Plug-ins That are Shipped with Oracle Database Security Central

Oracle Database Security Central supports plug-ins for a variety of different platforms, such as Oracle Solaris, Linux, and Microsoft Windows.

About Plug-ins

Oracle Database Security Central supports plug-ins for many platforms and third-party products.

Oracle Database Security Central plug-ins support the target versions listed in Table C-1. Select link for each target to get detailed information.

Table 1: Out-of-the-Box Plug-ins and and Features Supported in Oracle Database Security Central

Target Version	Audit Trail Collection	Audit Policy Creation, Entitlement Auditing	Stored Procedure Auditing	Audit Trail Cleanup	Database Firewall	Host Monitor Agent	Native Network Encrypted Traffic Monitoring / Retrieve Session Information
Oracle Database Plug-in for Oracle Database Security Central	Yes	Yes (except Unified Audit Policies)	Yes	Yes	Yes	Yes	Yes
Oracle Database Plug-in for Oracle Database Security Central 12.1, 12.2, 18c, 19c, 21c, 23ai	Yes	Yes (including Unified Audit Policies)	Yes	Yes	Yes	Yes	Yes
PostgreSQL Plug-in for Oracle Database Security Central Open source versions: 9.6 to 11.8 12, 13, 14, 15	Yes	No	No	No	No	No	No
IBM DB2 Plug-in for Oracle Database Security Central for LUW 10.5, 11.1, 11.5	Yes	No	No	Yes	Yes Versions 9.1 - 10.5	Yes	No
Quick JSON Target Type for Oracle Database Security Central	Yes	No	No	No	No	No	No
MySQL Plug-in for Oracle Database Security Central 5.6, 5.7, 8.0	Yes	No	No	Yes	Yes	Yes	No
Oracle Solaris Plug-in for Oracle Database Security Central<p>11.3, 11.4 on SPARC64 platforms</p>	Yes	No	No	No	No	Yes Versions 11, 11.1, 11.2	No
Oracle Linux 6.0 to 6.9, 7.0 to 7.5, 7.6 to 7.8, 7.9, 8, 8.2, 8.3, 9	Yes	No	No	No	No	Yes	No
Red Hat Enterprise Linux 6.7 to 6.10, 7.0 to 7.5, 7.6 to 7.8, 7.9, 8, 8.2, 8.3, 9	Yes	No	No	No	No	Yes	No
IBM AIX Plug-in for Oracle Database Security Central on Power Systems (64-bit) 7.1 (TL5) 7.2 (TL2 and above) 7.3 (TL0) 7.3 (TL2)	Yes	No	No	No	No	Yes	No
Microsoft Windows Plug-in for Oracle Database Security Central Microsoft Windows Server 2012 R2, 2016 on x86-64 2019 on x86-64	Yes	No	No	No	No	No	No
Microsoft Active Directory Plug-in for Oracle Database Security Central 2012 to 2016 on 64 bit	Yes	No	No	No	No	No	No

Related Topics

• Behavior Changes, Deprecated, and Desupported Platforms and Features

Oracle Database Plug-in for Oracle Database Security Central

Learn about the Oracle Database plug-in for Oracle Database Security Central. Table C-2 lists features of the Oracle Database Plug-in.

