Audit Vault configuration

How to configure Audit vault in oracle 10g on RHEL 4.5?
thank you
Kushal

Audit Vault is NOT Database Vault. The link you provided is for the wrong product.
To the OP: The installation docs are here: http://docs.oracle.com.
Just search for the phrase "Audit Vault."

Similar Messages

"Oracle Audit Vault Configuration Assistant" failed

Hello everyone, I can across this issue while installing AV agent and wanted to know if any one can help with a quick solution. OS= Linux 5, agent_software= 10.2.3 and here is the error messages:
++**INFO: Configuration assistant "Oracle Audit Vault Agent One-Off Patches" succeeded**++
++**INFO: Command = oracle.av.common.AvcaCfgPlugIn /app/oracle/product/10.2.0/agent_home/bin/avca -s initialize_agent -agentname agentdevmdb1 -agentusr ${s_agentusr} -agentport 7016 -av AHS-SOASOV1-DEVM.ahs.state.vt.us:1521:av.ahs.state.vt.us -rmiport 3121 -jmsport 3300**++
++**Command = oracle.av.common.AvcaCfgPlugIn has failed**++
++**INFO: Configuration assistant "Oracle Audit Vault Configuration Assistant" failed**++
++**-----------------------------------------------------------------------------**++
++***** Starting OUICA *****++
++**Oracle Home set to /app/oracle/product/10.2.0/agent_home**++
++**Configuration directory is set to /app/oracle/product/10.2.0/agent_home/cfgtoollogs. All xml files under the directory will be processed**++
++**INFO: The "/app/oracle/product/10.2.0/agent_home/cfgtoollogs/configToolFailedCommands" script contains all commands that failed, were skipped or were cancelled. This file may be used to run these configuration assistants outside of OUI. Note that you may have to update this script with passwords (if any) before executing the same.**++
++**-----------------------------------------------------------------------------**++
++**INFO: Created a new file /app/oracle/product/10.2.0/agent_home/cfgtoollogs/configToolFailedCommands**++
++**INFO: Since the option is to overwrite the existing /app/oracle/product/10.2.0/agent_home/cfgtoollogs/configToolFailedCommands file, backing it up**++
++**INFO: The backed up file name is /app/oracle/product/10.2.0/agent_home/cfgtoollogs/configToolFailedCommands.bak**++
++**SEVERE: OUI-25031:Some of the configuration assistants failed. It is strongly recommended that you retry the configuration assistants at this time. Not successfully running any "Recommended" assistants means your system will not be correctly configured.**++
++**1. Check the Details panel on the Configuration Assistant Screen to see the errors resulting in the failures.**++
++**2. Fix the errors causing these failures.**++
++**3. Select the failed assistants and click the 'Retry' button to retry them.**++
++**INFO: User Selected: Yes/OK**++

Hi:
A log of everything the avca command is trying to do is kept in $ORACLE_HOME/av/log/avca.log. Please review that to see what could have caused the issue.

Failing 10.2.3.2 audit vault patch on AV Agent at AV Configuation Assistant

Hi,
Applying 10.2.3.2 audit vault patch on top of 10.2.3.0 Audit Vault Agent. Getting following error after 100% installation at the time of Audit Vault Configuation Assistant Components
Information from Installxxxxxx.log
OPatch succeeded.
INFO: Configuration assistant "Oracle Audit Vault Agent One-Off Patches" succeeded
INFO: Command = oracle.av.common.AvcaCfgPlugIn /oracle/app/oracle/product/10.2.3/av_1/bin/avca -s initialize_agent -agentname agent_hmrac2 -agentusr ${s_agentusr} -agentport 7016 -av HMCSPV0921.HIGHMARK.INTRA:1522:av.HIGHMARK.INTRA -rmiport 3121 -jmsport 3300
INFO: Configuration assistant "Oracle Audit Vault Configuration Assistant" succeeded
INFO: All the tools have been executed Successfully
INFO: The "/oracle/app/oracle/product/10.2.3/av_1/cfgtoollogs/configToolAllCommands" script contains all commands to be executed by the configuration assistants. This file may be used to run the configuration assistants outside of OUI. Note that you may have to update this script with passwords (if any) before executing the same.
WARNING:
The following configuration scripts need to be executed as the "root" user.
#!/bin/sh
#Root script to run
/oracle/app/oracle/product/10.2.3/av_1/root.sh
To execute the configuration scripts:
1. Open a terminal window
2. Log in as "root"
3. Run the scripts
4. Return to this window and click "OK" to continue
INFO:
*** End of Installation Page***
The installation of Oracle Audit Vault Agent 10g was successful.
WARNING: Do you really want to exit?
INFO: User Selected: Yes/OK
INFO: The OUICA command is launched from /oracle/app/oracle/product/10.2.3/av_1/oui/bin/ouica.sh.
Executed *"/oracle/app/oracle/product/10.2.3/av_1/cfgtoollogs/configToolAllCommands* which has following command and successful.
[oracle@HMCSPS02 oui]$ cat "/oracle/app/oracle/product/10.2.3/av_1/cfgtoollogs/configToolAllCommands"
# Copyright (c) 1999, 2009, Oracle. All rights reserved.
/oracle/app/oracle/product/10.2.3/av_1/bin/avca apply_patchset
[oracle@HMCSPS02 oui]$ echo $ORACLE_HOME
/oracle/app/oracle/product/10.2.3/av_1
[oracle@HMCSPS02 oui]$ sh /oracle/app/oracle/product/10.2.3/av_1/bin/avca apply_patchset
Deploying to standalone OC4J...
Restarting agent ...
Agent restarted successfully.
Retried component but again failed. Hence executed root.sh and clicked 'Next' button. then message got like 'Agent 10.2.3.2 Installation was successful but some of the components missing,skipped or cancelled which may be functioning properly.
has my patch upgrade to client was successful or what is the workaround ???
Any help on this would be appreciated...
Regards,
Manish

