Audit Oracle Database Server 12.1 and 12.2 with Netwrix Auditor

This article explains how to audit Oracle Database Server 12.1 and 12.2 with Netwrix Auditor.
Email It to Me Print this Page
Symptoms The following scenarios are possible:
  1. Oracle Database server 12.2 installed on all target servers.
AND
Monitoring plans for Oracle Database have not been created.
  1. Oracle Database server 12.2 and 12.1 are installed on target servers.
    AND
    You need to create monitoring plans for Oracle Database 12.2 and then edit their settings manually.
In both cases, you will not receive any errors in the Netwrix Auditor System Health log, but the product cannot collect data from Oracle Database server 12.2.
Cause Netwrix Auditor does not support Oracle Database server 12.2 Unified auditing.
Resolution
Perform the following steps depending on your scenario:
 
ScenarioResolution steps
Oracle Database server 12.2 installed on all target servers.
AND
Monitoring plans for Oracle Database have not been created
  1. On the computer where Netwrix Auditor is installed, navigate to %NetwrixAuditor_installation_folder%\ Oracle Auditing (by default, C:\Program Files (x86).
  2. Edit the NwxOracleAuditorQueries.acinc file with Notepad:
Replace the gv$unified_audit_trail text
with audsys.aud$unified.
  1. Navigate to the Services snap-in and restart the Netwrix Auditor for Oracle Database Audit Service service.
  2. Create a monitoring plan for your Oracle Database instances and wait for initial analysis completes.
 
Oracle Database server 12.2 and 12.1 are installed on target servers
AND
You need to create monitoring plans for Oracle Database 12.2 and then edit their settings manually.
Note: Netwrix Auditor fails to process both: Oracle Database server 12.1 and 12.2 within one monitoring plan. 
  1. Create monitoring plan with Oracle 12.2 items.
  2. Find your monitoring plan GUID:
Navigate to %programdata%\Netwrix Auditor\AuditCore\ConfigServer\ and open the Configuration.xml file.
Find your monitoring plan name in the configuration file:

ects">-<n n="ManagedObj
....
<a n="Name" t="2" v="your_Oracle_Database_monitoring_plan_name"/>
  1. Navigate to C:\ProgramData\Netwrix Auditor\OracleAuditor\Data\<your_Oracle_monitoring_plan_GUID> and edit the Queries.xml file with Notepad:
Replace the gv$unified_audit_trail text
with audsys.aud$unified.
  1. Run data collection for your Oracle Database monitoring plans.

 
Was this information helpful?