Audit Oracle Database Server 12.1 and 12.2 with Netwrix Auditor

Oracle Database
7.0-8.5
9.0-9.7
9.8
https://kb.netwrix.com/1097
Copy Article URL Copied

The following scenarios are possible:

  1. Oracle Database server 12.2 installed on all target servers.
AND
Monitoring plans for Oracle Database have not been created.
  1. Oracle Database server 12.2 and 12.1 are installed on target servers.
    AND
    You need to create monitoring plans for Oracle Database 12.2 and then edit their settings manually.

In both cases, you will not receive any errors in the Netwrix Auditor System Health log, but the product cannot collect data from Oracle Database server 12.2.


Netwrix Auditor does not support Oracle Database server 12.2 Unified auditing.


Perform the following steps depending on your scenario:
Scenario Resolution steps
Oracle Database server 12.2 installed on all target servers.
AND
Monitoring plans for Oracle Database have not been created
  1. On the computer where Netwrix Auditor is installed, navigate to %NetwrixAuditor_installation_folder% Oracle Auditing (by default, C:Program Files (x86).
  2. Edit the NwxOracleAuditorQueries.acinc file with Notepad:
Replace the gv$unified_audit_trail text
with audsys.aud$unified.
  1. Navigate to the Services snap-in and restart the Netwrix Auditor for Oracle Database Audit Service service.
  2. Create a monitoring plan for your Oracle Database instances and wait for initial analysis completes.
Oracle Database server 12.2 and 12.1 are installed on target servers
AND
You need to create monitoring plans for Oracle Database 12.2 and then edit their settings manually.
Note: Netwrix Auditor fails to process both: Oracle Database server 12.1 and 12.2 within one monitoring plan.

  1. Create monitoring plan with Oracle 12.2 items.
  2. Find your monitoring plan GUID:
Navigate to %programdata%Netwrix AuditorAuditCoreConfigServer and open the Configuration.xml file.
Find your monitoring plan name in the configuration file:
ects”>-<n n=”ManagedObj
….
<a n=”Name” t=”2″ v=”your_Oracle_Database_monitoring_plan_name”/>
  1. Navigate to C:ProgramDataNetwrix AuditorOracleAuditorData<your_Oracle_monitoring_plan_GUID> and edit the Queries.xml file with Notepad:
Replace the gv$unified_audit_trail text
with audsys.aud$unified.
  1. Run data collection for your Oracle Database monitoring plans.
Go Up