Oracle Database Security Central Fields

Oracle Database Security Central values consist of core fields, large fields, marker fields, and extension fields.

Core Fields

To monitor and filter audit records for all source types in Oracle Audit Vault, you use core fields.

Core fields are fundamental to all source types. They are central to the description of an event. These fields are present in most audit records, for reporting, filtering, and so on.

Core Field Definitions

EventTimeUTC: Required: The time stamp that indicates when the event occurred. If the event has more than one time stamp (for example, an event start time stamp and an event end time stamp), then the collection plug-in must assign a time stamp to this field. If this field contains NULL, then Oracle Audit Vault shuts down the collection plug-in.

UserName: Required: The user who performed the action in the application or system that generated the audit record. If this field contains NULL, then the audit record is invalid.

CommandClass: Required: The action performed in the event (for example, SELECT or DELETE). If this field contains NULL, then the audit record is invalid.

OSUserName: The user who logged into the operating system that generated the audit record. If the user logged into the operating system as JOHN but performed the action as SCOTT, then this field contains JOHN and the User Name field contains SCOTT.

TargetType: The type of the target object on which the action was performed. For example, if the user selected from a table, then the target type is TABLE.

TargetObject: The name of the object on which the action was performed. For example, if the user selected from a table, then the Target Object field contains the name of the table.

TargetOwner: The name of the owner of the target on which the action was performed. For example, if the user had selected from a table owned by user JOHN, then the Target Owner field contains the user name JOHN.

ClientIP: The IP address of the host (Host Name) from where the user initiated the action.

ClientId: Client identifier of the user whose actions were audited.

ClientHostName: The host computer from where the user initiated the action. For example, if the user performed the action from an application on a server, then this field contains the name of the server.

TerminalName: Name of the UNIX terminal that was the source of the event.

EventName: The name of the event as is from the audit trail.

EventStatus: The status of the event. There are three possible values for EventStatus: SUCCESS, FAILURE, and UNKNOWN.

ErrorId: The error code of an action.

ErrorMessage: The error message of an action.

Related Topics

Large Fields

In Oracle Audit Vault, Large fields are fields that can contain arbitrarily large amounts of data.

Large Field Definitions

For large fields, use the following:

Marker Field

In Oracle Audit Vault, marker fields are fields that uniquely identify a record in a trail.

Marker Field Definitions

Marker Field of a Record: The marker is a string that uniquely identifies a record in a trail. During the recovery process, Oracle Audit Vault uses this field to filter the duplicate records. The collection plug-in provides the marker field, which is typically a concatenated subset of the fields of an audit record. For example, with Oracle Database, the session ID and Entry ID (a unique identifier within a session) define a marker.

Extension Field

Extension fields store fields that cannot be accommodated in core or large fields, as name-value pairs, separated by delimiter, inside a single Audit Vault field.

Extension Field Definition

The extension field contains character large object (CLOB) columns. The RLS$INFO column describes the configured row level security policies. The RLS$INFO information is mapped to the extension field in Oracle Database Security Central.

Extension Field Values

To populate the extension field column, you must set the AUDIT_TRAIL parameter of the target to DB EXTENDED.