From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Mathew Brown" Subject: Re: Using Linux Audit to Audit / Log All Oracle Related Activity Date: Sat, 22 Dec 2007 07:06:05 -0800 Message-ID: <1198335965.30524.1227904519@webmail.messagingengine.com> References: <1197897678.9239.1226981649@webmail.messagingengine.com> <200712170836.39984.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <200712170836.39984.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb , linux-audit@redhat.com List-Id: linux-audit@redhat.com On Mon, 17 Dec 2007 08:36:39 -0500, "Steve Grubb" said: > On Monday 17 December 2007 08:21:18 Mathew Brown wrote: > > I was wondering if the Linux Audit Daemon could be used to address the > > issue of Oracle auditing. Has anyone investigated this possibility? > > What would you like to know about Oracle? Hi Steve, Thanks for your reply. What I was interested in is auditing all queries and modifications to the database. I'm looking at it from a compliance perspective (and trying to minimize the power of the sysdba account). I've looked at alternative solutions such as the Oracle Vault which enables logging but it's too CPU intensive. I thought that the Linux audit daemon might provide me with similar functionality but have the added benefit of not requiring writes locally (send to remove syslog for example). > > Ideally, I would like to audit all network (listener) as well as all > > local access (an Oracle DBA running sqlplus directly on the machine). > > You mean accepting the connection? I think you can get all accepts that > Oracle > would issue, but I don't know if you will get the remote address in the > logs. > You also cannot tell it that you want accepts of a specific socket. > > You might want to spend some time looking at Oracle from strace. That is > about > the view of the world from the Linux Audit System. If you can't find > anything > worth logging from that, it most likely means that you'd want Oracle to > be > patched to send meaningful events to the audit system. > > -Steve -- Mathew Brown mathewbrown@fastmail.fm -- http://www.fastmail.fm - Faster than the air-speed velocity of an unladen european swallow