About the Flow of Control Inside the Java-Based Collection Plug-in

Learn how Oracle Audit Vault accesses an audit trail, maps the trail to Oracle Audit Vault events, starts the correct Java-based collection plug-in, and creates audit records.

When a collection plug-in accesses an audit trail, it extracts an audit record and its related fields from the audit trail. Next, it maps the audit record to an Oracle Audit Vault event, and all the fields to Oracle Audit Vault fields. The collection plug-in then passes the Oracle Audit Vault event and fields to the Collection Framework, which sends the information to the Oracle Audit Vault Server.

The sequence of control processes for the audit trail collection is as follows.

Control Process Sequence for Audit Trail Collection

  1. The Oracle Audit Vault Server commands the Agent Framework to create a thread to collect from a specific audit trail.

  2. The new thread, just created by the agent, collects a specific audit trail.

    At this point, control is handed to the Collection Framework.

  3. Within the thread, the Collection Framework connects to the Oracle Audit Vault Server, and queries for configuration information for the audit trail being collected.

    In addition, it requests information for the last checkpoint set for that trail.

  4. With the information it now has, the Collection Framework uses the plug-in manifest file to determine the correct Java class to start within the correct collection plug-in. It passes the configuration information to this class, and asks it to initialize itself.

  5. After the collection plug-in has initialized itself, the Collection Framework loops repeatedly. Within each loop, the Collection Framework does the following:

    • Asks the collection plug-in for any additional audit records in the audit trail.

      The collection plug-in transforms (by mapping) any further audit records into the form of audit records that Audit Vault expects, and hands them to the Collection Framework through the Collection API.

  6. The collection plug-in can periodically send Checkpoint and metric information to the Collection Framework. The collection plug-in can do so in the same flow when it has the control, for example when the Collection Framework calls hasNext().

  7. If the Oracle Audit Vault Server sends commands to the Collection Framework, the Collection Framework passes them to the collection plug-in to act on.

    If the Collection Framework receives a STOP command from the Audit Vault Server, it notifies the collection plug-in to stop sending record. Then it exits the collection thread and shuts itself down.

    If the Collection Framework receives a RECONFIGURE command from the Audit Vault Server, it notifies the collection plug-in to set an attribute using setAttribute().

Related Topics