Audit Record Storage Analytics

Configuring and Managing Auditing 12-3

3. Enter your database details and click Next.

4. Choose the option to create a new prefix, for example IDM. 5. Also, select Audit Services from the list of schemas.

6. Click Next and accept the tablespace creation.

7. Check for any errors while the schemas are being created. This process will take several minutes to complete.

12.2.2 Set Up Audit Data Sources

As explained in Section 12.2.1, Create the Audit Schema using RCU , after you create a database schema to store audit records in a database, you must set up an Oracle WebLogic Server audit data source that points to that schema. Take these steps to set up an audit data source:

1. Connect to the Oracle WebLogic Server administration console:

http:host:7001console

2. Under JDBC, click the Data Sources link.

3. The Data Sources page appears. Click New to create a new data source.

4. Enter the following details for the new data source:

■ Name : Enter a name such as Audit Data Source-0. ■ JNDI Name : jdbcAuditDB ■ Database Type : Oracle ■ Database Driver : Oracles Driver Thin XA Versions: 9.0.1, 9.0.2, 10, 11 If deploying to a managed cluster server, also check AdminServer; this ensures that the data source is listed in the audit store when switching from file to database store. Click Next. 5. The Transaction Options page appears. Click Next. 6. The Connection Properties page appears. Enter the following information: ■ Database Name : Enter the name of the database to which you will connect. This usually maps to the SID. ■ Host Name : Enter the hostname of the database. ■ Port : Enter the database port. ■ Database User Name : This is the name of the audit schema that you created in RCU. The suffix is always IAU for the audit schema. For example, if you gave the prefix as test, then the schema name is test_iau. ■ Password : This is the password for the audit schema that you created in RCU. Click Next. Note: This task is performed with the Oracle WebLogic Server administration console. 12-4 Oracle Fusion Middleware Application Security Guide 7. The next page lists the JDBC driver class and database details. Accept the defaults, and click Test Configuration to test the connection. If you see the message Connection established Successfully, click Next. If it displays any error, go back and check the connection details. 8. In the Select Targets page, select the servers where this data source needs to be configured, and click Finish.

12.2.2.1 Multiple Data Sources

For scalability and high availability, you can configure Oracle Real Application Clusters for your audit data. For details, see: ■ Setting Up Auditing with a RAC Database Store in the Oracle Fusion Middleware High Availability Guide ■ Using WebLogic Server to Configure Audit Data Sources and Multi Data Sources in the Oracle Fusion Middleware High Availability Guide ■ Configuring the JDBC String for the Audit Loader in the Oracle Fusion Middleware High Availability Guide ■ Using WebLogic Server with Oracle RAC in Oracle Fusion Middleware Configuring and Managing JDBC for Oracle WebLogic Server

12.2.3 Configure a Database Audit Store for Java Components

After the schema is created, configuring a database-based audit store involves: ■ creating a data source that points to the audit schema you created, and ■ configuring the audit store to point to the data source This section describes the following tasks related to audit store configuration: ■ View Audit Store Configuration ■ Configure the Audit Store

12.2.3.1 View Audit Store Configuration

To view the current audit store configuration, navigate to Domain, then Security, then Audit Store . Note: These steps configure the audit store for Java components only. Separate steps are needed to configure the audit store for system components. See Section 12.2.4, Configure a Database Audit Store for System Components . By configuring the same database to store audit records for Java components and system components, you can ensure that reports for both types of components can be viewed together. Note: This task is performed with Oracle Enterprise Manager Fusion Middleware Control. Configuring and Managing Auditing 12-5 This page shows: ■ whether or not a database is configured as the audit store. By default a database is not configured, and audit records are stored in bus-stop files. ■ Datasource JNDI Name - If a database store is configured for audit records, this field shows the JNDI name of the datasource. This field is empty when the audit store is not configured. ■ Datasource Name - If a database store is configured for audit records, this field shows the datasource name. This field is not displayed when the audit store is file-based. ■ URL - If a database repository is configured for audit records, this field shows the data source URL, which is the connect string used to connect to the database. This field is not displayed when the audit store is file-based. See Section 12.2.2, Set Up Audit Data Sources for datasource examples.

12.2.3.2 Configure the Audit Store

You can change from storing audit records in a file to using a database audit store. Take these steps to configure the audit store:

1. Navigate to Domain, then Security, then Audit Store. The Audit Store page

appears. 2. Click the searchlight icon next to the Datasource JNDI Name field. 3. A dialog box appears showing the list of datasources available for audit records in the domain. Select the desired datasource and click OK. 4. The selected datasource is displayed in the Datasource JNDI Name field. Click Apply to continue, or Revert to abandon the update. 5. Restart all the Oracle WebLogic Servers in the domain. This enables Audit Loader Startup Class present in Oracle WebLogic Server to re-read the configuration. 6. You can test the changes by setting an audit policy to test event collection. For example, you can set the Medium audit policy for Oracle Platform Security Services. For details, see Section 12.3.1, Manage Audit Policies for Java Components with Fusion Middleware Control . 7. Execute a scenario so that auditing can generate an audit event. For example, creating a credential will trigger an audit record based on the policy you configured in Step 6. Note: You can also use the WLST setAuditRepository command to change the audit store settings. See Appendix D, Fusion Middleware Audit Framework Reference for details. 12-6 Oracle Fusion Middleware Application Security Guide 8. Check for errors and exceptions in the server logs ■ Check DOMAIN_HOMEjrfServer_admin.out ■ Check DOMAIN_HOMEserversSERVER_NAMElogs.

12.2.3.3 Deconfigure the Audit Store

Since a database is the recommended store for audit records, switching from database to file mode is discouraged. However, Section 12.3.4, Manage Audit Policies Manually discusses a property called the audit.repositoryType whose value can be set to File to switch to file storage. When you switch from database to file, events that were collected in the database are not transferred back to the file system. If this switch is temporary, then the audit events collected in the file are automatically pushed to database when you switch to database store again.

12.2.4 Configure a Database Audit Store for System Components

Oracle Process Manager and Notification Server OPMN manages several system components running in Oracle WebLogic Server. For these components, the mechanism through which the audit events are pushed from local bus-stop files to the database audit store is handled by OPMN. You must execute the following steps in every instance of the component to configure an audit store:

1. Open the opmn.xml file, which resides in

ORACLE_INSTANCEconfigOPMNopmnopmn.xml

2. Locate the rmd-definitions element, which looks like this:

rmd-definitions rmd name=AuditLoader interval=15 Note: You cannot use Fusion Middleware Control or WLST to switch from database to file mode; this requires manual configuration as explained in Section 12.3.4, Manage Audit Policies Manually . Note: If your system component runs in a clustered deployment, you must configure the audit store at each instance of the component so that all instances push out records to the store. Note: These steps configure the audit store for system components only. Separate steps are needed to configure the audit store for Java components. See Section 12.2.3, Configure a Database Audit Store for Java Components . By configuring the same database to store audit records for Java components and system components, you can ensure that reports for both types of components can be viewed together.