Configuring Oracle Audit WUC

I had problem with Oracle audit log on WUC connector. I was follow instructions in documentation of "SmartConnector for Microsoft Windows Event Log – Unified: Oracle Audit" - application logs were collected correctly but unparsed and categorized as System or Application Event.

I have studied the documentation and this forum and here is my solution - maybe help someone else:

1) For Oracle host set collecting Application log ( Custom Log Names is blank ) 
2) Edit or reate customeventsource.map.csv in 

$ARCSIGHT_HOME/current/user/agent/fcp/windowsfg/

 and put to file:  

#Original_Event_Log_Type, Original_Event_Log_Source, Target_Event_Log_Source, Target_Event_Log_Type
Application,Oracle.*,oracle_orcl,Application

The complete contents of a sample customeventsource.map.csv file with two entries may appear as:

#Original_Event_Log_Type, Original_Event_Log_Source, Target_Event_Log_Source, Target_Event_Log_Type
Application,Oracle.*,oracle_orcl,Application

 

3) Save file and restart connector

4) Like charm, logs are parsed and categorized correctly :)

Sorry for my english. :)