All Apps and Add-ons

Oracle 11g standard audit to syslog: what is normal for single quotes?

jldunn
Engager

We are using Oracle 11g standard audit to syslog on a Unix server. I am seeing a small number of Oracle records that don't have trailing quotes in the syslog file, e.g.:

2013 Nov 6 03:00:01 hostname [local7.warning] Audit[30801972]: LENGTH : '203' ACTION :[55] 'alter session set remote_dependencies_mode = signature

Note that there is an opening single quote before "alter" but not a closing trailing quote.
Our DBA team doesn't know if this is 'normal' for Oracle audit records or not.
Is it 'normal' for an audit record to be missing a trailing quote?

I have not seen other records (non-Oracle) truncated by our syslog, so I am not suspecting syslog at this point. The records appear to be of differing lengths; i.e. they aren't all getting chopped off at a specific point.

pmdba
Builder

I would not say that this is normal. The syslog output format may be dependent on your particular flavor of UNIX, or your particular syslog configuration. The systems I have tested this on (RHEL 5, RHEL 6, OEL 5) all include the trailing quote, as well as several more fields (see below). I would recommend checking your syslog or rsyslog configuration to make sure there isn't some issue there. It may also be that Oracle is sending a character that has special meaning to syslog that causes it to truncate the entry. Check the full SQL statement being used to see if there is anything unusual about it.

Dec 3 14:46:31 hostname Oracle Audit[11872]: LENGTH : '233' ACTION :[85] 'alter system set "_shutdown_completion_timeout_mins" = 30 scope=memory /* db agent */' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[10] '1773000810'

0 Karma

lguinn2
Legend

You might also want to ask this on an Oracle forum. I don't think that many in this community are Oracle admins.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...