About Host Monitoring

You can deploy Database Firewall in Monitoring (Host Monitor) mode.

Database Firewall monitors and analyzes the SQL traffic to the database. You can configure Database Firewall in the following deployment modes:

For descriptions of these deployment modes, see Introduction to Database Firewall Deployment.

The Monitoring (Host Monitor) deployment mode requires a Host Monitor Agent to be deployed on the host machine where the target database is running. You can configure the Host Monitor Agent to capture SQL traffic on ports that the database is listening on. The Host Monitor Agent can capture SQL traffic of multiple databases that are running on a single host machine, and it can capture SQL traffic when there are multiple network paths from clients to the target database.

After you deploy and configure the Host Monitor Agent on the agent machine, it performs the following actions:

The Host Monitoring Agent can inspect SQL commands issued using local connections to the database through loopback (non-Oracle and Oracle) and bequeath (Oracle) when the Database Firewall is deployed in Monitoring (Host Monitor) mode. With this feature, the Host Monitoring Agent has complete visibility into database activities performed by all users including administrators accessing the database server as such. For a comprehensive visibility, it is recommended to augment network monitoring with database auditing. Database auditing running inside the Oracle Database has complete visibility into the internal jobs or procedure execution which typically network monitoring might not have access to. Database auditing cannot be bypassed by the use of synonyms or dynamically generated names, while network monitoring policies should be trained for all such possible combinations to make it foolproof.

Related Topics