Enterasys Security Information and Event Manager, Руководство по настройке

Страница: 297 / 426

Configuring DSMs
Oracle OS Audit 281
/var/lock/
/var/run/
Step 10
Restart the Oracle database instance.
Step 11
Start the OS Audit DSM script:
oracle_osauditlog_fwdr.pl -t target_host -d logs_directory
If you restart your Oracle server you must restart the script:
oracle_osauditlog_fwdr.pl -t target_host -d logs_directory
You are now ready to configure the log sources within SIEM.
Step 1
From the Log Source Type drop-down list box, select Oracle RDBMS OS Audit
Record .
Step 2
From the Protocol Configuration drop-down list box. select syslog .
Step 3
From the Log Source Identifier field type the address specified using the –H
option in Step 11 . For more information on configuring log sources, see the Log
Sources User Guide .
Table 51-2 Oracle OS Audit Command Parameters
Parameters Description
-t The -t parameter defines the remote host that receives the audit log
files.
-d The -d parameter defines directory location of the DDL and DML log
files.
-H The -H parameter defines the host name or IP address for the syslog
header. We recommend that this be the IP address of the Oracle server
on which the script is running.
-D The -D parameter defines that the script is to run in the foreground.
Default is to run as a daemon (in the background) and log all internal
messages to the local syslog service.
-n The -n parameter processes new logs, and monitors existing log files for
changes to be processed.
If the -n option string is absent all existing log files are processed during
script execution.
-u The -u parameter defines UDP.
-f The -f parameter defines the syslog facility.priority to be included at the
beginning of the log.
If you do not type a value,
user.info
is used.
-r The -r parameter defines the directory name where you want to create
the .pid file. The default is /var/run. This parameter is ignored if -D is
specified.
-l The -I parameter defines the directory name where you want to create
the lock file. The default is /var/lock. This parameter is ignored if -D is
specified.
-h The -t parameter displays the help message.