Ensign
Ensign
547 views

Oracle Audit DB Smart Connector supports Oracle 12c Unified Auditing

Hi.

I'm trying to configure an Oracle Audit DB SmartConnector to audit an Oracle 12c instance where the Unified Auditing Mode is enabled.

The connection was successuful, but no events are collected by connector.

I sniffed the traffic between the SmartConnector and the DB server and i realized that all query are related to dba_common_audit_trail and sys.aud$ tables. So, in my installation, these tables are empty, but all audit data are stored in unified_audit_trail table.

Is it possible to configure the SmartConnector to query the unified_audit_trail table table?

Thanks in advance,

Fabio

Labels (1)
0 Likes
3 Replies
Fleet Admiral
Fleet Admiral

Hi Fabio,

If when you launch the following command in sqlplus:

select * from dba_audit_trail

And you do not find any events. It is normal that you have no logs in ArcSight.

I have not found in the documentation an advanced parameter that permit to collect logs from unified_audit_trail.

I think that the Audit DB Connector do not support this config yet.

I advice you to ask to the HP Support to know exactly when this will be supported by the connector.

Otherwise to disable unified auditing to collect Audit DB logs with that connector.

It works well.

Just an advice if you need the complete SQL statement you have to update the config on DB in chosing audit_trail=db,extended but according DBA Admin there is an impact on Oracle Server performance.

Thanks

Regards

Michael

0 Likes
Ensign
Ensign

Hi Michael.

Thank you for your response.

Yes, when I launch in sqlplus the command:

select * from dba_audit_trail

it returns 0 rows.

Following your suggestion, I opened a new service request to HP support.

Best regards

Fabio

0 Likes
Absent Member.
Absent Member.

Hi, Fabio,

I have the same question as you - I am curious when Unified Auditing Mode is scheduled to be supported by ArcSight.

Can you please share the answer from HP support to you request when it arrives?

P.S.: What are your experiences with Unified Auditing in Oracle 12c as such, e.g. using the unified_audit_trail view ?

Thank you much

Peter

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.