Attention: To align with new corporate security policies, and to match policies adopted by other communities within Oracle, the My Oracle Support Community access requirements will change beginning September 18, 2025. MOSC will now require that member accounts in our community be associated to a *corporate* email address. This means that users with generic domains (such as gmail.com, yahoo.com, and others) will no longer be granted access to the discussion forums and ideas labs. If this policy affects you, act now to change the email address that is associated with your Oracle (and community) account. Alternatively, you can opt to create a new Oracle account that uses your corporate email domain.

Database Administration (MOSC)

Oracle 12C auditing for Splunk

Dec 9, 2020 9:18PM edited Dec 9, 2020 9:21PM in Database Administration (MOSC) 6 commentsAnswered ✓

Just one simple question to try to start with the best approach.

I intent to get my databases audited to deliver those OS files for Splunk, or share the directory. This is my idea.

What will be the best option?

Create Splunk user for Splunk access directly to my database to UNIFIED_AUDIT_TRAIL view?
No Splunk user, just a share directory with my save audit files. Internally, I'll export UNIFIED_AUDIT_TRAIL view into OS files. What will be the best approach with this scenario? AUDIT_TRAIL='OS'? The recommendations with this UNIFIED AUDIT option on 12C is to set AUDIT_TRAIL='NONE', so how to export that view to OS files? Dump?

Tagged:

audit

0

Howdy, Stranger!

To view full details, sign in to My Oracle Support Community.

Don't have a My Oracle Support Community account? Click here to get started.

Category Leaderboard

Top contributors this month