Table 2 Oracle Database Plug-in

Plug-in Specification	Description
Plug-in directory	AGENT_HOME/av/plugins/com.oracle.av.plugin.oracle
Target Versions	Oracle 12c Release 1 (12.1) Oracle 12c Release 2 (12.2) Oracle 18c Oracle 19c 21c 23ai 26ai
Target Platforms	Linux/x86-64 Solaris /x86-64 Solaris /SPARC64 AIX/Power64 Windows /x86-64 HP-UX Itanium See Platform Support Matrix in Oracle Database Security Central Installation Guide for complete details on supported target platforms and versions.
Setup Script(s)	Yes. See “Oracle Database Setup Scripts” for instructions.
Target Location (Connect String)	jdbc:oracle:thin:@//hostname:port/service
Collection Attributes	None. ORCLCOLL.NLS_LANGUAGE, ORCLCOLL.NLS_TERRITORY and ORCLCOLL.NLS_CHARSET: These will be deprecated in the future. ORCLCOLL.NLS_CHARSET attribute is replaced by AV.COLLECTOR.DATABASECHARSET. See Table C-21 for details. AV.COLLECTOR.TIMEZONEOFFSET Note: This attribute must be set to timezone offset of Oracle Database. It is mandatory if Transaction Log audit trail is going to be configured for the target.
Oracle Database Security Central Audit Trail Types	TABLE DIRECTORY TRANSACTION LOG SYSLOG (Linux only) EVENT LOG (Windows only) NETWORK See Table C-19 for descriptions of audit trail types.
Audit Trail Location	For TABLE audit trails: SYS.AUD$, SYS.FGA_LOG$, DVSYS.AUDIT_TRAIL$, UNIFIED_AUDIT_TRAIL, CDB_UNIFIED_AUDIT_TRAIL, SYS.DBA_SQL_FIREWALL_VIOLATIONS (Oracle AI Database 26ai and later). For DIRECTORY audit trails: Full path to directory containing AUD or XML files. For SYSLOG audit trails: Use DEFAULT or the full path to directory containing the syslog file. For EVENT LOG and NETWORK audit trails: no trail location required. For TRANSACTION LOG: Full path to directory containing Golden Gate Integrated Extract file. Note: Oracle Database Security Central queries and collects records from Unified Audit trail which fetches unified audit records from operating system spillover audit files. The Database Audit Management manages the clean up of Unified Audit trail and the underlying operating system spillover audit files.
Audit Trail Cleanup Support	Yes. See Oracle Database Audit Trail Cleanup for instructions.
OS user running the Agent	For Oracle Database Directory Audit Trail: Any user who has read permission on audit files, i.e oracle user, or user in DBA group. For Table Trail: Any database user (preferably not a DBA). See Oracle Database Setup Scripts for instructions. For Transaction Log trail : Any user who has read permission on Golden Gate Integrated Extract XML files. For any other directory audit trail: Any user who has read permission on audit files.
Supported Character Sets for DIRECTORY and SYSLOG audit trails	The DIRECTORY and SYSLOG audit trails use Java character set to open audit files based on the database character sets. This ensures the audit files are processed using the right character sets and to avoid data loss. The database character set is read from the following sources in the same order: Target attribute AV.COLLECTOR.DATABASECHARSET Target attribute ORCLCOLL.NLS_CHARSET (deprecated) The target Oracle database Note: An exception to the above process is XML audit files with Java character set specified in XML declaration. Refer to the known issues for a list of character sets that are not supported.
Cluster support (Oracle Real Application Clusters)	Yes When configuring a Oracle RAC as a target for audit collection, enter the port number of the SCAN Listener.
Oracle Active Data Guard	Additional Information for Audit Collection from Oracle Active Data Guard

MySQL Plug-in for Oracle Database Security Central

Learn how to use the MySQL plug-in for Oracle Database Security Central. Table C-3 lists the features of the MySQL plug-in.

Table 3 MySQL Plug-in

Plug-in Specification	Description
Plug-in directory	AGENT_HOME/av/plugins/com.oracle.av.plugin.mysql
Target Versions	Enterprise Edition 5.6, 5.7, 8.0
Target Platforms	Linux (x86-64): OL 5.x, 6.x, 7.x and RHEL 6.x, 7.x Microsoft Windows (x86-64): 8 Microsoft Windows Server (x86-64): 2012, 2012R2, 2016
Target Location (Connect String)	jdbc:av:mysql://hostname:port/mysql
Collection Attribute(s)	av.collector.securedTargetVersion - (Required) Specifies the MySQL version. Default is 8.0. av.collector.AtcTimeInterval - (Optional) Specifies the audit trail cleanup file update time interval in minutes. Default is 20.
Oracle Database Security Central Audit Trail Types	DIRECTORY NETWORK See Table C-19 for descriptions of audit trail types.
Audit Trail Cleanup Support	Yes.

Audit Trail Location

The path to the directory where the converted files are created.

The default audit format for MySQL 5.5 and 5.6 is old. The default audit format for MySQL 5.7 is new. The audit format can be changed by modifying the configuration on MySQL Server.

