Target Collection Attributes

You must define collection attributes before you can use Oracle DBSecCentral plug-ins to collect data from the audit trail.

For Database Table plug-in, JSON, CSV, XML file collection plug-ins, and REST plug-in, you need to set the audit collection attributes during target registration. This has to be completed after deploying the collection plug-in in the Audit Vault Server and before starting the audit trail which uses the plug-in.

You define collection attributes using the AVCLI command ALTER SECURED TARGET.

Required target attributes are:

• av.collector.securedtargetversion (Mandatory): Current version of the target. This version information helps in choosing the correct mapper file for the audit trail if there are multiple mapper files in the templates directory of the collection plug-in.

• av.collector.atcintervaltime: The collection plug-in writes the time, up to which audit data has been collected from the trail, to a file. This file will be present in the av/atc directory in the agent home. Also, this file contains the time in UTC time zone. This information can help some third party utilities to clean up audit data from a trail. Note that collection plug-in does not perform the audit data clean-up, it just writes this information to a file. atcintervaltime: specifies how frequently the collection plug-in should update the time information in the file. The value of the attribute is in minutes.

• av.collector.timezoneoffset (Mandatory): Offset of the target event time from UTC time zone. This helps the collector to report event time correctly to the Audit Vault Server by adjusting the time zones. This attribute is not needed for an XML file collection plug-in if the event time itself contains the time zone information. An example of this setting is as follows:

  av.collector.TimeZoneOffset = +5:30

• av.collector.enableArchivedTime(Optional): This attribute is applicable only for Oracle table trail. It is set to true by default. When enableArchivedTime is set to true and if INIT_CLEANUP procedure is called for the trail, then the last archived timestamp in dbms_audit_mgmt package is updated to the current checkpoint time based on the ATC interval time. When set to false, the last archived timestamp for the trail is not updated in the target database. In that case, the user must ensure that the audit records with timestamps less than the checkpoint time should not be purged from the audit table. The user can view the Audit Vault Server database checkpoint table in AVSYS schema to verify the checkpoint time of the trail until the records have been collected. If you want to change the attribute value, then the trail must be restarted after the attribute has been updated.