{"id":1466,"date":"2009-01-27T12:00:00","date_gmt":"2009-01-27T12:00:00","guid":{"rendered":"http:\/\/orcldoug.com\/blog\/?p=1466"},"modified":"2009-01-27T12:00:00","modified_gmt":"2009-01-27T12:00:00","slug":"adding-a-new-oracle-host-to-audit-vault","status":"publish","type":"post","link":"http:\/\/orcldoug.com\/blog\/2009\/01\/27\/adding-a-new-oracle-host-to-audit-vault\/","title":{"rendered":"Adding a new Oracle host to Audit Vault"},"content":{"rendered":"

This one’s been outstanding for a while. After my presentation on Audit Vault at UKOUG<\/a>, the AV Product Manager Tammy Bednar sent me a couple of corrections to the configuration section. Rather than just amend the slides, I was keen to wait until I had another chance to configure a new source and collectors, which finally arrived last week. <\/p>\n

Looking at my slides made me laugh and then cringe. Two step 4s? No setup of the source at the end? Mmm, not very good and an almost inevitable consequence of updating my slides too late in the day.<\/p>\n

I’ve corrected the slides and uploaded them to the UKOUG website and, for those who might arrive via a Google search, these are the steps for Audit Vault 10.2.3.1 (but probably work just as well for 10.2.3). I would normally suggest you ignore quick cook-book instructions like this and read the documentation. It’s probably still the best approach, but I don’t think I’m the only person who finds the current version of the docs a little opaque so a reduction might be useful here. I’m sure I’ll be referring back to it 😉<\/p>\n

[AV Server] is your Audit Vault Server host – one of these.
[Agent] is the server where your the databases to be audited are hosted – probably quite a few of these.
[Source Database] is one of the many database instances running on the Agent server(s) that you want to collect audit information from.<\/p>\n

Where you need to supply your own values, these are shown in italics. I’ve assumed here that I want to audit a PROD1 database on the prod host.<\/p>\n