The Audit Trail Location is as follows:

1. For old audit format, the path to the directory is where the converted XML files are created when you run the MySQL XML transformation utility.

2. For new audit format, the path to the directory is where the audit.log files are generated by MySQL Server.

Table 4 Old Audit Format

Audit Trail Location	Value
Input path format before MySQL 5.7.21	For example: \ConvertedXML
Input path format of MySQL 5.7.21 onwards	For example: \ConvertedXML

Table 5 New Audit Format

Audit Trail Location	Value
Input path format before MySQL 5.7.21	For example: \MySQLLog
Input path format for MySQL 5.7.21 onwards	/.*.log Where * is the time stamp in YYYYMMDDThhmmss format. For example: MySQLLog/audit*.log

Note:

• In the old format audit data is collected from converted XML files. In the new format audit data is collected from both active log and rotated logs.

• Audit collection from MySQL Community Edition is not supported by this plug-in of Oracle Oracle Database Security Central.

Tip: Enable automatic size-based audit log file rotation, by setting audit_log_rotate_on_size property. See Audit Log File Space Management and Name Rotation in MySQL Reference Manual for further details.

See Also:

• Running the XML Transformation Utility for MySQL Audit Formats

• MySQL Audit Trail Cleanup

PostgreSQL Plug-in for Oracle Database Security Central

Learn about using the PostgreSQL plug-in for Oracle Database Security Central. Table C-6 specifies the values or details required for the configuration.

Prerequisite: Ensure to enable pgaudit extension. The audit collection is incomplete and operational details are missed out from the reports in case this extension is not enabled.

Table 6 PostgreSQL

Specification	Description
Plug-in directory	AGENT_HOME/av/plugins/com.oracle.av.plugin.postgresql
Target Versions	Open source versions: 9.6 to 11.8 12 and 13 14 and 15
Target Platforms	Linux/x86-64
Setup Scripts	None
Target Location (Connect String)	None
Collection Attributes (Required)	av.collector.securedTargetVersion Specifies the target version. Default is 11.0.
Collection Attributes (Optional)	AV.COLLECTOR.DATABASECHARSET The NLS character set of the audit trail file. The PostgreSQL DIRECTORY audit trails use Java character set to open audit files based on the database character sets. This ensures the audit files are processed using the right character sets and avoid data loss.
Audit Trail Types	DIRECTORY
Audit Trail Location	The path to the directory containing CSV audit files.
Audit Trail Cleanup Support	No

IBM DB2 Plug-in for Oracle Database Security Central

Learn about how to use the IBM DB2 plug-in for Oracle Database Security Central. Table C-7 lists the features of the IBM DB2 plug-in.

Table 7 IBM DB2 Plug-in

Plug-in Specification	Description
Plug-in directory	AGENT_HOME/av/plugins/com.oracle.av.plugin.db2
Target Versions	10.5, 11.1, 11.5
Target Platforms	Linux (x86-64): OL 5.x, 6.x, 7.x and RHEL 6.x, 7.x Microsoft Windows (x86-64): 8 Microsoft Windows Server (x86-64): 2012, 2012R2, 2016 IBM AIX on Power Systems (64-bit): 7.1
Setup Script(s)	Yes. See “IBM DB2 for LUW Setup Scripts” for instructions.
Collection Attribute(s)	av.collector.databasename (case sensitive) - (Required) Specifies the IBM DB2 for LUW database name.
Oracle Database Security Central Audit Trail Types	DIRECTORY NETWORK See Table C-19 for descriptions of audit trail types.
Audit Trail Location	Path to a directory, for example: d:\temp\trace
Audit Trail Cleanup Support	Yes
Cluster Support	Yes HADR (High Availability and Disaster Recovery)
Target Platform for Cluster	HADR on OL 7.x
DB2 Multiple Instances Support	Yes

Multiple Instances Environment

In case of multiple instances environment, create an Audit Vault Agent user and then the Agent group. Install the Agent as the newly created Agent user belonging to the Agent group. Add all the users of the instance to the Agent group and then add the Agent user to the instance group.