Sorry, it was my mistake.
Actually while upgradation to 10.2.3.2, my ORACLE_HOME was not set to AV Agent HOME (instead it was set for AV Server HOME). That is why at the end script was unable to run from respective HOME.
Conclusion: Make sure to set ORACLE_HOME to AV Agent HOME before applying to 10.2.3.2 patchset to AV Agent. (also Valid for all Oracle Patchset Installation)
thanks for your support and reply.
Regards,
Manish

Oracle Audit Vault Server & Agent Installation Error.

Hi,
I am new to Audit vault. When I install Audit Vault on Windows 2008 R2 it throws an error after installing 99%. Kindly help me to resolve.
OS Version : Windows 2008 R2
Oracle Audit Vault Version: 10.2.3.2
Error:
Audit Vault Server:
INFO: Configuration assistant "Oracle Audit Vault Configuration Assistant" failed
*** Starting OUICA ***
Oracle Home set to C:\oracle\product\10.2.3\av_1
Configuration directory is set to C:\oracle\product\10.2.3\av_1\cfgtoollogs. All xml files under the directory will be processed
INFO: The "C:\oracle\product\10.2.3\av_1\cfgtoollogs\configToolFailedCommands" script contains all commands that failed, were skipped or were cancelled. This file may be used to run these configuration assistants outside of OUI. Note that you may have to update this script with passwords (if any) before executing the same.
INFO: Created a new file C:\oracle\product\10.2.3\av_1\cfgtoollogs\configToolFailedCommands
INFO: Since the option is to overwrite the existing C:\oracle\product\10.2.3\av_1\cfgtoollogs\configToolFailedCommands file, backing it up
INFO: The backed up file name is C:\oracle\product\10.2.3\av_1\cfgtoollogs\configToolFailedCommands.bak
SEVERE: OUI-25031:Some of the configuration assistants failed. It is strongly recommended that you retry the configuration assistants at this time. Not successfully running any "Recommended" assistants means your system will not be correctly configured.
1. Check the Details panel on the Configuration Assistant Screen to see the errors resulting in the failures.
2. Fix the errors causing these failures.
3. Select the failed assistants and click the 'Retry' button to retry them.
xception: VariableNotFoundException
Query Exception Class: class oracle.sysman.oii.oiil.OiilQu
Also while installing Collection agent, it throws the error while executing runInstaller.
OS Version : AIX 6.1
Oracle Audit Vault Agent Version: 10.2.3.2
Audit Agent:
bash-3.2$ ./runInstaller
Starting Oracle Universal Installer...
Checking installer requirements...
Checking operating system version: must be 5200 or 5300
Failed <<<<
Exiting Oracle Universal Installer, log for this session can be found at /tmp/OraInstall2011-05-12_05-11-03PM/installActions2011-05-12_05-11-03PM.log
*/tmp/OraInstall2011-05-12_05-15-39PM>*cat installActions2011-05-12_05-15-39PM.log
Using paramFile: /finacle/avagent/aix_5l64/install/oraparam.ini
Checking installer requirements...
Checking operating system version: must be 5200 or 5300
Failed <<<<
Exiting Oracle Universal Installer, log for this session can be found at /tmp/OraInstall2011-05-12_05-15-39PM/installActions2011-05-12_05-15-39PM.log
Thanks & Regards,
Mithra.
Edited by: 864048 on Jun 7, 2011 2:57 AM

Hi ,
Please try the following:
Execute the setup in cmd with -ignoreSysPrereqs option.
Thank you.

