Enterasys Security Information and Event Manager, Configuration Manual

Page: 289 / 426

Configuring DSMs
Oracle Audit Records 273
Step 7
If you are using Oracle v9i or Oracle v10g Release 1, you must create a view,
using SQLplus to enable the SIEM integration. If you are using Oracle 10g
Release 2 or later, you may skip this step:
CREATE VIEW SIEM_audit_view AS SELECT
CAST(dba_audit_trail.timestamp AS TIMESTAMP) AS SIEM_time,
dba_audit_trail.* FROM dba_audit_trail;
If you are using the JDBC protocol, see the Log Sources User Guide for more
information on configuring the JDBC protocol. When configuring the JDBC protocol
within SIEM (see the
Log Sources User Guide ), use the following specific
parameters:
NOTE
Make sure that database user that SIEM uses to query events from the audit log
table has the appropriate permissions for the Table Name object.
Step 8
You are now ready to configure the log source in SIEM.
To configure SIEM to receive events from an Oracle Database:

From the Log Source Type drop-down list box, select the Oracle RDBMS
Audit Record option.
For more information on configuring log sources, see the Log Sources User Guide .
Improving
Performance With
Large Audit Tables
The size of the Oracle audit table affects the amount of time that SIEM requires to
process the DBA_AUDIT_TRAIL view. If your sys.sud$ table is large (close or
exceeding 1 GB), extended processing time is required. To ensure SIEM
processes the large sys.sud$ table quickly, you must create an index and a new
view.
NOTE
If auditing is extensive or the database server is very active, you may need to shut
down the database to perform the below procedure.
Table 51-2 Configuring Log Source Parameters
Parameter Name
Oracle v9i or 10g Release 1
Values Oracle v10g Release 2 and
v11g Values
Table Name SIEM_audit_view dba_audit_trail
Select List * *
Compare Field SIEM_time extended_timestamp
Database Name For all supported versions of Oracle, the Database Name
must be the exact service name used by the Oracle listener.
You can view the available service names by running the
following command on the Oracle host:
lsnrctl status