Can Splunk read data from Aud$ and FGA_LOG$ ,can it be used to replace Oracle Audit vault

New Member

looking for the these information to pull live data from oracle database. Can it also pull the data from xml file.
any limit on the data length and character

Tags (1)
0 Karma


This will depend somewhat on what version of Oracle you are running. Oracle 11g can write audit records to text or xml files or syslog, or keep them in the database where you can index them using Splunk DBConnect. Starting with Oracle 12c, audit records are only stored in a new unified audit trail table and no longer written to external files, so DBConnect will be your only option. In general Splunk doesn't have any limit on the amount or size of data ingested. If you can read the file or run the SQL query Splunk can index the results.

That said, if you have any concerns about bumping into your Splunk license limit, I would advise reading audit records from syslog or Oracle's .aud text files and avoiding XML. The XML tags make it easy for Splunk to identify fields, but will consume twice as much of your license pulling in those extra characters. If you are running SQL queries, consider which columns from the audit tables you want to include; you can save overhead on your license if you can exclude some of them.

It's a little dated (DB Connect is on version 3.0 now), but the following add-on can explain the basics of pulling in data from a variety of Oracle related sources. Log File Analysis for Oracle 11g.

0 Karma