Oracle 12c UNIFIED_AUDIT_TRAIL to syslog server

Splunk Search

Dear community,

I have to implement Oracle 12c audit and save/export audit data to a shared drive on the SYSLOG server. Splunk will get the data for this SYSLOG server.

In a configuration like that, what is the best approach? Mixed auditing or Pure auditing?

My approach is to define pure audit and create 2 procedures:

Transfer UNIFIED_AUDIT_TRAIL to the SYSLOG server;
Clean up the auditing data from time to time.

With DBConnect, I must create a specific user, which I don't want.

Is there a step-by-step guide in windows to implement Oracle 12c auditing?

Thanks

Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Access to Splunk Observability Kubernetes “Classic Navigator” UI will no longer be available starting January ...

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...