Perform the following steps from every instance to extract the audit files:

1. Navigate to the extraction utility location using $AGENT_HOME/av/plugins/com.oracle.av.plugin.db2/bin.

2. Set the environment variables agent_home, db2audit_command, and lslk_cmd.

3. Run the extraction utility using ./DB295ExtractionUtil -archivepath <archive path> -extractionpath <extraction path> -audittrailcleanup <yes/no>.

4. The extracted files are generated in the directory at the instance level.

5. Start the audit trail for every instance as the extraction path is different for each instance.

Quick JSON Target Type for Oracle Database Security Central

Learn how to configure and use the Quick JSON target type for Oracle Database Security Central.

Quick JSON target type can be used to collect audit data from targets that store audit records in JSON format, by mapping few collection attributes. Table C-9 specifies the values or details required for the configuration.

Table 9 Quick JSON

Specification	Description
Plug-in directory	AGENT_HOME/av/plugins/com.oracle.av.plugin.quickjson
Target Platforms	Linux/x86-64 Windows /x86-64
Setup Scripts	None
Target Location (Connect String)	None
Collection Attributes (Required)	av.collector.securedTargetVersion Specifies the target version.
Collection Attributes (Optional)	AV.COLLECTOR.DATABASECHARSET The NLS character set of the audit trail file. The Quick JSON DIRECTORY audit trails use Java character set to open audit files based on the database character sets. This ensures the audit files are processed using the right character sets and avoid data loss.
Audit Trail Types	DIRECTORY
Audit Trail Location	The path to the directory containing JSON audit files.
Audit Trail Cleanup Support	No

QuickJSON collector relies on collection attributes to map JSON audit data to Oracle Oracle Database Security Central audit record fields. These collection attributes point to data within JSON audit file using JSON Path expressions. Following table lists the QuickJSON collection attributes.

Table 10 Quick JSON Collection Attributes

Quick JSON Collection Attribute Name	Description	Attribute Value Type
av.collector.qck.starttag	Should be set to the first key of JSON audit record. This is not JSON Path expression. It is the name of the required key.	Static String
av.collector.qck.eventtime	Time when the event occurred.	JSON Path Expression
av.collector.qck.username	The user of the target who executed the event.	JSON Path Expression
av.collector.qck.os.username	Operating system login name of the target user who executed the event.	JSON Path Expression
av.collector.qck.eventname	Name of the event as recognized by the target.	JSON Path Expression
av.collector.qck.commandclass	Class of command issued by the target user who executed the event.	JSON Path Expression
av.collector.qck.client.ip	IP address of the client host.	JSON Path Expression
av.collector.qck.targetobject	Object affected by the event.	JSON Path Expression
av.collector.qck.targettype	Type of the target object. For example: Package, Type, or Table.	JSON Path Expression
av.collector.qck.eventstatus	Completion status of the event.	JSON Path Expression
av.collector.qck.errorid	Error number in case of event failure.	JSON Path Expression
av.collector.qck.errormessage	Error message in case of event failure.	JSON Path Expression
av.collector.qck.target.entity	Name of target entity.	JSON Path Expression
av.collector.qck.target.user	Name of target user.	JSON Path Expression
av.collector.qck.target.role	Name of target role.	JSON Path Expression

Note: The attributes av.collector.qck.target.entity, av.collector.qck.target.user, and av.collector.qck.target.role are only applicable if Quick JSON target is used to collect audit data from Mongo DB.

See Also:

• Configuring Quick JSON Target Type to Collect Audit Data from MongoDB

• Audit Record Fields for more information on other collection attributes and corresponding audit record field definitions.

QuickCSV Collector for Oracle Database Security Central

Learn how to configure and use the QuickCSV target type for Oracle Database Security Central.

A QuickCSV target type can be used to collect audit data from most targets that store audit records in CSV format through a one-to-one mapping of collection attributes to fields in the log file. If a database stores some data across multiple fields, it cannot be captured in a single field.

The Specifications for QuickCSV Collector table below specifies the values or details required for the configuration.