Audit Vault Agent sizing (harware requirements)

Hi, I need to provide my customer an estimation of the disk space needed for the Audit Vault Agent, size of archivelog files of the source database so that REDO collector could work without problems, and other demands of source side (audit vault agent) versus audit vault server?
Is there any document like "audit vault configuration best practice" related with hardware requirements (size of disk space, size of archivelog files, aud records...)???
Thank you all in advance..
Edited by: user10600747 on Jan 4, 2011 5:21 AM

Hi Elmin,
I was doing implementation on Audit Vault with around twenty source databases. These were hardware requirements:
Server:
HP-UX 11.31, 2 CPUs, 16 GB RAM, 1TB of storage for database
Agent (these are from the installation guide):
- At least 512 MB of available physical memory (RAM)
- Swap space of 1024 MB or twice the size of RAM
- 400 MB of disk space in the /tmp directory
- 1.6 GB of disk space for the Oracle Audit Vault collection agent software (but if you apply patches you need actually more than this).
Regards,
Sve

Installation audit vault agent with RAC configuration

Hi at all,
I have a question about the installation of the agent on the RAC configuration. Where must I install the Audit vault agent, on all RAC nodes or is there a properly configuration?
Thanks
Vincenzo

By default when you install the agent on any single node the installation recognizes that it is a cluster and presents you with a list of available nodes from which to select.
With a RAC cluster you have one database and multiple instances. All instances will write to one, and only one AUD$ and FGA_LOG$ table so if you are using database auditing one node will suffice. Which node that is though depends on knowing which node is up at any one time so you could potentially choose a node that is dropped from the cluster or is down for patching and maintenance while the cluster is still running. With respect to REDO collection each node has its own redo thread so you definitely need to be collecting from every node.
Audit Vault has not been out long enough that I can tell you from experience what might be defined as "best practice" and often what we really need to study is "worst practice" to know what not to do. But in the case of RAC my instinct would be to first determine the collection type(s) and then decide. Erring on the side of collecting from all nodes makes a lot of sense.

Error while trying to start Audit Collector on the Audit Vault Server 10g

Hi,
We are trying to build a demo environment for testing Oracle Audit Vault 10g but we are having some trouble.
Our environment is like this: Oracle Audit Vault Server is installed on Windows Server 2003 SP2, while the Audit Vault Agent is installed on an Oracle 10g Release 2 database which resided on Windows server 2003 SP1. This two Windows Server machines are both installed as virtual machines.
We have successfully created the Agent and the Collector on Audit Vault Server and the Agent starts successfully while when we try to start the collector we get an error which says " Http Communication error: Http Communication error: 500" and the collector does not start.
We are new to the Audit Vault Software so we would really appreciate some help on how to resolve this issue because we have got stuck here and can not go on with our work.
Thanks in advance for your time
Best regards
Engrid

Hi,
Thanks again for all of your replies but now we are getting another error with the OSAUD collector. We are able to add the collector successfully by using the avorcldb all_collector command.
Source database is 10g R2 (10.2.1) and we configured it for collecting the audit records in the OS audit trail by using the following statement: ALTER SYSTEM SET AUDIT_TRAIL=OS SCOPE=SPFILE;, and the SHOW PARAMETER AUDIT command returns the following values :
NAME TYPE VALUE
audit_file_dest string C:\ORACLE\PRODUCT\10.2.0\ADMIN
\<db_name>\ADUMP
audit_sys_operations boolean TRUE
audit_trail string OS
We don't know if the values set for the audit_file_dest is correct but after we start working on the database and execute some statements Oracle is not creating any files on this destinations while for the same statements when the Audit_trail=DB, EXTENDED the audit values for these statements are written in the appropriate table.
So we do not know if this is the cause but when we try to start the OSAUD collector defined on the Audit Vault Server it can not start and gives us the follwing error: "could not start collector OSAUD_Collector for source <source name>, directory access error for C:\ORACLE\PRODUCT\10.2.0\ADMIN\<db_name>\ADUMP".
Sorry for the message being so long but we really need some help with this issue.
thanks in advance.
Engrid

