Ciao Wim, thanks, unfortunately that is possible only starting from 10g. Old good 9i has only the options for logging to file (AUDIT_TRAIL can be only DB, OS or NONE):
http://download.oracle.com/docs/cd/B10501_01/server.920/a96521/audit.htm Cheers Fabio -----Messaggio originale----- Da: [email protected] [mailto:[email protected]] Per conto di Wim Remes Inviato: giovedì 10 dicembre 2009 15:47 A: [email protected] Cc: [email protected] Oggetto: Re: [ossec-list] Checking for new logfiles with wildcards or Oracle 9i audit trail monitoring Fabio, you can have Oracle writing audit records to syslog, which would allow you to capture the events there instead of in the everchanging files. http://download-uk.oracle.com/docs/cd/B28359_01/server.111/b28320/initparams016.htm#REFRN10263 Cheers, Wim On Thu, Dec 10, 2009 at 2:33 PM, Fabio Paracchini <[email protected]> wrote: > Hi folks, > > I implemented a new collector for Oracle 9i audit trail, but I have a > little problem regarding the funny way used by Oracle to write logfiles. > > > > Oracle writes in the same directory a different logfile for each process, > I'm able to correctly monitor the files that already exists at OSSEC start, > but it seems that there is no way to check and monitor new files. > > > > Is it possible to have the agent check for new files periodically or, > better, to start monitor the file as soon as it appears ? > > As an alternative, is it possible to have the agent read the beginning of > the logfile instead of reading from the last byte, so that I can restart > periodically the agent (e.g. every 10 minutes) and analyze the logs ? > > > > I tried to look at logcollector.c but for sure there is someone out there > that has better knowledge... > > > > I'll be more than happy to release the code for inclusion in the main > release, but I'd like to have it work properly. > > > > Thank you in advance for the help. > > Ciao > > Fabio > > The Agent configuration is as follows: > > > > <localfile> > > <log_format>oracle_audit_log</log_format> > > <location>/vol1/ora9/product/9.2/rdbms/audit/*.aud</location> > > </localfile> > > > > The directory structure is similar to this: > > > > ls /vol1/ora9/product/9.2/rdbms/audit > > ora_3849.aud ora_3960.aud ora_4446.aud ora_4636.aud ora_4654.aud > ora_4672.aud ora_4704.aud ora_4722.aud ora_4841.aud > > > > The single file contains something like that: > > > > Audit file /vol1/ora9/product/9.2/rdbms/audit/ora_3849.aud > > Oracle9i Release 9.2.0.4.0 - Production > > JServer Release 9.2.0.4.0 - Production > > ORACLE_HOME = /vol1/ora9/product/9.2 > > System name: Linux > > Node name: LNXSQU23.***** > > Release: 2.4.21-20.ELsmp > > Version: #1 SMP Wed Aug 18 20:46:40 EDT 2004 > > Machine: i686 > > Instance name: cope > > Redo thread mounted by this instance: 1 > > Oracle process number: 15 > > Unix process pid: 3849, image: ora...@lnxsqu23.**** (TNS V1-V3) > > > > Thu Dec 10 12:34:03 2009 > > ACTION : 'CONNECT' > > DATABASE USER: 'SYS' > > PRIVILEGE : SYSDBA > > CLIENT USER: ****** > > CLIENT TERMINAL: ******* > > STATUS: 0 > > > > Thu Dec 10 12:34:03 2009 > > ACTION : 'declare cursor NlsParamsCursor is SELECT * FROM > nls_session_parameters;begin SELECT Nvl(Lengthb(Chr(65536)), > Nvl(Lengthb(Chr(256)), 1)) INTO > > :CharLength FROM dual; for NlsRecord in NlsParamsCursor loop if > NlsRecord.parameter = 'NLS_DATE_LANGUAGE' then :NlsDateLanguage := > NlsRecord.value; > > elsif NlsRecord.parameter = 'NLS_DATE_FORMAT' then ' > > DATABASE USER: 'SYS' > > PRIVILEGE : SYSDBA > > CLIENT USER: ******** > > CLIENT TERMINAL: ******** > > STATUS: 0 > > > > -- Wim Remes Security Afficionado