Table 11 Specifications for QuickCSV Collector

Specification	Description
Plug-in directory	/av/plugins/com.oracle.av.plugin.quickcsv
Target platforms	All supported OS
Setup scripts	None
Target Location (Connect String)	None
Collection attributes	(See table below)
Audit trail types	Directory
Audit trail location	Path to directory containing the .csv files
Audit trail cleanup support	No

The below table describes the attributes which are mapped to fields within the .csv audit file. Against the attribute, the value to be entered is the field number. The field numbers can be entered as 1, 2, 3, etc. or as $1, $2, $3, etc.

Table 12 Attributes for QuickCSV Collector

Attribute	Description
av.collector.map.client.hostname	Target hostname
av.collector.map.client.id	Target ID
av.collector.map.client.ip	Target IP address
av.collector.map.client.program.name	Program running on target which executed the event
av.collector.map.command.class	Class of command issued by the target user who executed the event
av.collector.map.command.param	Parameters given to command while executing the event
av.collector.map.command.text	Command statement for the event
av.collector.map.database.name	Name of the target database
av.collector.map.error.id	Error number in case of event failure
av.collector.map.error.message	Error message in case of event failure
av.collector.map.event.name (Required)	Name of the event as recognized by the target
av.collector.map.event.status	Completion status of the event
av.collector.map.event.time (Required)	Time when the event occurred
av.collector.map.instance.name	Name of database instance
av.collector.map.os.username	Operating system login name of the target user who executed the event
av.collector.map.repository.name	Name of the database repository
av.collector.map.target.object	Object affected by the event
av.collector.map.target.owner	Name of the user who owns the target
av.collector.map.target.type	Type of target object
av.collector.map.username	The user of the target who executed the event

Other than the predefined attributes mentioned above, you can also add more attributes to specify fields to be collected from. These attributes must begin with the prefix av.collector.map.extension. The data collected from the field specified against the user-defined attribute will be added to the extension field along with the name given to the attribute.

The below table describes the attributes that specify the format of the .csv file.

Table 13 Format Attributes for QuickCSV Collector

Format Attribute	Description	Default value
av.collector.format.delimiter	Specifies the delimiter string used in the .csv file. For example, comma (,) semicolon (;) etc.	, (comma)
av.collector.format.escape	Specifies the escape character within a quoted field	NA
av.collector.format.quote	Specifies the character used to put a field between quotes	” (double-quote)
av.collector.pattern.timestamp	Specifies the timestamp format string	yyyy-MM-dd HH:mm:ss.SSS z
av.collector.timezoneoffset	Specifies the timezone offset for the timestamp	NA

Oracle Solaris Plug-in for Oracle Database Security Central

Learn to use the Oracle Solaris plug-in for Oracle Database Security Central. Table C-14 lists the features of the Oracle Solaris plug-in.

Table 14 Oracle Solaris Plug-in

Plug-in Specification	Description
Plug-in directory	AGENT_HOME/av/plugins/com.oracle.av.plugin.solaris
Target Versions	Versions 11.3 and 11.4 on SPARC64 and x86-64 platforms
Target Platforms	Solaris/SPARC64
Setup Script(s)	No
Target Location (Connect String)	hostname (fully qualified machine name or IP address)
Collection Attribute(s)	None
Oracle Database Security Central Audit Trail Types	DIRECTORY See Table C-19 for descriptions of audit trail types.
Audit Trail Location	hostname:path_to_trail The hostname matches the hostname in the audit log names, which look like this: timestamp1.timestamp2.hostname
Audit Trail Cleanup Support	No

Related Topics

• Behavior Changes, Deprecated, and Desupported Platforms and Features

Linux Plug-in for Oracle Database Security Central

Learn how to benefit from using the Linux plug-in for Oracle Database Security Central. Table C-15 lists the features of the Linux plug-in that collects audit data from Oracle Linux (OL) and Red Hat Enterprise Linux (RHEL).

