Security Compliance

Integrate the Oracle Database with SolarWinds SEM

This article contains the procedures for integrating your Oracle database with your SolarWinds SEM implementation.

First published date

10/10/2018 2:30 AM

Last published date

11/4/2022 2:18 AM

Overview

This article contains the procedures for integrating your Oracle database with your SolarWinds Security Event Manager - SEM (formerly Log & Event Manager - LEM) implementation.

Product section

Security Event Manager

Resolution

Notes:

Install a SEM Agent on your database server.
SolarWinds supports the following versions of Oracle on the following operating systems:
9 10 11 12C 19C 21C
Windows X X X X X X
Linux X X X X X

Best Practices for Oracle Auditing

Configure auditing on your Oracle database to suit the needs of your environment. At minimum, we recommend you audit access rights to the database, such as login, logout, and change events. For more detailed auditing, SolarWinds recommends you use our Recommended Oracle Audit script below to enable auditing for sessions and most schema changes in addition to the basic auditing noted above.

REM ***************************************************************************
REM    Oracle Audit Configuration Script
REM    Version  : 1.1 

REM    Author   : TriGeo Network Security
REM               www.trigeo.com

REM    Script   : Recommended_Oracle_Audit.sql
REM    Created  : October 11 2007
REM    Purpose  : To configure auditing for TriGeo Oracle Agent Alerts
REM    To run as: SYSDBA.
REM ***************************************************************************

REM ***************************************************************************
REM Configure DB to log audits to system
REM ***************************************************************************

ALTER SYSTEM SET audit_sys_operations = TRUE SCOPE=SPFILE;
ALTER SYSTEM SET audit_syslog_level = "local6.debug" SCOPE=SPFILE;
ALTER SYSTEM SET audit_trail = "OS" SCOPE=SPFILE;
COMMIT;

REM ***************************************************************************
REM Clear existing audit configuration settings
REM ***************************************************************************

NOAUDIT ALL;
NOAUDIT ALL ON DEFAULT;
NOAUDIT ALL PRIVILEGES;


REM ***************************************************************************
REM CREATE, ALTER, and GRANT actions will be audited on all objects 
REM created in the future.
REM ***************************************************************************

AUDIT CREATE ON DEFAULT BY ACCESS;
AUDIT ALTER ON DEFAULT BY ACCESS;
AUDIT GRANT ON DEFAULT BY ACCESS;


REM ***************************************************************************
REM Audit the creation, alteration, and deletion of most DB schema objects in the database
REM ***************************************************************************

AUDIT TABLESPACE BY ACCESS;
AUDIT INDEX BY ACCESS;
AUDIT USER BY ACCESS;
AUDIT ROLE BY ACCESS;
AUDIT PROFILE BY ACCESS;
AUDIT CLUSTER BY ACCESS;
AUDIT TABLE BY ACCESS;
AUDIT PROCEDURE BY ACCESS;
AUDIT TRIGGER BY ACCESS;
AUDIT VIEW BY ACCESS;

REM ***************************************************************************
REM Audit OPERATOR objects
REM ***************************************************************************
AUDIT CREATE OPERATOR BY ACCESS;
AUDIT ALTER ANY OPERATOR BY ACCESS;
AUDIT DROP ANY OPERATOR BY ACCESS;


REM ***************************************************************************
REM Audit login/logouts, changes to the audit policy, changes access rights
REM and all TRUNCATE operations
REM ***************************************************************************

AUDIT SESSION BY ACCESS;
AUDIT ALTER SYSTEM;
AUDIT SYSTEM AUDIT BY ACCESS;
AUDIT SYSTEM GRANT BY ACCESS;
AUDIT TRUNCATE BY ACCESS;


REM ***************************************************************************
REM Audit changes to the audit trail table
REM ***************************************************************************

AUDIT DELETE ON SYS.AUD$ BY ACCESS;
AUDIT INSERT ON SYS.AUD$ BY ACCESS;
AUDIT UPDATE ON SYS.AUD$ BY ACCESS;

To enable the minimum recommended auditing:

Open SQL*Plus and connect to your database.
Run the following command:

AUDIT SESSION, ROLE, USER BY ACCESS;

To enable enhanced auditing using the Recommended Oracle Audit script:

Download the attached script and save it to a known location.
Open SQL*Plus and connect to your database as SYSDBA.
Run the following command at the SQL> prompt.
```
@PATH\Recommended_Oracle_Audit.sql|
```
where PATH is the file path for the script.
Restart your database in Enterprise Manager.

Configure Oracle on Windows to integrate with a SEM Agent

Use the following procedure to configure your Oracle database for integration with a SEM Agent.

Note: If you are configuring Oracle on a Linux server, configure it to report its logs using syslog messages after completing the following procedure. For more information, see the procedure on Configuring Oracle on Linux to Syslog to a SEM Agent.

