New Ranks & Badges For The Community!
Notice something different? The ranks and associated badges have gone "Star Fleet". See what they all mean HERE
Highlighted
Captain
Captain
376 views

Configuring Oracle Audit WUC

I had problem with Oracle audit log on WUC connector. I was follow instructions in documentation of "SmartConnector for Microsoft Windows Event Log – Unified: Oracle Audit" - application logs were collected correctly but unparsed and categorized as System or Application Event.

I have studied the documentation and this forum and here is my solution - maybe help someone else:

1) For Oracle host set collecting Application log ( Custom Log Names is blank ) 
2) Edit or reate customeventsource.map.csv in 

$ARCSIGHT_HOME/current/user/agent/fcp/windowsfg/

 and put to file:  

#Original_Event_Log_Type, Original_Event_Log_Source, Target_Event_Log_Source, Target_Event_Log_Type
Application,Oracle.*,oracle_orcl,Application

The complete contents of a sample customeventsource.map.csv file with two entries may appear as:

#Original_Event_Log_Type, Original_Event_Log_Source, Target_Event_Log_Source, Target_Event_Log_Type
Application,Oracle.*,oracle_orcl,Application

 

3) Save file and restart connector

4) Like charm, logs are parsed and categorized correctly 🙂

Sorry for my english. 🙂

0 Replies
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.