Stopping, Starting, and Other Agent Operations

Learn about starting and stopping the agent and other operations.

Stopping and Starting Audit Vault Agent

Learn about stopping and starting Audit Vault Agent.

Important: Stop and start the Audit Vault Agent as the same OS user account that you used during installation.

See Also: Audit Vault Agent Auto Start Configuration

Stopping and Starting the Agent on Unix Hosts

Learn about stopping and starting the Agent on Unix hosts.

To start the Audit Vault Agent after initial activation, run the following command from the Agent_Home/bin directory on the host machine:

agentctl start

To stop the Audit Vault Agent run the following command from the Agent_Home/bin directory on the host machine:

agentctl stop

Note:

• After the agentctl stop command, run the agentctl status command to ensure the Agent is in STOPPED state before executing the agentctl start command again.

• In case the Agent auto start service is configured and if the Agent alone is manually stopped, then the Agent is automatically started again. See Configuring Agent Auto Restart Functionality for complete information and run the right commands.

Stopping and Starting the Agent on Windows Hosts

Learn about stopping and starting the Agent on Microsoft Windows hosts.

The Audit Vault Agent is automatically registered as a Windows service when you deploy the agent on a Windows host. We recommend that you run the agent as a Windows service so that it can keep running after the user logs out.

See Also: Registering and Unregistering the Audit Vault Agent as a Windows Service

To stop or start the Agent Windows service

Use one of the methods below:

• In the Windows GUI (Control Panel > Administrative Tools > Services), find the Audit Vault Agent service, and then right-select it to select Start or Stop.

• Run one of these commands from the Agent_Home\bin directory on the host machine:

  agentctl stopsvc

  agentctl startsvc

To check that the Windows service is stopped

Run this command:

cmd> sc queryex OracleAVAgent

You should see the Agent Windows service in a STOPPED state.

To stop or start the Agent in console mode

start /b agentctl stop

start /b agentctl start

To forcibly stop the Agent in console mode

agentctl stop -force

Note:

This is not a recommended option to stop the Agent. Use it only in case the Agent goes into an unreachable state for a long time and cannot be restarted or stopped. In such a scenario, use this option to forcibly stop and later restart the Agent.

To restart the Agent use the agentctl start command.

Autostarting the Agent on Windows Hosts

Learn about autostarting the agent on Microsoft Windows hosts.

You can configure the agent service to start automatically on a Windows host.

1. Open the Services Management Console.

   From the Start menu, select Run, and in the Run dialog box, enter services.msc to start the Services Management Console.

2. Right-select Oracle Audit Vault Agent and from the menu, select Properties.

3. In the Properties dialog box, set the Startup type setting to Automatic.

4. Select OK.

5. Close the Services Management Console.

Changing the Logging Level for the Audit Vault Agent

Learn how to change the logging level for Oracle Audit Vault Agent.

The logging level that you set affects the amount of information that Oracle writes to the log files. You may need to take this into account due to disc space limitations.

Log files are located in the Agent_Home/av/log directory.

The following logging levels are listed in the order of the amount of information written to log files, where debug provides the most information:

• error - Writes only error messages

• warning - (Default) Writes warning and error messages

• info - Writes informational, warning, and error messages

• debug - Writes detailed messages for debugging purposes

Using the Oracle Database Security Central console to Change Logging Levels

To change the logging level for the Audit Vault Agent using the Audit Vault Server UI, see “Clearing Diagnostic Logs”.

Using AVCLI to Change the Agent Logging Level

To change the logging level for the Audit Vault Agent using the AVCLI utility:

1. Ensure that you are logged into AVCLI on the Audit Vault Server.

2. Run the ALTER HOST command.

   The syntax is as follows:

   ALTER HOST host_name SET LOGLEVEL=av.agent:log_level

   In this specification:

   • host_name: The name of the host where the Audit Vault Agent is deployed.

   • log_level: Enter a value of info, warn, debug, or error.

Viewing the Status and Details of Audit Vault Agent

Learn about viewing the status and details of Audit Vault Agent.

You can view an Audit Vault Agent’s status and details such as activation key, platform, version, location, and other details.

Prerequisite

Log in to the Oracle Database Security Central console as an administrator. See Using Oracle Database Security Central Console for more information.

To view the status and details of an Audit Vault Agent:

1. Select Agents.

2. In the left navigation menu, select Agents.

   A list of registered Agents is displayed on the page.

3. In this list of registered Agents, check the Agent Status, Host Monitor Status, Activation Key, Agent Details, and Host Monitor Details columns for the Agent that you are interested in.

4. To see the audit trails for a specific Agent host, select View Audit Trails in the Agent Details column.

Deactivating and Removing Audit Vault Agent

Learn about deactivating and removing Audit Vault Agent.

Use this procedure to deactivate and remove Audit Vault Agent.

See Also: If you have registered the Audit Vault Agent as a Windows service, see Registering and Unregistering the Audit Vault Agent as a Windows Service to unregister the service.

1. Stop all audit trails being collected by the Audit Vault Agent.

   1. In the Oracle Database Security Central console, select Targets.

   2. Select Audit Trails in the left navigation menu.

   3. Select the check boxes for each audit trail that you want to stop, and then select Stop.

2. Stop the Audit Vault Agent by running the following command on the host computer:

   agentctl stop

3. Deactivate the Audit Vault Agent on the host computer:

   1. In the Oracle Database Security Central console, select Agents, and then in the left navigation menu, select Agents.

   2. Select the checkbox for each host name that you want to deactivate, and then select Deactivate.

   3. Optionally, drop the host by selecting the checkbox for it, and then clicking Delete.

   4. Delete the Audit Vault Agent home directory on the host computer.

Note: The Audit Vault Agent deployed on a host is associated with the specific Audit Vault Server from where it was downloaded. This Audit Vault Agent collects audit data from the configured targets. It sends this data to the specific Audit Vault Server. To configure the audit trail collection from the existing targets to a different Audit Vault Server, you should deactivate, remove the existing Agent, download the Audit Vault Agent installation file from the new Audit Vault Server, and install it on the target host. This scenario is different from updating the existing Auditing Vault Agent.