Using an Audit Trail Cleanup with Java-Based Collection Plug-ins

Learn how you can enable audit trail clean-up on the source after Oracle Database Security Central has archived an audit trail.

Audit trail clean-up is a feature that some sources provide to remove audit records after they have been archived. If this type of feature exists in the source, then an Oracle Audit Vault collection plug-in can integrate with the feature, to tell the source to what extent the audit trail has been archived. When Oracle Audit Vault provides archive status information, a source is enabled to clean up the audit trail (remove the original audit data) to that point, because the Oracle Audit Vault status indicates that the audit trail is archived, and deleting the audit trail to the point of the archive record results in no loss of data. The Oracle Audit Vault collection plug-in gives the clean-up utility information about the checkpoint, which is he point up to which data has been collected.

The collection plug-in can write archive status information into the directory agent_home\av\atc, to a file with a trail-specific name, using the following syntax * SecuredTargetName_TrailID*.atc (for example, oracl_1.atc).

The content of the atc file should consist of the following:

• securedTargetType=Oracle

• SecuredTargetName=orcl

• TrailType=TABLE

• TrailName=sys.aud$

• 2016-04-15 10:26:53.7 (This time stamp represents the last checkpoint for these settings.)

The target clean-up utility can parse the checkpoint from the atc file and purge audit records till this timestamp from audit trail.

For example, Oracle Database sources provide a target cleanup utility, in the DMBS_AUDIT_MGMT PL/SQL package. The Oracle Database prepackaged collection plug-ins integrate with the DMBS_AUDIT_MGMT package, which enables audit trail cleanup operations on the source.