3 Replies Latest reply: Oct 3, 2012 8:34 AM by 706614 RSS

    audit vault vs auditing of access

    964657
      Can anyone help clarifying what is included in 11g and what is an extra cost? It sounds like AuditVault is an add-on product/cost?

      But what about the audit settings I see here with DBMS_AUDIT_MGMT:

      http://www.oracle-base.com/articles/11g/auditing-enhancements-11gr2.php

      http://docs.oracle.com/cd/E14072_01/network.112/e10574/auditing.htm

      It looks like any enterprise license already has the right to create logs with DBMS_AUDIT_MGMT for free/included. Is that correct? If so, what extra does auditvault give you? It looks like the reporting/alerting/etc...

      But if I just send the raw/free audit logs to splunk for alerting/reporting, it looks like I can still do my own reporting without adding an extra oracle package. Does that sound right?

      Thank you!
        • 1. Re: audit vault vs auditing of access
          706614
          You are correct in surmising that DBMS_AUDIT_MGMT is a database feature already included as part of the Enterprise Edition license for your database. It allows you to manage the audit trail generated by our database - how long to keep, when to delete, etc.

          Audit Vault, on the other hand, is a heterogeneous solution aimed at assisting with regulatory compliance. It consolidates audit trails from multiple Oracle and non-Oracle databases, and allows you to report, analyze and alert on the events collected. You also get the ability to report on user entitlement data and manage audit settings across multiple Oracle databases. It is a separately licensed product. None of these features are available as part of your EE license.

          Hope this helps.
          • 2. Re: audit vault vs auditing of access
            415289
            If so, what extra does auditvault give you? It looks like the reporting/alerting/etc...
            yes ,a GUI based product to setup auditing at database level and get alert,pdf report based on requirement.
            it consolidate data from all source Once consolidated, Oracle Audit Vault removes audit data from the source systems where the audit data was generated, simplifying the management of auditing across the enterprise

            http://www.oracle.com/technetwork/products/audit-vault/overview/index.html
            But if I just send the raw/free audit logs to splunk for alerting/reporting, it looks like I can still do my own reporting without adding an extra oracle package. Does that sound right?
            yes,
            • 3. Re: audit vault vs auditing of access
              706614
              Hi:

              The package DBMS_AUDIT_MGMT is already part of the Oracle database, whether you use Audit Vault or not. What Audit Vault does is integrate with it. DBMS_AUDIT_MGMT manages the audit trail that your database generates. It can delete audit records older than a certain date, for instance. If Audit Vault is being used, however, there's a handshake between it and DBMS_AUDIT_MGMT, so that DBMS_AUDIT_MGMT will not delete any audit records that have not already been collected by Audit Vault.