Operating System and Repository Auditing

Learn how to audit DBSecCentral’s operating system (OS) and embedded repository.

About Auditing Operating System

Learn all about auditing of the operating system.

Audit Vault Sever enables default Oracle Linux audit configuration. The configuration settings are available in /etc/audit/auditd.conf file and the audit logs are recorded in /var/log/audit directory.

Audit Policies Used in Application Auditing

Learn what audit policies are used to configure application auditing in Oracle DBSecCentral.

Table 1 Oracle Predefined Policies

Policy Name	Description
`ORA_LOGON_FAILURES`	Any failed log in events.
`AVDF_ORA_SECURECONFIG`	This policy is the same as `ora_secureconfig`, secure configuration defined by Oracle Database except for the `AVSYS` and `MANAGEMENT` users.
`AVSYS_DV_UA_POLICY`	Database Vault protected `AVSYS` realm. The Database Vault `AVSYS` realm protects all objects owned by the `AVSYS` database schema.
`MANAGEMENT_DV_UA_POLICY`	Database Vault protected `MANAGEMENT` realm. The Database Vault `MANAGEMENT` realm protects all objects owned by the `MANAGEMENT` database schema.
`AUDIT_DB_MGMT_POLICY`	Database management operations.
`AUDIT_SELECT_DICTIONARY_POLICY`	Select any dictionary privilege except for `AVSYS` and `MANAGEMENT` user.

See Also:

AVDF_ORA_SECURECONFIG

The AVDF_ORA_SECURECONFIG policy audits the following except for AVSYS and MANAGEMENT users.

CREATE AUDIT POLICY AVDF_ORA_SECURECONFIG
    PRIVILEGES ALTER ANY TABLE, CREATE ANY TABLE, DROP ANY TABLE,
    CREATE ANY PROCEDURE, DROP ANY PROCEDURE, ALTER ANY PROCEDURE,
    GRANT ANY PRIVILEGE, GRANT ANY OBJECT PRIVILEGE, GRANT ANY ROLE,
    AUDIT SYSTEM, CREATE EXTERNAL JOB, CREATE ANY JOB,
    CREATE ANY LIBRARY,
    EXEMPT ACCESS POLICY,
    CREATE USER, DROP USER,
    ALTER DATABASE, ALTER SYSTEM,
    CREATE PUBLIC SYNONYM, DROP PUBLIC SYNONYM,
    CREATE SQL TRANSLATION PROFILE, CREATE ANY SQL TRANSLATION PROFILE,
    DROP ANY SQL TRANSLATION PROFILE, ALTER ANY SQL TRANSLATION PROFILE,
    TRANSLATE ANY SQL,
    EXEMPT REDACTION POLICY,
    PURGE DBA_RECYCLEBIN, LOGMINING,
    ADMINISTER KEY MANAGEMENT, BECOME USER
    ACTIONS  ALTER USER, CREATE ROLE, ALTER ROLE, DROP ROLE,
    SET ROLE, CREATE PROFILE, ALTER PROFILE,
    DROP PROFILE, CREATE DATABASE LINK,
    ALTER DATABASE LINK, DROP DATABASE LINK,
    CREATE DIRECTORY, DROP DIRECTORY,
    CREATE PLUGGABLE DATABASE,
    DROP PLUGGABLE DATABASE,
    ALTER PLUGGABLE DATABASE,
    EXECUTE ON DBMS_RLS,
    ALTER DATABASE DICTIONARY
WHEN
    'sys_context(''''USERENV'''',''''CURRENT_USER'''')
    NOT IN (''''AVSYS'''', ''''MANAGEMENT'''')'
    EVALUATE PER STATEMENT;

AVSYS_DV_UA_POLICY

CREATE AUDIT POLICY statement shows the AVSYS_DV_UA_POLICY unified audit policy definition as follows:

create audit policy AVSYS_DV_UA_POLICY actions component=dv
realm violation on "Audit Vault Realm",
realm success on "Audit Vault Realm",
realm access on "Audit Vault Realm",
rule set failure on "AVSYS audit command",
rule set success on "AVSYS audit command",
rule set eval on "AVSYS audit command"

Unified Audit Policy for Database Vault AVSYS Realm

AVSYS Database Vault realm protects all AVSYS objects including AVSYS tables, packages, and others. AVSYS_DV_UA_POLICY audits all activities on the Database Vault AVSYS realm.

