This discussion is archived
3 Replies Latest reply: Oct 3, 2012 6:34 AM by 706614 RSS

audit vault vs auditing of access

964657 Newbie
Currently Being Moderated
Can anyone help clarifying what is included in 11g and what is an extra cost? It sounds like AuditVault is an add-on product/cost?

But what about the audit settings I see here with DBMS_AUDIT_MGMT:

http://www.oracle-base.com/articles/11g/auditing-enhancements-11gr2.php

http://docs.oracle.com/cd/E14072_01/network.112/e10574/auditing.htm

It looks like any enterprise license already has the right to create logs with DBMS_AUDIT_MGMT for free/included. Is that correct? If so, what extra does auditvault give you? It looks like the reporting/alerting/etc...

But if I just send the raw/free audit logs to splunk for alerting/reporting, it looks like I can still do my own reporting without adding an extra oracle package. Does that sound right?

Thank you!
  • 1. Re: audit vault vs auditing of access
    706614 Explorer
    Currently Being Moderated
    You are correct in surmising that DBMS_AUDIT_MGMT is a database feature already included as part of the Enterprise Edition license for your database. It allows you to manage the audit trail generated by our database - how long to keep, when to delete, etc.

    Audit Vault, on the other hand, is a heterogeneous solution aimed at assisting with regulatory compliance. It consolidates audit trails from multiple Oracle and non-Oracle databases, and allows you to report, analyze and alert on the events collected. You also get the ability to report on user entitlement data and manage audit settings across multiple Oracle databases. It is a separately licensed product. None of these features are available as part of your EE license.

    Hope this helps.
  • 2. Re: audit vault vs auditing of access
    KuljeetPalSingh Guru
    Currently Being Moderated
    If so, what extra does auditvault give you? It looks like the reporting/alerting/etc...
    yes ,a GUI based product to setup auditing at database level and get alert,pdf report based on requirement.
    it consolidate data from all source Once consolidated, Oracle Audit Vault removes audit data from the source systems where the audit data was generated, simplifying the management of auditing across the enterprise

    http://www.oracle.com/technetwork/products/audit-vault/overview/index.html
    But if I just send the raw/free audit logs to splunk for alerting/reporting, it looks like I can still do my own reporting without adding an extra oracle package. Does that sound right?
    yes,
  • 3. Re: audit vault vs auditing of access
    706614 Explorer
    Currently Being Moderated
    Hi:

    The package DBMS_AUDIT_MGMT is already part of the Oracle database, whether you use Audit Vault or not. What Audit Vault does is integrate with it. DBMS_AUDIT_MGMT manages the audit trail that your database generates. It can delete audit records older than a certain date, for instance. If Audit Vault is being used, however, there's a handshake between it and DBMS_AUDIT_MGMT, so that DBMS_AUDIT_MGMT will not delete any audit records that have not already been collected by Audit Vault.

Legend

  • Correct Answers - 10 points
  • Helpful Answers - 5 points