Splunk Search

oracle audit log regex

Communicator

I'm trying to extract a field from the Oracle audit logs. For some reason I can't seem to get the regex just right. Any suggestions?

Search:

index=main sourcetype="audit_log" | head 10000 | rex "(?i) DATABASE\s+USER:.+'(?P<DBA>.+)'" | top 50 DBA

Source:

Audit file /u01/app/oracle/admin/prodprt/adump/prodprt1_ora_31495_1.aud
Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit Production
With the Partitioning, Real Application Clusters, Automatic Storage Management, OLAP,
Data Mining and Real Application Testing options
ORACLE_HOME = /u01/app/oracle/product/11.2.0/prodprt
System name:    Linux
Node name:  prodprtdb01
Release:    2.6.18-164.el5
Version:    #1 SMP Thu Sep 3 04:15:13 EDT 2009
Machine:    x86_64
Instance name: prodprt1
Redo thread mounted by this instance: 1
... 1 line omitted ...
Unix process pid: 31495, image: oracle@prodprtdb01 (TNS V1-V3)
Tue Mar  1 13:04:28 2011 -07:00
LENGTH : '155'
ACTION :[7] 'CONNECT'
DATABASE USER:[1] '/'
PRIVILEGE :[6] 'SYSDBA'
CLIENT USER:[6] 'oracle'
CLIENT TERMINAL:[0] ''
Tags (1)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

There probably is no space character before the word "DATABASE" in the data. You probably just need to remove that from the regex (or replace it with a ^ or \v).


BTW, something like this is probably a useful extraction for Oracle audit log data in general:

props.conf:

[audit_log]
REPORT-orcl_txt_audit = oracle_text_audit_log

transforms.conf:

[oracle_text_audit_log]
REGEX = (^|\v)([\w\s]*\w)\s*:(?:\[\d*\])?\s*([\'\"])?([^\']*)\2
FORMAT = $1::$3

Approximately.

View solution in original post

0 Karma

Motivator

Can you please post the settings (in Oracle) that you use to spit out this level of information? I have a client who really needs all this data but their level of auditing isn't outputting the correct fields yet.

0 Karma

Splunk Employee
Splunk Employee

There probably is no space character before the word "DATABASE" in the data. You probably just need to remove that from the regex (or replace it with a ^ or \v).


BTW, something like this is probably a useful extraction for Oracle audit log data in general:

props.conf:

[audit_log]
REPORT-orcl_txt_audit = oracle_text_audit_log

transforms.conf:

[oracle_text_audit_log]
REGEX = (^|\v)([\w\s]*\w)\s*:(?:\[\d*\])?\s*([\'\"])?([^\']*)\2
FORMAT = $1::$3

Approximately.

View solution in original post

0 Karma

Splunk Employee
Splunk Employee

Just change [^\'] to [^\'\v] instead.

0 Karma

Communicator

Hmm, I tried this and it seems to work now . . . (?im)DATABASE\s+USER:[\d+]\s+'(?P.{,10})' . But it doesn't feel right to me. The problem is what if the username is more than 10 characters?

0 Karma

Communicator

Thanks, Gkanapathy. That worked for the above search but when I tried to add an extract it will grab the user and everything else (the following 3 lines). I tried to modify the regex to not be greedy with the single quote - but I can't seem to tweak it just right.

0 Karma