Procedure Look-Ups: Connect Strings, Collection Attributes, Audit Trail Locations

Procedure lookups enable you to fine tune and customize audit records generation.

Target Locations (Connect Strings)

Use connect strings to register target locations in the Oracle Database Security Central console.

When registering a target in the Oracle Database Security Central console, you enter a connect string in the Target Location field. Use a connect string format from Table C-20 depending on the target type.

Note: The connection string is mandatory for audit collection. However, it’s not required for Database Firewall monitoring.

Table 20 Target Connect Strings (for Target Location Field)

Target Type	Connect String
Oracle Database	`jdbc:oracle:thin:@//`hostname:port`/`service
Microsoft SQL Server (SQL Server Authentication)	`jdbc:av:sqlserver://hostname:port` When SSL Encryption is used with MSSQL sever and the server certificate validation is required. Ensure that agent TLS level is set to Level 4. `jdbc:av:sqlserver://:;encryptionMethod=SSL;validateServerCertificate=true;CryptoProtocolVersion=TLSv1.2;trustStore=;trustStorePassword=;extendedOptions=enableCipherSuites=SSL_RSA_WITH_RC4_128_MD5,SSL_RSA_WITH_RC4_128_SHA` When SSL Encryption is used with MSSQL sever and the server certificate validation is not required. `jdbc:av:sqlserver://:;encryptionMethod=SSL;validateServerCertificate=false;CryptoProtocolVersion=TLSv1.2;`
Microsoft SQL Server (Windows Authentication)	`jdbc:av:sqlserver://:;authenticationMethod=ntlmjava` `(Use Windows user credentials along with domain. For example, \ and password.)` OR `jdbc:av:sqlserver://:;authenticationMethod=ntlmjava;domain=` `Use Windows user credentials without domain. For example, and password.`
Oracle Solaris	hostname (fully qualified machine name or IP address)
Oracle Linux	hostname (fully qualified machine name or IP address)
Microsoft Windows	hostname (fully qualified machine name or IP address)
Microsoft Active Directory Server	hostname (fully qualified machine name or IP address)
IBM AIX	hostname (fully qualified machine name or IP address)

Related Topics

Audit Collection Attributes

Oracle Database Security Central (Oracle DBSecCentral) provides audit collection attributes that are specific to the target platform, such as Oracle Database or MySQL.

About Audit Collection Attributes

Specify audit collection attributes when configuring targets.

Some types of targets have optional or required audit trail collection attributes. You can specify audit collection attributes when registering or modifying targets in the Audit Collection Attributes fields.

The following target types do not require audit collection attributes:

Microsoft SQL Server
Oracle Solaris
Windows
Linux
Microsoft Active Directory Server

Oracle Database Audit Collection Attributes

Specify audit collection attributes to control the types of data that Audit Vault collects.

You can specify audit collection attributes for a DIRECTORY audit trail for Oracle Database. Table C-21 describes the audit collection attributes you can use if you select DIRECTORY as the Audit Trail Type when registering an Oracle Database target in Oracle Database Security Central.

