Less04_Conf_Srcs_Coll.ppt

Configuring Sources and Collectors Objectives After completing this lesson, you should be able to: Configure audit sources Configure collectors for an Oracle database Start agents and collectors Oracle Database Collectors DBAUD: Retrieves audit records from: Database audit trail stored in SYS.AUD$ Fine-grained audit trails stored in SYS.FGA_LOG$ OSAUD: Retrieves audit records from the OS audit file REDO: Uses Oracle LogMiner and Streams to retrieve logical change records (LCRs) from the redo log files Using the DBAUD Collector Collects audit records from the audit trail when AUDIT_TRAIL is set to DB,EXTENDED Collects data from the SYS.AUD$ and SYS.FGA_LOG$ tables Collects: DDL and DML statements SQL text Successes and/or failures as specified in audit settings Can be remote from the source database and the Audit Vault Server Oracle Database Collectors: DBAUD Using the OSAUD Collector Collects audit records from the audit trail when AUDIT_TRAIL is set to AUDIT_TRAIL = OS Collects mandatory audit records from the operating system audit trail Collects: DDL and DML statements SYS privilege usage Successes and/or failures as specified in audit settings Independent process running on source host Oracle Database Collectors: OSAUD Oracle Database Collectors: REDO Uses Streams technology to retrieve logical change records (LCRs) from the redo log files Collects: Committed DDL and DML statements SYS privilege usage Before-and-after values (successes only) Oracle Database Collectors: REDO Setting Initialization Parameters for REDO Collectors Set parameters as suggested for the REDO collector: Basic Steps to Configure Sourcesand Deploy Collectors Create a user in the source database that will be used by the Audit Vault collectors. Execute the zarsspriv.sql script to grant privileges to the source user you created in the previous step. Create a user in the Audit Vault Server database to be used to insert data from the source database. Grant proxy connect privileges to the A