Oracle Audit DB Smart Connector supports Oracle 12c Unified Auditing

[buccia1]

Hi.

I'm trying to configure an Oracle Audit DB SmartConnector to audit an Oracle 12c instance where the Unified Auditing Mode is enabled.

The connection was successuful, but no events are collected by connector.

I sniffed the traffic between the SmartConnector and the DB server and i realized that all query are related to dba_common_audit_trail and sys.aud$ tables. So, in my installation, these tables are empty, but all audit data are stored in unified_audit_trail table.

Is it possible to configure the SmartConnector to query the unified_audit_trail table table?

Thanks in advance,

Fabio

[mschleich]

Hi Fabio,

If when you launch the following command in sqlplus:

select * from dba_audit_trail

And you do not find any events. It is normal that you have no logs in ArcSight.

I have not found in the documentation an advanced parameter that permit to collect logs from unified_audit_trail.

I think that the Audit DB Connector do not support this config yet.

I advice you to ask to the HP Support to know exactly when this will be supported by the connector.

Otherwise to disable unified auditing to collect Audit DB logs with that connector.

It works well.

Just an advice if you need the complete SQL statement you have to update the config on DB in chosing audit_trail=db,extended but according DBA Admin there is an impact on Oracle Server performance.

Thanks

Regards

Michael

[buccia1]

Hi Michael.

Thank you for your response.

Yes, when I launch in sqlplus the command:

select * from dba_audit_trail

it returns 0 rows.

Following your suggestion, I opened a new service request to HP support.

Best regards

Fabio

[maklary]

Hi, Fabio,

I have the same question as you - I am curious when Unified Auditing Mode is scheduled to be supported by ArcSight.

Can you please share the answer from HP support to you request when it arrives?

P.S.: What are your experiences with Unified Auditing in Oracle 12c as such, e.g. using the unified_audit_trail view ?

Thank you much

Peter