2 Replies Latest reply: May 29, 2012 2:16 AM by 939797 RSS

    Fine Grained Audit records to syslog

      Hello experts,

      I am working on Standard Auditing and Fine Grained Auditing on databases on Red Hat x86_64.

      I am trying to send Fine Grained Audit records to syslog as for my Standard Audit records with audit_trail set to OS, but can't find any appropriate option.

      When I create FGA policies with the ADD_POLICY procedure of the DBMS_FGA package, the audit_trail parameter can only be set to DB or XML, as stated in [PL/SQL Packages and Types Reference|http://docs.oracle.com/cd/E11882_01/appdev.112/e25788/d_fga.htm#CDEIECAG].

      Does somebody know if it is possible to send FGA audit records to syslog directly:
      1. without using any additional product (e.g. Oracle Audit Vault)?
      2. without doing manual extraction from fga_log$ or DBA_COMMON_AUDIT_TRAIL?

      Thanks for any suggestion.
        • 1. Re: Fine Grained Audit records to syslog
          Well, i did not used FGA yet.

          I used audit_Trail=db and the query SELECT username,extended_timestamp,owner,obj_name,action_name,sql_text FROM dba_audit_trail WHERE to_char(extended_timestamp, 'DD/MM/RR') = to_char(SYSDATE - 1, 'DD/MM/RR') ORDER BY timestamp)

          Then i wrote a procedure, and exported the results using utl_file .

          And i scheduled this procedure to run daily.

          It works pretty good, if you like the solution as ask for details.

          Hope that helps,

          • 2. Re: Fine Grained Audit records to syslog
            Hello BSalesRashid,

            Thanks for your suggestion but it's not exactly what I am looking for.

            I have thought to create manual extraction jobs, but I want to limit the operations needed to have FGA records in the syslog as we have a lot of databases and this would make databases administration heavier.

            So create manual extraction is indeed a solution but if the Database embed a way (initialization parameter, package, etc.) to do this, I would prefer to use this solution.