Preprocessing Audit Data
Learn about the requirements to use Oracle DBSecCentral collection plug-ins.
In general, collection plug-ins can only be used to collect audit trails that conform to the requirements presented in this chapter.
For other audit trails, you can use the Audit Vault Java API.
However, there can be other reasons why you cannot collect audit records directly with a collection plug-in, but you can collection them indirectly.
It can be possible to preprocess these audit trails to generate entries in database tables or XML files in a format that allows collection plug-ins to collect them. For example, IBM DB2 on Linux, Unix, and Microsoft Windows all require you to execute the db2audit program to extract audit records from a proprietary binary format into a text file. To extract new records, you must run this program periodically as the user who owns the DB2 software.
While you cannot define a collection plug-in to read the file directly, It is possible that you can write a program that reads the file periodically, extracts new audit records, and writes them to a new XML file in a directory. Each run of this program can create a new XML file that contains only the new records. You can then define a collection plug-in to read these XML files, and collect the audit records into Oracle Audit Vault Server.
Related Topics