Audit Vault and DB Firewall Design

I have and application (JAVA Based) connected to the database 11g using JDBC,
I am going to implement Audit Vault and DB firewall R12 for three reasons:
1. monitoring the traffic
2. blocking un wanted SQL statements.
3. blocking un wanted IPs/Users
Our two Physcial servers that will be used for Audit Vault and DB Firewalls contain two NIC each.
My Questions:
1. How to put these two servers in our network to be able to mointor as well block traffic, we don't need to change anything to our exisiting network configuration.
2. How to DB Firewall will block unwanted incomming traffic from the JAVA application to our database.
please any usefull documents, links, ideas, network design
I tried official Oracle Document, it is useless

hi,
1. if you plan to block sql using the firewall you will need 3 NICs in the firewall appliance since apart from the management interface you will need to setup a bridge (with 2 NICs) to physically route the traffic through the firewall, this also requires you to patch the appliance properly inside your datacenter between the protected database and the client or middle tier servers, so you can't do this w/o changing anything in your nw configuration.
2. you will need to compile a whitelist based on what your trusted applications are doing normally, this is an iterative process, then the firewall will be able to block sql not in the whitelist (replace it with something like select 1 from dual), since the only physical network path from the java clients to the secured target db goes via the bridge
Comment: so if you have a chance: pull one NIC out of the AV server (it only needs 1) and plug it into the firewall appliance.
greetings,
Harm ten Napel

REG:Oracle Audit Vault Agent Installation fails at the last step .

Hi ,
I am installing Audit vault agent 10.3 and it is failing at the last on solarisis 10 sparc 64 bit .
The error is
OUI-25031:Some of the configuration assistants failed/cancelled. It is strongly recommended that you retry the configuration assistants at this time. Not successfully running any "Recommended" assistants means your system will not be correctly configured.
I have tried the Doc ID 1058184.1 but it fails at the end saying cannot update av.properties , If we create the the directories manually and create the av.properties file then the agent will start but it is not stopping until you kill the agent .
Moreover if i am continuing with this agent after registering the collectors i am not able to start them as i am facing the http 404 error .
So i think i need to install the audit agent successfully first .
can anybody help me please as we are on client side and it is critical deliverable .
Regards
Edited by: 836778 on May 1, 2012 4:52 PM
Edited by: 836778 on May 1, 2012 4:59 PM

In case you're still dealing with this issue:
I hit this problem when the OS user I was installing with was not in the proper OS group. I don't have the documentation in front of me right now, but make sure your user is in the DBA and/or OINSTALL group.

If changing the hostname of the Audit Vault Server version 12.1.2 please wait until the system reboots automatically.

Hi everyone
when changing the hostname of an AV Server in the newly released version 12.1.2, it can take up to 10 minutes from the time a user click ok on the pop-up message "Are you sure you want to reboot the Audit Vault Server for the changes to take affect" to the system actually shutting down for the reboot. The machine must not be manually rebooted as this will cause errors.
Some background information was provided by one of Oracle's developers for this product:
AVDF 12.1.2.0.0 uses Oracle Grid in Restart Configuration. This is needed to leverage the ASM infrastructure to create diskgroups etc. So, when a hostname of a system is changed, the entire Grid stack needs to be re-configured to work under the new hostname. This re-configuration is needed because Grid creates a lot of directories with the hostname in them and when the hostname is changed, it tries to look for critical configuration files under this new "hostname" and of course, they would not be present. Hence, when we change the hostname, an entire re-configuration of the Clusterware is attempted, at which point a new set of directories with the new hostname will be created by the Grid software.
This reconfiguration operation may take a few minutes to several minutes depending on the hardware/resource specs. This is because re-configuration of the Clusterware stack is a heavy-weight operation and takes time (It needs to shutdown all the CRS services and re-configure them and bring them back up). Hence, the long duration it takes before re-boot. You *MUST NOT* reboot it manually before the system automatically reboots -- otherwise the re-configuration operation will only be half-done. The chances of this re-configuration operation failing is very, very minimal (based on our tests). So, given enough time it _WILL_ complete eventually and the system _WILL_ automatically reboot. You just need to wait for it to happen.
Hope this will avoid any issues,
greetings,
Harm ten Napel

I may add it was my personal impatience that lead to this discovery: I was re-imaging my virtualbox install with the new 12.1.2 version (for testing purposes) and I want my AV server to be called 'auditvault', when it appeared nothing was happening (but there was) I rebooted the system manually with said results...

