Overview of Audit Features

11-8 Oracle Fusion Middleware Application Security Guide For more information about OPSS, see Section 1.1, What is Oracle Platform Security Services? .

11.3.3 Audit Record Storage

As shown in Figure 11–1 , audit data can reside in two types of storage: ■ bus-stop files for intermediate storage of audit data. Each component instance writes to its own bus-stop. Bus-stop files are the default out-of-the-box storage mechanism for audit records: – For Java components, there is one bus-stop for each Oracle WebLogic Server instance. Audit records generated for all Java EE components running in a given Oracle WebLogic Server instance are stored in the same bus-stop. – For system components, there is a separate bus-stop for each component; thus, for example, each instance of Oracle Internet Directory has its own bus-stop. Bus-stop files are text-based and easy to query. For further details, see Section 11.3.1, Audit Architecture ■ permanent storage in a database; this is known as the audit store. If using a database, audit records generated by all components in all Oracle Fusion Middleware 11g instances in the domain are stored in the same store. You must use an audit store to utilize Oracle Business Intelligence Publisher reports. You can move from file-based storage to an audit store. This requires a specific configuration procedure. See Section 12.2.3, Configure a Database Audit Store for Java Components for details. Advantages of Using a Database Store Having the audit records in the bus-stop files has some practical limitations: ■ you cannot view domain-level audit data ■ reports cannot be run on Oracle BI Publisher Thus, there are certain advantages to using a database audit store: ■ You can use Oracle Business Intelligence Publisher for reporting. ■ The database store centralizes records from all components in the domain, whereas the bus-stop stores audit records on a per-instance basis. ■ performance may be improved compared to file-based storage For these reasons, Oracle recommends that customers switch to a database store for enhanced auditing capabilities.

11.3.4 Analytics

With Oracle Fusion Middleware 11g, you can utilize Oracle Business Intelligence as a full-featured tool for structured reporting. A large number of pre-defined reports are available, such as: ■ Users createddeleted ■ User transactions ■ Authentication and authorization failures ■ Policy violations Introduction to Oracle Fusion Middleware Audit Framework 11-9 With Oracle Business Intelligence: ■ You can select records based on criteria like username, date-time range, and so on. Note that Oracle Business Intelligence works with the database audit store only, and is not usable with bus-stop files. The pre-defined audit report types available with Oracle Business Intelligence include: ■ errors and exceptions ■ operational ■ user activity ■ authentication and authorization history ■ transaction history For further details, see Section C.2, Pre-built Audit Reports. You can also use the audit schema details to create custom audit reports as needed.