Enterasys Security Information and Event Manager, Configuration Manual

Page: 288 / 426

Configuring DSMs
272 O
RACLE
To configure an Oracle Audit device to write audit logs to SIEM, see Integrating
Oracle Audit Device with SIEM . If your system includes a large Oracle audit table
(greater than 1 GB), see Improving Performance With Large Audit Tables .
Integrating Oracle
Audit Device with
SIEM
To configure the device to write audit logs:
Step 1
Log in to the Oracle host as an Oracle user (This user was used to install Oracle,
for example oracle).
Step 2
Make sure the ORACLE_HOME and ORACLE_SID environment variables are
configured properly for your deployment.
Step 3
Open the following file:
${ORACLE_HOME}/dbs/init${ORACLE_SID}.ora
Step 4
Choose one of the following options:
a
For database audit trails, type the following command:
*.audit_trail=’DB’
b
For syslog, type the following command:
*.audit_trail=’os’
*.audit_syslog_level=’local0.info’
You must make sure the syslog daemon on the Oracle host is configured to
forward the audit log to SIEM. For systems running Red Hat Enterprise, the
following line in the
/etc/syslog.conf
file effects the forwarding:
local0.info @siem.domain.tld
Where
siem.domain.tld
is the hostname of the SIEM system that receives
the events. The syslog configuration must be re-loaded for the above command
to be recognized. On a system running Red Hat Enterprise, type the following
line to reload the syslog configuration:
kill -HUP /var/run/syslogd.pid
Step 5
Save and exit the file.
Step 6
To restart the database:
a
Connect to SQLplus and log in as sysdba:
For example,
Enter user-name: sys as sysdba
b
Shut down the database:
shutdown immediate
c
Restart the database:
startup