Enterasys Security Information and Event Manager, Configuration Manual

Page: 287 / 426

Configuring DSMs
51 O
RACLE
This section provides information on configuring the following DSMs:
• Oracle Audit Records
•
Oracle DB Listener
•
Oracle Audit Vault
• Oracle OS Audit
• Oracle BEA WebLogic
Oracle Audit
Records
Oracle databases track auditing events, such as, user login and logouts,
permission changes, table creation, and deletion and database inserts. SIEM can
collect these events for correlation and reporting purposes through the use of the
Oracle Audit DSM. For more information, see your Oracle documentation.
NOTE
Oracle provides two modes of audit logs. SIEM does not support fine grained
auditing.
Oracle RDBMS is supported on Linux only when using syslog. Microsoft Windows
hosts and Linux are supported when using JDBC to view database audit tables.
When using a Microsoft Windows host, verify database audit tables are enabled.
These procedures should be considered guidelines only. We recommend that you
have experience with Oracle DBA before performing the procedures in this
document. For more information, see your vendor documentation.
Before SIEM can collect Oracle Audit events from an Oracle RDBMS instance, that
instance must be configured to write audit records to either syslog or the database
audit tables. For complete details and instructions for configuring auditing, see
your vendor documentation.
NOTE
Not all versions of Oracle can send audit events using syslog. Oracle v9i and 10g
Release 1 can only send audit events to the database. Oracle v10g Release 2
and Oracle v11g can write audit events to the database or to syslog. If you are
using v10g Release 1 or v9i, you must use JDBC-based events. If you are using
Oracle v10g Release 2, you may use syslog or JDBC-based events.