Table 15 Linux Plug-in

Plug-in Specification	Description
Plug-in directory	AGENT_HOME/av/plugins/com.oracle.av.plugin.linux
Target Versions	Oracle Linux (OL): OL 6.0 (with auditd package 2.0) OL 6.1 - 6.5 (with auditd package 2.2.2) OL 6.6 - 6.7 (with auditd package 2.3.7) OL 6.8 - 6.9 (with auditd package 2.4.5) OL 7.0 (with auditd package 2.3.3) OL 7.1 - 7.2 (with auditd package 2.4.1) OL 7.3 (with auditd package 2.6.5) OL 7.4 - 7.5 (with auditd package 2.7.6) OL 7.6 (with auditd 2.8) (Oracle AVDF 20.2 and later) OL 7.7 (with auditd 2.8.5) (Oracle AVDF 20.2 and later) OL 7.8 (with auditd 2.8) (Oracle AVDF 20.2 and later) OL 7.9 (with auditd 2.8) (Oracle AVDF 20.4 and later) OL 8 (with auditd 3.0) (Oracle AVDF 20.3 and later) OL 8.2 and 8.3 (with auditd 3.0) (Oracle AVDF 20.4 and later) OL 9 (Oracle AVDF 20.9 and later) Red Hat Enterprise Linux (RHEL): Red Hat Enterprise Linux (RHEL) 6 was desupported in Oracle AVDF 20.15. Red Hat Enterprise Linux (RHEL) 6 was deprecated in Oracle AVDF 20.10, and it will be desupported in one of the future releases. RHEL 6.7 (with auditd 2.3.7) RHEL 6.8 (with auditd 2.4.5) RHEL 6.9 (with auditd 2.4.5) RHEL 6.10 (with auditd 2.4.5) RHEL 7.0 (with auditd 2.3.3) RHEL 7.1 (with auditd 2.4.1) RHEL 7.2 (with auditd 2.4.1) RHEL 7.3 (with auditd 2.6.5) RHEL 7.4 (with auditd 2.7.6) RHEL 7.5 (with auditd 2.7.6) RHEL 7.6 (with auditd 2.8) (Oracle AVDF 20.2 and later) RHEL 7.7 (with auditd 2.8.5) (Oracle AVDF 20.2 and later) RHEL 7.8 (with auditd 2.8) (Oracle AVDF 20.2 and later) RHEL 7.9 (with auditd 2.8) (Oracle AVDF 20.4 and later) RHEL 8 (with auditd 3.0) (Oracle AVDF 20.3 and later) RHEL 8.2 and 8.3 (with auditd 3.0) (Oracle AVDF 20.4 and later) RHEL 9 (Oracle AVDF 20.9 and later) Run rpm -q audit to get the audit package version.
Target Platforms	Linux/x86-64
Setup Script(s)	No. However, the following user/group access rights are needed to start a Linux audit trail: If the agent process is started with root user, no changes to access rights are needed. If the agent process is started with a user other than root: Assign the group name of the Agent user (the one who will start the Agent process) to the log_group parameter in the /etc/audit/auditd.conf file. The Agent user and group must have read and execute permissions on the folder that contains the audit.log file (default folder is /var/log/audit). Restart the Linux audit service after you make the above changes.
Target Location (Connect String)	hostname (fully qualified machine name or IP address)
Collection Attribute(s)	None
DBSecCentral Audit Trail Types	DIRECTORY See Table C-19 for descriptions of audit trail types.
Audit Trail Location	Default location of audit.log (/var/log/audit/audit*.log) or any custom location configured in the /etc/audit/auditd.conf file
Audit Trail Cleanup Support	No

Related Topics

• Behavior Changes, Deprecated, and Desupported Platforms and Features

IBM AIX Plug-in for Oracle Database Security Central

Learn about the IBM AIX plug-in for Oracle Database Security Central. Table C-16 lists the features of the IBM AIX plug-in.

