Fabio, you can have Oracle writing audit records to syslog, which would allow you to capture the events there instead of in the everchanging files.
http://download-uk.oracle.com/docs/cd/B28359_01/server.111/b28320/initparams016.htm#REFRN10263 Cheers, Wim On Thu, Dec 10, 2009 at 2:33 PM, Fabio Paracchini <[email protected]> wrote: > Hi folks, > > I implemented a new collector for Oracle 9i audit trail, but I have a > little problem regarding the funny way used by Oracle to write logfiles. > > > > Oracle writes in the same directory a different logfile for each process, > I’m able to correctly monitor the files that already exists at OSSEC start, > but it seems that there is no way to check and monitor new files. > > > > Is it possible to have the agent check for new files periodically or, > better, to start monitor the file as soon as it appears ? > > As an alternative, is it possible to have the agent read the beginning of > the logfile instead of reading from the last byte, so that I can restart > periodically the agent (e.g. every 10 minutes) and analyze the logs ? > > > > I tried to look at logcollector.c but for sure there is someone out there > that has better knowledge… > > > > I’ll be more than happy to release the code for inclusion in the main > release, but I’d like to have it work properly. > > > > Thank you in advance for the help. > > Ciao > > Fabio > > The Agent configuration is as follows: > > > > <localfile> > > <log_format>oracle_audit_log</log_format> > > <location>/vol1/ora9/product/9.2/rdbms/audit/*.aud</location> > > </localfile> > > > > The directory structure is similar to this: > > > > ls /vol1/ora9/product/9.2/rdbms/audit > > ora_3849.aud ora_3960.aud ora_4446.aud ora_4636.aud ora_4654.aud > ora_4672.aud ora_4704.aud ora_4722.aud ora_4841.aud > > > > The single file contains something like that: > > > > Audit file /vol1/ora9/product/9.2/rdbms/audit/ora_3849.aud > > Oracle9i Release 9.2.0.4.0 - Production > > JServer Release 9.2.0.4.0 - Production > > ORACLE_HOME = /vol1/ora9/product/9.2 > > System name: Linux > > Node name: LNXSQU23.***** > > Release: 2.4.21-20.ELsmp > > Version: #1 SMP Wed Aug 18 20:46:40 EDT 2004 > > Machine: i686 > > Instance name: cope > > Redo thread mounted by this instance: 1 > > Oracle process number: 15 > > Unix process pid: 3849, image: ora...@lnxsqu23.**** (TNS V1-V3) > > > > Thu Dec 10 12:34:03 2009 > > ACTION : 'CONNECT' > > DATABASE USER: 'SYS' > > PRIVILEGE : SYSDBA > > CLIENT USER: ****** > > CLIENT TERMINAL: ******* > > STATUS: 0 > > > > Thu Dec 10 12:34:03 2009 > > ACTION : 'declare cursor NlsParamsCursor is SELECT * FROM > nls_session_parameters;begin SELECT Nvl(Lengthb(Chr(65536)), > Nvl(Lengthb(Chr(256)), 1)) INTO > > :CharLength FROM dual; for NlsRecord in NlsParamsCursor loop if > NlsRecord.parameter = 'NLS_DATE_LANGUAGE' then :NlsDateLanguage := > NlsRecord.value; > > elsif NlsRecord.parameter = 'NLS_DATE_FORMAT' then ' > > DATABASE USER: 'SYS' > > PRIVILEGE : SYSDBA > > CLIENT USER: ******** > > CLIENT TERMINAL: ******** > > STATUS: 0 > > > > -- Wim Remes Security Afficionado
