oracle audit log regex

[nocostk]

I'm trying to extract a field from the Oracle audit logs. For some reason I can't seem to get the regex just right. Any suggestions?

Search:

index=main sourcetype="audit_log" | head 10000 | rex "(?i) DATABASE\s+USER:.+'(?P<DBA>.+)'" | top 50 DBA

Source:

Audit file /u01/app/oracle/admin/prodprt/adump/prodprt1_ora_31495_1.aud
Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit Production
With the Partitioning, Real Application Clusters, Automatic Storage Management, OLAP,
Data Mining and Real Application Testing options
ORACLE_HOME = /u01/app/oracle/product/11.2.0/prodprt
System name:    Linux
Node name:  prodprtdb01
Release:    2.6.18-164.el5
Version:    #1 SMP Thu Sep 3 04:15:13 EDT 2009
Machine:    x86_64
Instance name: prodprt1
Redo thread mounted by this instance: 1
... 1 line omitted ...
Unix process pid: 31495, image: oracle@prodprtdb01 (TNS V1-V3)
Tue Mar  1 13:04:28 2011 -07:00
LENGTH : '155'
ACTION :[7] 'CONNECT'
DATABASE USER:[1] '/'
PRIVILEGE :[6] 'SYSDBA'
CLIENT USER:[6] 'oracle'
CLIENT TERMINAL:[0] ''

[Jason]

Can you please post the settings (in Oracle) that you use to spit out this level of information? I have a client who really needs all this data but their level of auditing isn't outputting the correct fields yet.

[gkanapathy · Accepted solution]

There probably is no space character before the word "DATABASE" in the data. You probably just need to remove that from the regex (or replace it with a ^ or \v).

---

BTW, something like this is probably a useful extraction for Oracle audit log data in general:

props.conf:

[audit_log]
REPORT-orcl_txt_audit = oracle_text_audit_log

transforms.conf:

[oracle_text_audit_log]
REGEX = (^|\v)([\w\s]*\w)\s*:(?:\[\d*\])?\s*([\'\"])?([^\']*)\2
FORMAT = $1::$3

Approximately.

[gkanapathy]

Just change [^\'] to [^\'\v] instead.

[nocostk]

Hmm, I tried this and it seems to work now . . . (?im)DATABASE\s+USER:[\d+]\s+'(?P.{,10})' . But it doesn't feel right to me. The problem is what if the username is more than 10 characters?

[nocostk]

Thanks, Gkanapathy. That worked for the above search but when I tried to add an extract it will grab the user and everything else (the following 3 lines). I tried to modify the regex to not be greedy with the single quote - but I can't seem to tweak it just right.