Table 16 IBM AIX Plug-in

Plug-in Specification	Description
Plug-in directory	AGENT_HOME/av/plugins/com.oracle.av.plugin.aixos
Target Versions	AIX versions: 7.3 (TL2) 7.3 (TL0) 7.2 (TL2 and above) 7.1 (TL5)
Supported JRE Version	1.8.0_241 (minimum) Note: JRE version 11 is not supported on AIX platform.
Target Platforms	Power Systems (64-bit)
Setup Script(s)	No. However, the following user and group access rights are needed to start an AIX audit trail: If the Agent process is started by the root user, then no changes to access rights are needed. If the Agent process is started with a user other than root, then run the following commands in the AIX system as root to authorize another user: Create a new role and grant it the aix.security.audit authorization: mkrole authorizations= (aix.security.audit) (role_name) Alter the Agent user to assign the newly created role: chuser roles=role_name agent_user_name Update the kernel table with the newly created role by running the command: setkst Add the Agent user to the same group as that of the AIX audit files. Ensure you have set read permission on the /audit directory where the audit trail files are located. To start the Agent with the Agent user, log in to the AIX terminal with agent_user_name and switch to the role created in this procedure: swrole role_name
Target Location (Connect String)	hostname (fully qualified machine name or IP address)
Collection Attribute(s)	None
DBSecCentral Audit Trail Types	DIRECTORY See Table C-19 for descriptions of audit trail types.
Audit Trail Location	Default location of trail (/audit/trail) or any custom location configured in the /etc/security/audit/config file
Audit Trail Cleanup Support	Yes. The AIX plug-in will create a .atc file at: AGENT_HOME/av/atc/SecuredTargetName_TrailId.atc The .atc file contains the following information: trail_location end_time_of_audit_event_collection

Microsoft Windows Plug-in for Oracle Database Security Central

Learn about the Microsoft Windows plug-in for Oracle Database Security Central. Table C-17 lists the features of the Microsoft Windows plug-in.

Table 17 Microsoft Windows Plug-in

Plug-in Specification	Description
Plug-in directory	AGENT_HOME\av\plugins\com.oracle.av.plugin.winos
Target Versions	Microsoft Windows Server 2012, 2012 R2, 2016 2019
Target Platforms	Windows/x86-64
Setup Script(s)	No
Target Location (Connect String)	hostname (fully qualified machine name or IP address)
Collection Attribute(s)	None
AVDF Audit Trail Types	EVENT LOG See Table C-19 for descriptions of audit trail types.
Audit Trail Location	security (case-sensitive)
Audit Trail Cleanup Support	No

Microsoft Active Directory Plug-in for Oracle Database Security Central

Learn about how to use the Microsoft Active Directory plug-in for Oracle Database Security Central. Table C-18 lists the features of the Microsoft Active Directory plug-in.

Table 18 Microsoft Active Directory Plug-in

Plug-in Specification	Description
Plug-in directory	AGENT_HOME\av\plugins\com.oracle.av.plugin.msad
Target Versions	2012 to 2016 on 64 bit
Target Platforms	Windows/x86-64
Setup Script(s)	No
Target Location (Connect String)	hostname (fully qualified machine name or IP address)
Collection Attribute(s)	None
AVDF Audit Trail Types	EVENT LOG See Table C-19 for descriptions of audit trail types.
Audit Trail Location	directory service or security (case-sensitive)
Audit Trail Cleanup Support	No

Summary of Data Collected for Each Audit Trail Type

Explore the types of data that Oracle Database Security Central (Oracle DBSecCentral) collects for each audit trail type.

When you configure an audit trail for a target, you select the type of audit trail in the Audit Trail Type field. The audit trail type depends on your target type. Table C-19 describes the types of audit trails that you can configure for each target type.

Refer to the product documentation for your target type for details on its auditing features and functionality. See the following documentation for Oracle products:

