How to configure unified audit with Dataguard and a SIEM tool
I am looking for a recommendation on how to configure database auditing that will satisfy following:
1. All audit events must be replikated into a SIEM tool (in case: ArcSight)
2. No audit events must be lost.
3. Active Dataguard is used and audit trail management must be identical for primary and standby
4. Unified auditing is prefered
The issues I face are:
- SYSLOG has been demonstrated to drop events, when rate of events is high
- Database based audit trail does not include audit events on the standby database (audit logs are
written to filesystem)
- Binary audit log format is not compatible with ArcSight (not relevant for unified auditing)