synoti logosynoti logo
Databases Oracle

1. Requirements

  1. Unified Security Stack Agent (Windows or Linux) with Syslog integration enabled on port 7014 TCP/UDP (You can follow the Syslog integration guide from the “Integrations” menu on your Unified Security Stack instance).

  2. rsyslog with the imfile module active.

  3. Configure Oracle DB to output Audit, Listener, and Alert logs to files.

The Unified Security Stack agent can be installed on a separate instance dedicated only to receiving logs, or on the same server as Unified Security Stack. However, installing the Unified Security Stack agent directly on the server running the Oracle DB is recommended to enable incident response commands.

Installation of Rsyslog is required on the same server as your OracleDB.

2. Set up forwarding of logs to Unified Security Stack

1. Execute the command below to create the configuration file:

sudo touch /etc/rsyslog.d/oracle-synoti.conf

2. Open file “/etc/rsyslog.d/oracle-synoti.conf” with your preferred editor and add the following configuration:

input(type="imfile"
File="BASEDIR/admin//adump/.aud"
Tag="oracle-audit"
Severity="info"
Facility="local5")

input(type="imfile"
File="BASEDIR/diag/tnslsnr/*/listener/trace/listener.log"
Tag="oracle-listener"
Severity="info"
Facility="local5")

input(type="imfile"
File="BASEDIR/diag/rdbms///trace/alert_*.log"
Tag="oracle-alerts"
Severity="info"
Facility="local5")

local5.* @DESTINATION:7014

3. Replace BASEDIR with the actual Oracle DB working/base path (e.g., /u01/app/oracle)

4. Replace DESTINATION with the Unified Security Stack Agent's IP address or Fully Qualified Domain Name (FQDN)

Rsyslog will send logs by default using UDP protocol, but TCP protocol can be used by adding an additional @ just before the agent IP or FQDN. Example:

local5.* @@DESTINATION:7014

5. Use the following command to restart rsyslog

sudo systemctl restart rsyslog

6. Validate the configuration by sending test logs with the commands below.

logger -p local5.info "Test Oracle Audit log message"
logger -p local5.info "Test Oracle Listener log message"
logger -p local5.info "Test Oracle Alert log message"

7. Use the Logs Explorer to verify that Unified Security Stack received these messages, searching for the test message above.