Audit Administration Tasks Oracle Fusion Middleware Online Documentation Library

12-6 Oracle Fusion Middleware Application Security Guide 8. Check for errors and exceptions in the server logs ■ Check DOMAIN_HOMEjrfServer_admin.out ■ Check DOMAIN_HOMEserversSERVER_NAMElogs.

12.2.3.3 Deconfigure the Audit Store

Since a database is the recommended store for audit records, switching from database to file mode is discouraged. However, Section 12.3.4, Manage Audit Policies Manually discusses a property called the audit.repositoryType whose value can be set to File to switch to file storage. When you switch from database to file, events that were collected in the database are not transferred back to the file system. If this switch is temporary, then the audit events collected in the file are automatically pushed to database when you switch to database store again.

12.2.4 Configure a Database Audit Store for System Components

Oracle Process Manager and Notification Server OPMN manages several system components running in Oracle WebLogic Server. For these components, the mechanism through which the audit events are pushed from local bus-stop files to the database audit store is handled by OPMN. You must execute the following steps in every instance of the component to configure an audit store:

1. Open the opmn.xml file, which resides in

ORACLE_INSTANCEconfigOPMNopmnopmn.xml

2. Locate the rmd-definitions element, which looks like this:

rmd-definitions rmd name=AuditLoader interval=15 Note: You cannot use Fusion Middleware Control or WLST to switch from database to file mode; this requires manual configuration as explained in Section 12.3.4, Manage Audit Policies Manually . Note: If your system component runs in a clustered deployment, you must configure the audit store at each instance of the component so that all instances push out records to the store. Note: These steps configure the audit store for system components only. Separate steps are needed to configure the audit store for Java components. See Section 12.2.3, Configure a Database Audit Store for Java Components . By configuring the same database to store audit records for Java components and system components, you can ensure that reports for both types of components can be viewed together. Configuring and Managing Auditing 12-7 conditional [CDATA[{time}=00:00]] conditional action value=exec ORACLE_HOMEjdkbinjava -classpath COMMON_COMPONENTS_HOMEmodulesoracle.osdt_11.1.1osdt_cert.jar: COMMON_COMPONENTS_HOMEmodulesoracle.osdt_11.1.1osdt_core.jar: ORACLE_HOMEjdbclibojdbc5.jar: COMMON_COMPONENTS_HOMEmodulesoracle.iau_11.1.1fmw_audit.jar: COMMON_COMPONENTS_HOMEmodulesoracle.pki_11.1.1oraclepki.jar -Doracle.home=ORACLE_HOME -Doracle.instance=ORACLE_INSTANCE -Dauditloader.jdbcString=jdbc:oracle:thin:host:port:sid -Dauditloader.username=username oracle.security.audit.ajl.loader.StandaloneAuditLoader exception value=exec binecho PERIODICAL CALL For Audit Loader FAILED rmd rmd-definitions 3. Replace the existing RMD definition for audit loader; you need to modify only these values: ■ jdbcString - this is the database JDBC connection string; change this from the default string to a valid connection string. ■ username ■ interval - this is the interval in seconds at which audit records are pushed from the component’s bus-stop file to the audit store. By default the interval value is set very high 31536000 seconds so that the audit loader is effectively disabled. Change this to a reasonable interval such as 15 seconds. 4. Save and exit the file. 5. Ensure that ORACLE_HOME, ORACLE_INSTANCE , and COMMON_COMPONENTS_ HOME are defined. For example: ORACLE_HOME = u01oracleas11_oh ORACLE_INSTANCE = u01oracleinstancesinstance COMMON_COMPONENTS_HOME = MW_HOMEoracle_common 6. Populate the audit store password in the secret store. This is the password that you have specified when creating the audit schema in RCU: ORACLE_HOMEjdkbinjava -classpath COMMON_COMPONENTS_HOMEmodulesoracle.osdt_11.1.1osdt_cert.jar: COMMON_COMPONENTS_HOMEmodulesoracle.osdt_11.1.1osdt_core.jar: ORACLE_HOMEjdbclibojdbc5.jar: COMMON_COMPONENTS_HOMEmodulesoracle.iau_11.1.1fmw_audit.jar: COMMON_COMPONENTS_HOMEmodulesoracle.pki_11.1.1oraclepki.jar -Doracle.home=ORACLE_HOME -Doracle.instance=ORACLE_INSTANCE -Dauditloader.jdbcString=jdbc:oracle:thin:host:port:sid -Dauditloader.username=username -Dstore.password=true -Dauditloader.password=password oracle.security.audit.ajl.loader.StandaloneAuditLoader Note: Insert these lines after the ias-instance tag is closed.