detailed instructions and information about Oracle Database Security Central syslog alert formats