Enterasys Security Information and Event Manager, Configuration Manual

Page: 294 / 426

Configuring DSMs
278 O
RACLE
For example, to monitor the listener log on an Oracle 9i server with an IP address
of 182.168.12.44 and forward events to SIEM with the IP address of
192.168.1.100, type the following:
oracle_dblistener_fwdr.pl –t “tail –f
<install_directory>/product/9.2/network/log/listener.log”
–f user.info –H 192.168.12.44 –h 192.168.1.100 –p 514
A sample log from this setup would appear as follows:
<14>Apr 14 13:23:37 192.168.12.44 AgentDevice=OracleDBListener
Command=SERVICE_UPDATE DeviceTime=18-AUG-2006
16:51:43 Status=0 SID=qora9
NOTE
The kill command can be used to terminate the script if you need to reconfigure a
script parameter or stop the script from sending events to SIEM. For example,
kill -QUIT ‘cat /var/run/oracle_dblistener_fwdr.pl.pid‘
. The
example command uses the backquote character (
‘
), which is located to the left
of the number one on most keyboard layouts.
You are now ready to configure the Oracle Database Listener within SIEM.
Step 1
From the Log Source Type drop-down list box, select Oracle Database Listener .
Step 2
From the Protocol Configuration drop-down list box, select syslog .
Step 3
In the Log Source Identifier field, type the IP address of the Oracle Database you
specified using the -H option in Step 6 .
The configuration of the Oracle Database Listener protocol is complete. For more
information on Oracle Database Listener, see your vendor documentation.
Oracle Audit Vault
The SIEM Oracle Audit Vault DSM accepts events on Oracle v10.2.3.2 and above
using Java Database Connectivity (JDBC) to accesses alerts on the JDBC
protocol. SIEM records Oracle Audit Vault alerts from the source database and
captures events as configured by the Oracle Audit Policy Setting. When events
occur, the alerts are stored in avsys.av$alert_store table. Customized events are
created in Oracle Audit Vault by a user with AV_AUDITOR permissions.
See your vendor documentation about configuration of Audit Policy Settings in
Oracle Audit Vault.
In Oracle Audit Vault, alert names are not mapped to a SIEM Identifier (QID).
Using the Map Event function in the SIEM Events interface a normalized or raw
-l The -I parameter defines the directory name where you wish to create
the lock file. The default is /var/lock. This parameter is ignored if -D is
specified.
Table 51-1 Command Parameters (continued)
Parameters Description