Table 21 Audit Collection Attributes for DIRECTORY

Attribute Name and Description	Required?	Default	Comments
`ORCLCOLL.NLS_LANGUAGE` The NLS language of the data source	Yes: If the started audit trail cannot establish a connection to the Oracle target (for example, target is not running) No: If the started audit trail is able to connect to the Oracle target and get these parameter values from the target (for example, the target is running when the trail is started)	NA	The value is not case sensitive.
`ORCLCOLL.NLS_TERRITORY` The NLS territory of the data source	Yes: If the started audit trail cannot establish a connection to the Oracle target (for example, target is not running) No: If the started audit trail is able to connect to the Oracle target and get these parameter values from the target (for example, the target is running when the trail is started)	NA	The value is not case sensitive.
`ORCLCOLL.NLS_CHARSET` The NLS character set of the data source	Yes: If the started audit trail cannot establish a connection to the Oracle target (for example, target is not running) No: If the started audit trail is able to connect to the Oracle target and get these parameter values from the target (for example, the target is running when the trail is started)	NA	The value is not case sensitive.
`ORCLCOLL.RAC_INSTANCE_ID` The instance ID in an Oracle RAC environment	No	1	None.
`AV.COLLECTOR.DATABASECHARSET` The NLS character set of the data source.	Yes: If the audit trail started cannot establish a connection to the target Oracle Database. For example, the target is not running. No: If the audit trail started is able to connect to the target Oracle Database and get these parameter values from the target. For example, the target is running when the trail is started.	NA	None.
`ORCLCOLL.HEARTBEAT_INTERVAL` The interval, in seconds, to store the metric information	No	60	Cannot be reconfigured at run time. This interval determines how frequently metric information is updated. If the value is too low it creates overhead for sending metrics to the Audit Vault Server. If the value is too high it will skew the average metric information.
`ORCLCOLL.NT_ORACLE_SID` The Oracle SID name on a Microsoft Windows systems	No	No default	The value is not case sensitive. If no value is specified then the audit trail queries the value from the target.
`AV.COLLECTOR.TIMEZONEOFFSET` Timezone offset of Oracle Database target	Optional. Note: This attribute is not required from Oracle DBSecCentral latest releases, as the Transaction Log audit trail fetches the time zone offset from the target database.	NA	None.

IBM DB2 for LUW Audit Collection Attribute

Learn about the IBM DB2 for LUW audit collection attribute. Table C-22 describes the audit collection attribute required when you register an IBM DB2 for LUW target in Oracle Oracle Database Security Central.

Table 22 Audit Collection Attribute for IBM DB2 for LUW

Attribute Name and Description Required? Default Comments

Attribute Name and Description	Required?	Default	Comments
`av.collector.databasename` The IBM DB2 for LUW database name	Yes	NA	This parameter is case sensitive. Note: The audit collection attribute is not required from release 12.2.0.11.0 and onwards.

av.collector.databasename

The IBM DB2 for LUW database name

Yes

This parameter is case sensitive.

Note: The audit collection attribute is not required from release 12.2.0.11.0 and onwards.

MySQL Audit Collection Attributes

Learn about the MySQL audit collection attributes. Table C-23 describes the required and optional audit collection attributes when you register a MySQL target in Oracle Database Security Central.

Table 23 Audit Collection Attributes for MySQL

Attribute Name and Description Required? Default Comments

Attribute Name and Description	Required?	Default	Comments
`av.collector.securedTargetVersion` The MySQL database version	Yes	8.0	NA
`av.collector.AtcTimeInterval` Specifies a time interval, in minutes, at which the audit trail cleanup time is updated	No	20	Example: If this value is 20, the audit trail cleanup time is updated every 20 minutes in the ATC file. Audit log files that have a time stamp older than the audit trail cleanup time will be cleaned from the source folder when you run the audit trail cleanup utility.

av.collector.securedTargetVersion

The MySQL database version

Yes

8.0

av.collector.AtcTimeInterval

Specifies a time interval, in minutes, at which the audit trail cleanup time is updated

Example: If this value is 20, the audit trail cleanup time is updated every 20 minutes in the ATC file. Audit log files that have a time stamp older than the audit trail cleanup time will be cleaned from the source folder when you run the audit trail cleanup utility.

See Also: MySQL Audit Trail Cleanup

Audit Trail Locations

When you configure an audit trail for a target in the Audit Vault Server, you specify a trail location. The trail location depends on the type of target.

Note: Trail locations are case sensitive. To avoid duplicate data collection, Oracle recommends that you provide the entire trail location either in all capital letters or all lowercase letters.

Note: If you select DIRECTORY for the audit trail type, the trail location must be a directory mask.