Open SQL*Plus and connect to your database.
Run the following command to determine whether auditing is already turned on:
```
SELECT NAME,VALUE FROM v$parameter WHERE NAME LIKE 'audit%';
```
If auditing is turned on, this command should return the following results.
```
audit_trail OS
audit_sys_operations TRUE
```
If the command returns unexpected results, run the following commands:
```
ALTER SYSTEM SET audit_sys_operations = TRUE SCOPE=SPFILE;
ALTER SYSTEM SET audit_trail = "OS" SCOPE=SPFILE;
```
Note: Alter these commands if you did not start your database with the default spfile configuration.
Restart the database services.
Note: If you are running Oracle 9, be sure to restart your database using the spfile option, as this is not the default configuration when using SQL*Plus. If you are using Enterprise Manager instead, this should not be a concern.
Repeat Step 2 in this procedure to verify your changes were applied correctly.

Configuring Oracle on Linux to Syslog to a SEM Agent

Use the following procedure to configure Oracle to send Syslog messages to a local facility on your SEM Agent for Linux implementations.

Open SQL*Plus and connect to your database.

Run the following command to determine whether auditing is already turned on:

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

SELECT NAME,VALUE FROM v$parameter WHERE NAME LIKE 'audit%';

If auditing is turned on, this command should return the following results:

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

audit_trail OS
audit_sys_operations TRUE
audit_syslog_level local6.debug

If the command returns unexpected results, run the following commands:

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

ALTER SYSTEM SET audit_sys_operations = TRUE SCOPE=SPFILE;
ALTER SYSTEM SET audit_syslog_level = "local6.debug" SCOPE=SPFILE;
ALTER SYSTEM SET audit_trail = "OS" SCOPE=SPFILE;

Note: Alter these commands if you did not start your database with the default spfile configuration.

Restart the database services.
Repeat Step 2 of the Configure Oracle to Integrate with a SEM Agent procedure to verify your changes were applied correctly.

Open /etc/syslog.conf for editing and add the following entry:

# Oracle Audit Trail local6.log
local6.* /var/log/local6.log

If local6.log does not exist, create an empty file at /var/log/local6.log before you proceed.

Run the following commands to restart the syslog service:sh /etc/init.d/syslog stop
sh /etc/init.d/syslog start

-- Scripts are not supported under any SolarWinds support program or service.
-- Scripts are provided AS IS without warranty of any kind. SolarWinds further
-- disclaims all warranties including, without limitation, any implied warranties
-- of merchantability or of fitness for a particular purpose. The risk arising
-- out of the use or performance of the scripts and documentation stays with you.
-- In no event shall SolarWinds or anyone else involved in the creation,
-- production, or delivery of the scripts be liable for any damages whatsoever
-- (including, without limitation, damages for loss of business profits, business
-- interruption, loss of business information, or other pecuniary loss) arising
-- out of the use of or inability to use the scripts or documentation.

sh /etc/init.d/syslog stop
sh /etc/init.d/syslog start

Configure the Oracle Auditor Connector on Your SEM Agent

Use the following procedure to configure the Oracle Auditor connector on the SEM Agent installed on your database server. For Windows implementations, use the Oracle Auditor - Windows connector. For Linux implementations, use the Oracle Auditor - Syslog connector.

SEM Flash console

Open your SEM Console and log in as an administrator.
Click the Manage tab, and then click Nodes.
Locate the SEM Agent on your database server, click the gear icon next to it (left), and then click Connectors.
In the Connector Configuration window, enter Oracle Auditor in the search box at the top of the Refine Results pane.
Click the gear icon next to the Oracle Auditor connector for your host operating system, and then click New.
Enter a custom Alias or accept the default.
If you are configuring the Oracle Auditor - Syslog connector, verify that the Log File path matches the path you supplied in your initial configuration.
If you are finished configuring the connector, click Save.
Click the gear icon next to the new connector, denoted by an icon in the Status column, and then click Start.
Click Close to close the Connector Configuration window.

SEM HTML5 console

In the SEM Events console, click the Nodes tab.
Select your agent node, and then click Manage Node connectors.
In the search box, enter Oracle Auditor.
Select your connector, and then click Add connector.
Enter a name, or accept the default.
Note: If you are configuring the Oracle Auditor - Syslog connector, verify that the Log File path matches the path you supplied in your initial configuration.
Click Add.
Under configured connectors, select your connector, and then click Start.

Disclaimer: Please note, any content posted herein is provided as a suggestion or recommendation to you for your internal use. This is not part of the SolarWinds software or documentation that you purchased from SolarWinds, and the information set forth herein may come from third parties. Your organization should internally review and assess to what extent, if any, such custom scripts or recommendations will be incorporated into your environment. You elect to use third-party content at your own risk, and you will be solely responsible for the incorporation of the same if any.

	9	10	11	12C	19C	21C
Windows	X	X	X	X	X	X
Linux		X	X	X	X	X