The following commands are audited by Database Vault AVSYS realm:

drop database link
drop index
drop package
drop package body
drop procedure
drop sequence
drop synonym
drop table
drop type
drop type body
drop view
delete
revoke
truncate table

MANAGEMENT_DV_UA_POLICY

CREATE AUDIT POLICY statement shows the MANAGEMENT_DV_UA_POLICY unified audit policy definition as follows:

create audit policy MANAGEMENT_DV_UA_POLICY actions component=dv
realm violation on "Audit Vault Account Manager Realm",
realm success on "Audit Vault Account Manager Realm",
realm access on "Audit Vault Account Manager Realm",
rule set failure on "MANAGEMENT audit command",
rule set success on "MANAGEMENT audit command",
rule set eval on "MANAGEMENT audit command"

Unified Audit Policy for Database Vault MANAGEMENT Realm

Management Database Vault realm protects all the MANAGEMENT object, includes MANAGEMENT tables, packages, etc. MANAGEMENT_DV_UA_POLICY audits all activities on the Database Vault MANAGEMENT realm.

The following commands are audited by Database Vault MANAGEMENT realm:

drop database link
drop index
drop package
drop package body
drop procedure
drop sequence
drop synonym
drop table
drop type
drop type body
drop view
delete
revoke
truncate table

AUDIT_DB_MGMT_POLICY

CREATE AUDIT POLICY statement shows the AUDIT_DB_MGMT_POLICY unified audit policy definition and audits all users:

create audit policy audit_db_mgmt_policy
privileges
ALTER PUBLIC DATABASE LINK,
AUDIT ANY, AUDIT SYSTEM,
CREATE ANY TRIGGER, CREATE PUBLIC DATABASE LINK,
DROP ANY DIRECTORY, DROP PUBLIC DATABASE LINK
actions
ALTER FUNCTION, ALTER PACKAGE, ALTER PROCEDURE,
ALTER TRIGGER,
CREATE PACKAGE, CREATE PACKAGE BODY, CREATE PROCEDURE,
CREATE SPFILE, CREATE TRIGGER,
DROP FUNCTION, DROP PACKAGE, DROP PROCEDURE,
DROP TRIGGER;

AUDIT_SELECT_DICTIONARY_POLICY

CREATE AUDIT POLICY statement shows the AUDIT_SELECT_DICTIONARY_POLICY unified audit policy definition and audits all users except AVSYS and MANAGEMENT:

CREATE AUDIT POLICY  AUDIT_SELECT_DICTIONARY_POLICY
        PRIVILEGES
        SELECT ANY DICTIONARY
    WHEN 'sys_context(''''USERENV'''',''''CURRENT_USER'''')
        NOT IN (''''AVSYS'''', ''''MANAGEMENT'''')'
        EVALUATE PER STATEMENT;

Viewing DBSecCentral OS and Repository Audit Report

The OS and repository audit reports can be viewed by a super auditor on the DBSecCentral System Report page.

Log in to Oracle Database Security Central Console as a super auditor.
Select Reports.
Select DBSecCentral System Reports.
Select one of the following reports:
- All Activity - The All Activity report includes all the audited activities of the DBSecCentral appliance’s application, embedded repository, and operating system.
- Database Auditing - The Database Auditing report includes all the audited activities of the DBSecCentral appliance’s embedded repository.
- OS Auditing - The OS Auditing report includes all the audited activities of the DBSecCentral appliance’s embedded operating system.

Records in the DBSecCentral System Reports will be purged after six months.

You can schedule and generate these reports, Scheduling and Generating PDF or XLS Reports.

Related Topics

DBSecCentral System Reports - Auditor Guide

Stop DBSecCentral Operating System and Repository Auditing

Perform the following steps to stop auditing of the DBSecCentral operating system and embedded repository in DBSecCentral.

Log in to the Audit Vault Server through SSH and switch to the root user.

See Logging In to Oracle DBSecCentral Appliances Through SSH.
Unlock the avsys account.
1. Switch to the dvaccountmgr user.
```
su - dvaccountmgr
```
2. Start SQL*Plus without the user name and password.
```
sqlplus /
```
3. Run the following command to unlock avsys:
```
alter user avsys identified by <password> account unlock;
```
4. Exit SQL*Plus.
```
exit
```
Note: Remember to relock the avsys account when you’ve completed this task.
Log in to the Audit Vault Server through SSH and switch to the root user.