1. [AV Server] Add the new agent.<\/p>\n

avca add_agent -agentname agent_prod<\/em> -agenthost prod<\/em>\n\nAVCA started\nAdding agent...\nEnter agent user name: agent_prod<\/em>\nEnter agent user password: GHt5_5dhY<\/em>\nRe-enter agent user password: GHt5_5dhY<\/em>\nAgent added successfully. <\/pre>\n
2. [Agent] Install the Agent software. You’ll need the agent details that you added to the AV Server in step 1.<\/p>\n
3. [Source Database] Create an account in the database that you want to collect audit data from and then assign the correct privileges to it. (Note that you only need to run the last command if you’ll be using the Redo Collector) <\/p>\n
create user avsrc_prod<\/em> identified by avpwd1<\/em>;\n@\/oem\/oracle\/product\/av\/scripts\/streams\/source\/zarsspriv.sql avsrc_prod<\/em> setup;\n@\/oem\/oracle\/product\/av\/scripts\/streams\/source\/zarsspriv.sql avsrc_prod<\/em> redo_coll;<\/pre>\n
4. [AV Server] Verify that source database configuration is ok. <\/p>\n
avorcldb verify -src prod:1521:PROD1.WORLD<\/em> -colltype ALL<\/pre>\n
5. [AV Server] Add Source<\/p>\n
avorcldb add_source -src prod:1521:PROD1.WORLD<\/em> -desc PROD1<\/em> -agentname agent_prod<\/em><\/pre>\n
6. [AV Server] Add Collectors. There are three collector types you could add. Here I’m just adding the DB_AUD and OS_AUD collectors.<\/p>\n
avorcldb add_collector -srcname PROD1.WORLD<\/em> -agentname agent_prod<\/em> -colltype OSAUD \n         -orclhome \/oem\/oracle\/product\/10.2.0.4<\/em> -collname PROD1_OSAUD<\/em>\n\navorcldb add_collector -srcname PROD1.WORLD<\/em> -agentname agent_prod<\/em> -colltype DBAUD\n         -collname PROD1_DBAUD<\/em><\/pre>\n
7. [Agent] Complete Source configuration. This sets up tnsnames.ora and Wallet entries on the Agent machine.<\/p>\n
avorcldb setup -srcname PROD1.WORLD<\/em> -srcusr -wpwd GHt5_5dhY<\/em><\/pre>\n
8. [AV Server] Start Agent<\/p>\n
avctl start_agent -agentname agent_prod<\/em><\/pre>\n
9. [AV Server] Start Collectors<\/p>\n
avctl start_collector -collname PROD1_OSAUD<\/em> -srcname PROD1.WORLD<\/em>\navctl start_collector -collname PROD1_DBAUD<\/em> -srcname PROD1.WORLD<\/em><\/pre>\n
\nThanks again to Tammy for her help.<\/p>\n","protected":false},"excerpt":{"rendered":"
This one’s been outstanding for a while. After my presentation on Audit Vault at UKOUG, the AV Product Manager Tammy Bednar sent me a couple of corrections to the configuration section. Rather than just amend the slides, I was keen to wait until I had another chance to configure a new source and collectors, which… Continue reading Adding a new Oracle host to Audit Vault<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-1466","post","type-post","status-publish","format-standard","hentry","category-uncategorized","entry"],"jetpack_featured_media_url":"","jetpack-related-posts":[{"id":1461,"url":"http:\/\/orcldoug.com\/blog\/2008\/12\/10\/ukoug-days-4-and-5\/","url_meta":{"origin":1466,"position":0},"title":"UKOUG Days 4 and 5","date":"December 10, 2008","format":false,"excerpt":"I woke up on the last full day of the conference with a couple of small things left to do on my second presentation. I was confident, though, because it was just a bit of tidying up. Mmmm, that turned out be a mistake \ud83d\ude09First, though was Graham Wood's \"Cool\u2026","rel":"","context":"With 3 comments","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1408,"url":"http:\/\/orcldoug.com\/blog\/2008\/05\/19\/conference-activities\/","url_meta":{"origin":1466,"position":1},"title":"Conference Activities","date":"May 19, 2008","format":false,"excerpt":"I should get to bed soon because I have to be up at 4am for my flight to Stockholm (via Copenhagen). Tomorrow (and on Wednesday) I'll be presenting at the Swedish and Finnish Oracle User Groups joint 20th Anniversary event on the good ship (I hope) m\/s Silja Serenade. The\u2026","rel":"","context":"With 2 comments","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1626,"url":"http:\/\/orcldoug.com\/blog\/2011\/02\/21\/graham-woods-hidden-features-presentation\/","url_meta":{"origin":1466,"position":2},"title":"Graham Wood’s Hidden Features Presentation","date":"February 21, 2011","format":false,"excerpt":"Just a super-quick post to highlight the availability of Graham Wood's Hidden Features presentation that I enjoyed at UKOUG 2010. I felt it was one that lots of people could pick up one or two tips or reminders from, just from the slides, but couldn't track it down. Graham's been\u2026","rel":"","context":"With 2 comments","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1658,"url":"http:\/\/orcldoug.com\/blog\/2011\/11\/07\/upcoming-ukoug-conference\/","url_meta":{"origin":1466,"position":3},"title":"Upcoming UKOUG Conference","date":"November 7, 2011","format":false,"excerpt":"I always look forward to this time of year as the annual UKOUG conference in Birmingham approaches but this year I think I'm looking forward to it more than ever.As I'll have delivered both of my own presentations at previous events my slides will be done before I arrive and\u2026","rel":"","context":"With 8 comments","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":1460,"url":"http:\/\/orcldoug.com\/blog\/2008\/12\/05\/ukoug-day-3\/","url_meta":{"origin":1466,"position":4},"title":"UKOUG Day 3","date":"December 5, 2008","format":false,"excerpt":"After more work on the presentation and some very strange sleeping hours thanks to the raucuous ranks on Broad Street, it was time for the first of my presentations. But before that I wanted to attend JB's \"Proactive Detection of Oracle Performance Events using Adaptive Thresholds\" (skipped), the always entertaining\u2026","rel":"","context":"With 14 comments","img":{"alt_text":"","src":"\/serendipity\/uploads\/lion.jpg","width":350,"height":200},"classes":[]},{"id":1407,"url":"http:\/\/orcldoug.com\/blog\/2008\/04\/30\/oug-scotland-dba-sig\/","url_meta":{"origin":1466,"position":5},"title":"OUG Scotland DBA SIG","date":"April 30, 2008","format":false,"excerpt":"An enjoyable day, but it flew by. Having not had much sleep last night through worrying about the first time I was giving this particular presentation, I'm glad I was able to present in the second slot of the day because I knew I'd be flagging later on. The most\u2026","rel":"","context":"With 2 comments","img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"_links":{"self":[{"href":"http:\/\/orcldoug.com\/blog\/wp-json\/wp\/v2\/posts\/1466","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/orcldoug.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/orcldoug.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/orcldoug.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/orcldoug.com\/blog\/wp-json\/wp\/v2\/comments?post=1466"}],"version-history":[{"count":0,"href":"http:\/\/orcldoug.com\/blog\/wp-json\/wp\/v2\/posts\/1466\/revisions"}],"wp:attachment":[{"href":"http:\/\/orcldoug.com\/blog\/wp-json\/wp\/v2\/media?parent=1466"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/orcldoug.com\/blog\/wp-json\/wp\/v2\/categories?post=1466"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/orcldoug.com\/blog\/wp-json\/wp\/v2\/tags?post=1466"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}