Preparing Targets for Audit Data Collection

Learn about preparing targets for audit data collection.

Using an NTP Service to Set Time on Targets

Learn how to use NTP Service to configure time settings on targets.

Oracle recommends that you use an It is recommended that you also use a Network Time Protocol (NTP) service on both your targets and the Audit Vault server. This will help to avoid confusion on timestamps on the alerts raised by the Audit Vault Server.

See Also: Specifying the Server Date, Time, and Keyboard Settings for instructions on using an NTP server to set time for the Audit Vault Server.

Ensuring that Auditing is Enabled on the Target

Learn how to enable auditing.

To collect audit data from a target, you must ensure that auditing is enabled on that target and, where applicable, note the type of auditing that the target is using. Check the product documentation for your target type for details.

To check if auditing is enabled on an Oracle Database target:

Log in to the Oracle Database as a user with administrative privileges. For example:
```
sqlplus trbokuksa
Enter password: <password>
Connected.
```

Run the following command:

SHOW PARAMETER AUDIT_TRAIL

Returns:

NAME                                 TYPE        VALUE

------------------------------------ ----------- -------
audit_trail                          string      DB

If the output of the SHOW PARAMETER command is NONE or if it is an auditing value that you want to change, then you can change the setting as follows.

For example, if you want to change to XML, and if you are using a server parameter file, enter the following:
```
CONNECT SYS/AS SYSDBA
Enter password: <password>

ALTER SYSTEM SET AUDIT_TRAIL=XML SCOPE=SPFILE;
System altered.

SHUTDOWN
Database closed.
Database dismounted.
ORACLE instance shut down.

STARTUP
ORACLE instance started.
```
Make a note of the audit trail setting.

You will need this information when you configure the audit trail in Oracle Database Security Central.

Setting User Account Privileges on Targets

Some target types require credentials for Oracle Database Security Central (Oracle DBSecCentral) to access them.

If you plan to collect audit data from a target, perform stored procedure auditing (SPA) or entitlements auditing, or monitor native network encrypted traffic for Oracle Database, then you must create a user account on the target with the appropriate privileges to enable Oracle DBSecCentral to access the required data.

For database targets, Oracle DBSecCentral provides scripts to configure user account privileges for database target types. For Oracle Database targets, you can download the setup scripts from the Oracle Database Security Central console by clicking the Target Setup Script on the Targets.

For non-database targets, create a user that has the appropriate privileges to access the audit trail. For example, for a Windows target, this user must have administrative permissions to read the security log.

Note: Oracle DBSecCentral does not accept user names with quotation marks. For example, “J’Smith” is not a valid user name for an Oracle DBSecCentral user account on targets.

See Scripts for Oracle DBSecCentral Account Privileges on Targets for information on the scripts to configure user account privileges for database target types.

Scheduling Audit Trail Cleanup

Learn about scheduling audit trail cleanup.

Oracle DBSecCentral supports audit trail cleanup for Oracle Database, Microsoft SQL Server, IBM DB2, and MySQL.

See Also: Audit Trail Cleanup