See Logging In to Oracle DBSecCentral Appliances Through SSH.
Switch to the oracle user.
```
su - oracle
```
Start SQL*Plus as the avsys user.
```
sqlplus avsys
```
Run one the following to stop the collection of the listed audit trail:
- avsys.avdf_system_audit.stop_database_trail to stop the collection of the embedded repository’s unified audit trail
- avsys.avdf_system_audit.stop_os_trail to stop the collection of the OS trail
- avsys.avdf_system_audit.stop_avdf_trails to stop the collection of the above trails in addition to the application audit trail - Application Auditing
It is not possible to disable the audit trail for the DBSecCentral OS or embedded repository, however stopping the collection will prevent additional records from being stored in the DBSecCentral System Reports.
Lock the avsys account.
1. Switch to the dvaccountmgr user.
```
su - dvaccountmgr
```
2. Start SQL*Plus without the user name and password.
```
sqlplus /
```
3. Run the following command to lock avsys:
```
alter user avsys account lock;
```
4. Exit SQL*Plus.
```
exit
```

Start DBSecCentral Operating System and Repository Auditing

Perform the following steps to start auditing of the DBSecCentral operating system and embedded repository in DBSecCentral.

Log in to the Audit Vault Server through SSH and switch to the root user.

See Logging In to Oracle DBSecCentral Appliances Through SSH.
Unlock the avsys account.
1. Switch to the dvaccountmgr user.
```
su - dvaccountmgr
```
2. Start SQL*Plus without the user name and password.
```
sqlplus /
```
3. Run the following command to unlock avsys:
```
alter user avsys identified by <password> account unlock;
```
4. Exit SQL*Plus.
```
exit
```
Note: Remember to relock the avsys account when you’ve completed this task.
Log in to the Audit Vault Server through SSH and switch to the root user.

See Logging In to Oracle DBSecCentral Appliances Through SSH.
Switch to the oracle user.
```
su - oracle
```
Start SQL*Plus as the avsys user.
```
sqlplus avsys
```
Run one the following to start the collection of the listed audit trail:
- avsys.avdf_system_audit.start_database_trail to start the collection of the embedded repository’s unified audit trail
- avsys.avdf_system_audit.start_os_trail to start the collection of the OS trail
- avsys.avdf_system_audit.start_avdf_trails to start the collection of the above trails in addition to the application audit trail - Application Auditing
Lock the avsys account.
1. Switch to the dvaccountmgr user.
```
su - dvaccountmgr
```
2. Start SQL*Plus without the user name and password.
```
sqlplus /
```
3. Run the following command to lock avsys:
```
alter user avsys account lock;
```
4. Exit SQL*Plus.
```
exit
```

About Purging Unified Audit Trail on the Main Audit Vault Server

Learn how to configure a purge job for unified audit data pertaining to the Audit Vault Server.

Unified audit trail data that is older than 7 days is purged by default. This is done as part of the AVS_MAINTENANCE_JOB that is scheduled to run daily by default. The schedule can be changed using the Oracle Database Security Central console.

See Also: Schedule Maintenance Jobs

It is recommended to configure a unified audit trail purge job in the Audit Vault Server.

Follow these steps to configure unified audit trail purge job:

Log in to the Audit Vault Server as root OS user.
Run the command to switch to oracle user:
```
su - oracle
```
Start SQLPlus* connection as sqlplus /nolog without the username or password.
In SQLPlus* run the following command:
```
connect <sysdba>
```
Enter the password when prompted. Alternatively, run the command:
```
connect <sysdba/password>
```
Run the following SQL script to create a purge job with the job name AVS_UNIFIED_AUDIT_CLEANUP for Unified Audit Trail:
```
begin
      dbms_audit_mgmt.create_purge_job(
        audit_trail_type => dbms_audit_mgmt.audit_trail_unified,
        audit_trail_purge_interval => 1,
        audit_trail_purge_name => 'AVS_UNIFIED_AUDIT_CLEANUP',
        use_last_arch_timestamp => true,
        container => dbms_audit_mgmt.container_current);
  end;
```
This job runs once every hour to clean up the unified audit trail based on the archived timestamp updated by the Audit Vault Server Database auditing collection.

Tip: It is recommended to configure unified audit trail purge job.
Note:

When you configure unified audit trail purge job, the cleanup performed as part of AVS_MAINTENANCE_JOB is automatically removed and the following message is displayed in the Job Status page:
```
Audit Trail cleanup for Audit Vault Server is enabled, so not purging audit data by Maintenance
```

Note:

To check the status of AVS_UNIFIED_AUDIT_CLEANUP, run the following SQL statement:

select * from dba_scheduler_job_run_details where job_name='AVS_UNIFIED_AUDIT_CLEANUP';

Refer to Audit Trail Management Data Dictionary Views for more information.