This one’s been outstanding for a while. After my presentation on Audit Vault at UKOUG, the AV Product Manager Tammy Bednar sent me a couple of corrections to the configuration section. Rather than just amend the slides, I was keen to wait until I had another chance to configure a new source and collectors, which finally arrived last week.
Looking at my slides made me laugh and then cringe. Two step 4s? No setup of the source at the end? Mmm, not very good and an almost inevitable consequence of updating my slides too late in the day.
I’ve corrected the slides and uploaded them to the UKOUG website and, for those who might arrive via a Google search, these are the steps for Audit Vault 10.2.3.1 (but probably work just as well for 10.2.3). I would normally suggest you ignore quick cook-book instructions like this and read the documentation. It’s probably still the best approach, but I don’t think I’m the only person who finds the current version of the docs a little opaque so a reduction might be useful here. I’m sure I’ll be referring back to it 😉
[AV Server] is your Audit Vault Server host – one of these.
[Agent] is the server where your the databases to be audited are hosted – probably quite a few of these.
[Source Database] is one of the many database instances running on the Agent server(s) that you want to collect audit information from.
Where you need to supply your own values, these are shown in italics. I’ve assumed here that I want to audit a PROD1 database on the prod host.
1. [AV Server] Add the new agent.
avca add_agent -agentname agent_prod -agenthost prod AVCA started Adding agent... Enter agent user name: agent_prod Enter agent user password: GHt5_5dhY Re-enter agent user password: GHt5_5dhY Agent added successfully.
2. [Agent] Install the Agent software. You’ll need the agent details that you added to the AV Server in step 1.
3. [Source Database] Create an account in the database that you want to collect audit data from and then assign the correct privileges to it. (Note that you only need to run the last command if you’ll be using the Redo Collector)
create user avsrc_prod identified by avpwd1; @/oem/oracle/product/av/scripts/streams/source/zarsspriv.sql avsrc_prod setup; @/oem/oracle/product/av/scripts/streams/source/zarsspriv.sql avsrc_prod redo_coll;
4. [AV Server] Verify that source database configuration is ok.
avorcldb verify -src prod:1521:PROD1.WORLD -colltype ALL
5. [AV Server] Add Source
avorcldb add_source -src prod:1521:PROD1.WORLD -desc PROD1 -agentname agent_prod
6. [AV Server] Add Collectors. There are three collector types you could add. Here I’m just adding the DB_AUD and OS_AUD collectors.
avorcldb add_collector -srcname PROD1.WORLD -agentname agent_prod -colltype OSAUD
-orclhome /oem/oracle/product/10.2.0.4 -collname PROD1_OSAUD
avorcldb add_collector -srcname PROD1.WORLD -agentname agent_prod -colltype DBAUD
-collname PROD1_DBAUD
7. [Agent] Complete Source configuration. This sets up tnsnames.ora and Wallet entries on the Agent machine.
avorcldb setup -srcname PROD1.WORLD -srcusr -wpwd GHt5_5dhY
8. [AV Server] Start Agent
avctl start_agent -agentname agent_prod
9. [AV Server] Start Collectors
avctl start_collector -collname PROD1_OSAUD -srcname PROD1.WORLD avctl start_collector -collname PROD1_DBAUD -srcname PROD1.WORLD
Thanks again to Tammy for her help.