Troubleshooting Oracle Database Security Central for Auditors

Learn how to resolve issues that auditors using Oracle Database Security Central may encounter.

Is the Audit Vault 20.X EVENT_LOG column RECORD_ID Generated Sequentially or Randomly

It is not guaranteed that the RECORD_ID column will come in sequence. It is guaranteed that RECORD_ID will be unique.

There is No Option to Filter All Activity Report Using Timestamp/Time

Issue

There is no option to filter the All Activity Report using timestamp/time so that data on a specific day and time can be extracted.

Workaround

Add a row filter in the interactive report. Follow these steps:

1. Log in to Oracle Database Security Central Console as an auditor.

2. Select Reports

3. Select the All Activity report.

4. Select Filter from the Actions menu.

5. Select the Row.

6. Enter the following expression:

   to_timestamp(to_char(BZ,'MM/DD/YYYY HH:MI:SS PM'),'MM/DD/YYYY HH:MI:SS PM') >= to_timestamp('11/17/2021 12:35:55 PM','MM/DD/YYYY HH:MI:SS PM') AND to_timestamp(to_char(BZ,'MM/DD/YYYY HH:MI:SS PM') ,'MM/DD/YYYY HH:MI:SS PM') <= to_timestamp('11/17/2021 1:05:59 PM' ,'MM/DD/YYYY HH:MI:SS PM')

   Change timestamp in the filter to fit your requirements.

7. Select Apply.

How to Purge Alert Queue and Alert Store

Issue

If the alerts queue table is long then email notifications for the generated alerts do not send.

Workaround

Perform the following as the avsys user.

1. Purge the alert queue table:

   declare
   po dbms_aqadm.aq$_purge_options_t;
   begin
   po.block := TRUE;
   DBMS_AQADM.PURGE_QUEUE_TABLE(
       queue_table=>'avsys.av_alert_qt',
       purge_condition=>NULL,
       purge_options=>po);
   END;

2. Truncate the tables alert_store, ALERT_TROUBLETICKET_JOB,ALERT_EMAIL_JOB,ALERT_NOTE:

   ALTER TABLE ALERT_TROUBLETICKET_JOB DISABLE CONSTRAINT ALRT_TTKT_JOB_ALRT_STORE_FK;
   ALTER TABLE ALERT_EMAIL_JOB DISABLE CONSTRAINT ALRT_EMAIL_JOB_ALRT_STORE_FK;
   ALTER TABLE ALERT_NOTE DISABLE CONSTRAINT ALERT_NOTE_ALERT_STORE_FK;
   
   truncate table alert_store cascade;
   truncate table ALERT_TROUBLETICKET_JOB;
   truncate table ALERT_EMAIL_JOB;
   truncate table ALERT_NOTE;

3. Reenable the contraints:

   ALTER TABLE ALERT_NOTE ENABLE CONSTRAINT ALERT_NOTE_ALERT_STORE_FK;
   ALTER TABLE ALERT_TROUBLETICKET_JOB ENABLE CONSTRAINT ALRT_TTKT_JOB_ALRT_STORE_FK;
   ALTER TABLE ALERT_EMAIL_JOB ENABLE CONSTRAINT ALRT_EMAIL_JOB_ALRT_STORE_FK;