• Oracle Database 12c Release 1 (12.1): Oracle Database Security Guide

• Oracle Solaris 11.1

• Oracle Solaris 10.6

Table 19 Summary of Audit Trail Types Supported for Each Target Type

Target Type	Trail Type	Description
Oracle Database<p>Oracle AVDF’s support of Oracle Database 11g is deprecated in AVDF 20.14, and will be desupported in a future release.</p>	TABLE Releases supported: 11.2.0.4; 12.1; 12.2; 18c; 19c, 21,23	Collects from the following audit trails: Oracle Database audit trail, where standard audit events are written to the SYS.AUD$ dictionary table Oracle Database fine-grained audit trail, where audit events are written to the SYS.FGA_LOG$ dictionary table Oracle Database Vault audit trail, where audit events are written to the DVSYS.AUDIT_TRAIL$ dictionary table Oracle database 12.x unified audit trail, where audit events are written to the UNIFIED_AUDIT_TRAIL data dictionary view Note: The SYS.AUD$ and SYS.FGA_LOG$ tables have an additional column, RLS$INFO. The unified audit trail table has a RLS_INFO column. This column describes row-level security policies that are configured. This is mapped to the extension field in Oracle DBSecCentral. To populate this column, set the AUDIT_TRAIL parameter of the target to DB EXTENDED.
Oracle Database	DIRECTORY Releases 11.2.0.4, 12c, 18c; 19c.	Collects data from the following audit trails: On Linux and UNIX platforms: Oracle database audit files that are written to the operating system (AUD and XML) files On Windows platforms: Operating system XML files Note: Oracle recommends that you use unified audit table trails because directory trails are deprecated.
Oracle Database	TRANSACTION LOG 11.2.0.4 onwards for TRANSACTION LOG collection	Collects audit data from GoldenGate Integrated Extract files. If you plan to use this audit trail type, you can define the GoldenGate Integrated Extract rules to audit the tables from which GoldenGate Integrated Extract will capture audit information. The GoldenGate Integrated Extract files, in turn, are read by transaction log audit trail. For versions before 12.2, Oracle GoldenGate Downstream Mining must be configured. See Oracle Database Security Central Auditor's Guide for more information.
Oracle Database	SYSLOG	Collects Oracle audit records from either syslog or rsyslog audit files on Linux and Unix platforms only. If the system has both syslog and rsyslog installed, the exact rsyslog audit file location must be specified to collect data from rsyslog files. The following rsyslog formats are supported: RSYSLOG_TraditionalFileFormat (has low-precision time stamps) RSYSLOG_FileFormat (has high-precision time stamps and time zone information) Events from both formats appear the same on reports. However, with RSYSLOG_FileFormat, the AVSYS.EVENT_LOG table shows EVENT_TIME with microsecond precision. See Oracle Database Security Central Auditor's Guide for details on this table and Audit Vault Server schema documentation.
Oracle Database	EVENT LOG	Collects Oracle audit records from Microsoft Windows event logs on Windows platforms only.
Oracle Database	NETWORK	Collects network traffic (all database operations that use a TCP connection). Used for the Host Monitor Agent.
Microsoft SQL Server	DIRECTORY	Collects audit data from the following: sqlaudit trace extended events C2_DYNAMIC TRACE_DYNAMIC
Microsoft SQL Server	TRANSACTION LOG	Collects audit data from Oracle GoldenGate CDC Extract files. If you plan to use this audit trail type, you can define the GoldenGate CDC Extract rules to audit the tables from which GoldenGate CDC Extract will capture audit information. The GoldenGate CDC Extract files, in turn, are read by transaction log audit trail.
Microsoft SQL Server	EVENT LOG	Collects audit data from Windows application and security event logs.
Microsoft SQL Server	NETWORK	Collects network traffic (all database operations that use a TCP connection). Used for the Host Monitor Agent.
IBM DB2 for LUW	DIRECTORY	Collects audit data from ASCII text files extracted from the binary audit log (db2audit.log). These files are located in the security subdirectory of the DB2 database instance.
IBM DB2 for LUW	NETWORK	Collects network traffic (all database operations using a TCP connection). Used for Host Monitor Agent.
MySQL	DIRECTORY	Collects XML-based audit data from a specified location
MySQL	NETWORK	Collects network traffic (all database operations using a TCP connection). Used for Host Monitor Agent.
Oracle Solaris	DIRECTORY	Collects Solaris Audit records (version 2) generated by the audit_binfile plug-in of Solaris Audit
Linux	DIRECTORY	Collects audit data from audit.log
Windows OS	EVENT LOG	Collects audit data from Windows Security Event Log
Microsoft Active Directory	EVENT LOG	Collects audit data from Windows Directory Service, and Security Event Logs
Oracle Linux	DIRECTORY	Collects audit data from audit.log
IBM AIX	DIRECTORY	Collects audit data from the binary audit log (/audit/trail). Only BIN auditing mode is supported. Any custom location of the audit log is configured in the /etc/security/audit/config file.

Related Topics

• Behavior Changes, Deprecated, and Desupported Platforms and Features