Audit vault 10.3 - role 'DV_STREAMS_ADMIN' does not exist

hi,
in the audit-vault-admin guide 10.3, step 2.3.1 - 8:
If you plan to add the REDO collect to your source database, then grant the Oracle source database user account the DV_STREAMS_ADMIN role.
The DV_STREAMS_ADMIN role enables the management of Oracle Streams processes to be tightly controlled by Database Vault, but does not change or restrict the way an administrator would normally configure Oracle Streams.
For example:
SQL> GRANT DV_SECANALYST TO srcuser_ora;
I got this error when grant that role to srcuser:
SQL> grant DV_STREAMS_ADMIN to srcuser1;
grant DV_STREAMS_ADMIN to srcuser1
ERROR at line 1:
ORA-01919: role 'DV_STREAMS_ADMIN' does not exist
Please support !

Steps 6 and 7 mention DB Vault
You can raise an SR with Oracle for a documentation change.
If the source database has Oracle Database Vault installed, then log in as a user who has been granted the DV_OWNER (Database Vault Owner) role and add the source database user to the Oracle Data Dictionary realm.
For example:
SQL> CONNECT preston
Enter password: password
Connected.
SQL> EXEC DBMS_MACADM.ADD_AUTH_TO_REALM('Oracle Data Dictionary', 'SRCUSER_ORA', null, dbms_macutl.g_realm_auth_participant);
SQL> COMMIT;
If the source database has Oracle Database Vault installed, then grant the Oracle source database user account the DV_SECANALYST role.
The DV_SECANALYST role enables the user to run Oracle Database Vault reports and monitor Oracle Database Vault. This role also enables the Oracle source database user to collect Database Vault audit trail data from the source database.
For example:
SQL> GRANT DV_SECANALYST TO srcuser_ora;

Audit Vault Database Firewall 12.1 Repository Load Log Location

Can anyone tell me where, if any place, that Oracle writes a log for when it is moving data collected by the Database Firewall into the Audit Vault repository? Based on "holes" in the data, it appears that the collection and load from the database firewall mysteriously stops but will collect normally once the enforcement point is recycled.
Environment: Audit Vault Database Firewall 12.1.0.2
Thank you.

Hi!
Installation configuration depends on what you need: the only mandatory component is Server, other 2 are optional.
R, Natalia

Audit Vault & Apex - ANONYMOUS user recorded rather than Apex end user

Hi,
We have Audit Vault 10.2.3 & Apex 3.2
Audit Vault stores the name of the database user when a table is updated through SQL*Plus etc as expected.
Problem is through Apex and insert to db table using simple form on table the user ANONYMOUS is recorded.
We need to have the actual end user logged into Application Express.
Is there anyway of configuring Audit Vault or Apex to use/pass v('APP_USER')? Does something need to be done in Apex to set a session?
Running the below shows 2 ANONYMOUS users and no APEX_PUBLIC_USER or Apex end user.
select username, count(*)
from v$session
group by username;
Any advice & guidance would be great - thanks in advance.

Having posted the same question on the Apex forum I received the following response and have been able to use CLIENT_ID to return the apex user and session details. Thought it best to post here too incase others search for the same information.
Since Audit Vault relies on native database auditing it can only collect information that is recorded by the "source" database in its audit trail. APEX populates the CLIENT_INFO field of the connection with the APP_USER. However, CLIENT_INFO is not recorded in the audit trail. Instead the CLIENT_ID is captured. APEX records a composite value in this field. The value is formatted as "APP_USER:SESSION_ID". This value should be recorded in the audit trail and consequently sent to Audit Vault. Audit Vault's reports should be able to display this field, and you can filter on it to get the information you need.

Audit Vault Agent account creation

Hi, I just installed the AV Server and about to configure the agents. The Oracle AV agent installation document suggests creating AV agent user by logging into the database as AVAdmin user(Section 3.1.1.c). However, the user creation fails with ORA-01031: insufficient privileges. Other database accounts (sys, system..etc..) are locked. Any clue how to resolve this ussue?
Thanks in advance.

1. Where in the OP's post do you see the word Windows?
2. Your advice is totally irresponsible in all respects. The proper way to administer the product is in compliance with the documentation. There is no rational reason to do what you suggest.
Were you an employee of mine, working on an audit vault project, you'd be terminated tomorrow morning when you walked through the door.
Again: your advice is misguided and totally irresponsible.

Collecting File System Audit logs with Audit Vault

Can Audit Vault collect multi-platform OS file system audit records and logs as well as network component logs from switchs and routers in addition to DB audit records to satisify ICD 503/NIST/DOD auditing requirements? If not could it be configured to do so?
thanks

it only collect data from databases which may be oracle or non-oracle.
Oracle Audit Vault automates the consolidation and monitoring of audit data from Oracle and non-Oracle databases.
http://www.oracle.com/technetwork/products/audit-vault/overview/index.html

Audit Vault configuration

Similar Messages

Maybe you are looking for