Table 24 Supported Trail Locations for Targets

Target Type	Trail Type	Supported Trail Locations
Oracle Database	Table	`SYS.AUD$`, `SYS.FGA_LOG$`,`DVSYS.AUDIT_TRAIL$`,`UNIFIED_AUDIT_TRAIL`,`CDB_UNIFIED_AUDIT_TRAIL` `SYS.DBA_SQL_FIREWALL_VIOLATIONS` on Oracle AI Database 26ai
Oracle Database	Directory	Full path to the directory that contains the AUD or XML files
Oracle Database	syslog	Full path to the directory that contains the `syslog` or `rsyslog` file Include the `syslog` or `rsyslog` file prefix in the path. For example, if the file names are `messages.0`, `messages.1`, and so on, you might use the following path: `/scratch/user1/rsyslogbug/dbrecord/messages` You can also enter `Default` and the system will search for either the `syslog` or the `rsyslog` location. If both are present, entering `Default` causes the audit trail to collect data from the `syslog` files.
Oracle Database	Event log	No trail location required
Oracle Database	Transaction Log	Full path to the directory that contains the Oracle GoldenGate Integrated Extract XML trail file
Oracle Database	Network*	`NETWORK/`, `LOCAL/` and `LOCAL/Bequeath` `LOCAL/Bequeath` trail is supported only for Linux and Solaris platform.
Microsoft SQL Server	Directory	`.sqlaudit` files, or `.trc` (trace) files Examples: `directory_path\.sqlaudit` `directory_path\prefix.sqlaudit` `directory_path\prefix.trc` For `prefix`, you can use any prefix for the `.trc` or `.sqlaudit` files. `#C2_DYNAMIC` and `#TRACE_DYNAMIC` are only supported for SQL Server 2000, 2005, 2014, and 2016. Microsoft SQL Server 2012 was deprecated in Oracle AVDF 20.12, and it will be desupported in one of the future releases.
Microsoft SQL Server	Event log	`application` or `security` (SQL Server 2008, 2012, 2014, and 2016) [Microsoft SQL Server 2012](/pls/topic/lookup?ctx=en/database/oracle/database-security-central/&id=SIGAD-GUID-A8D61A19-1F65-4302-BC22-C66E297B91BE) was deprecated in Oracle AVDF 20.12, and it will be desupported in one of the future releases.
Microsoft SQL Server	Transaction Log (Oracle AVDF 20.9 and later)	Full path to the directory that contains the Oracle GoldenGate CDC Extract XML trail file
Microsoft SQL Server, MySQL and all types supported for Firewall monitoring	Network*	`NETWORK/` and `LOCAL/`
IBM DB2 for LUW	Directory	Path to a directory, for example: `d:\temp\trace`
PostgreSQL	Directory	Path to the directory that contains the CSV audit files
MySQL	Directory	Path to the directory where converted XML files are created when you run the MySQL XML transformation utility
Linux	Directory	Default location of the `audit.log` (`/var/log/audit/audit*.log`) or any custom location that is configured in the `/etc/audit/auditd.conf` file
Microsoft Windows	Event log	`security` (case-insensitive) You can use any case combination in the word `security`. However, after you start collecting a trail with a particular case combination, you must use the same combination in subsequent collections. Otherwise, a new audit trail will start collecting records from the start of the security event log.
Oracle Solaris	Directory	`hostname:path_to_trail` The `hostname` matches the host name in the audit log names, which look like this: `timestamp1.timestamp2.hostname`
AIX	Directory	`/audit/trail`
Microsoft Active Directory Server	Event log	`directory service` or `security` (case-insensitive) You can use any case combination in the words `directory service` or `security`. However, after you start collecting a trail with a particular case combination, you must use the same combination in subsequent collections. Otherwise, a new audit trail will start collecting records from the start of the security event log.

The trail location drop-down lists available network interface cards. If multiple interfaces are involved, create separate trail for each.

Related Topics