Connect as AVDF_ADM user
Click on Register
Enter the name and IP Address of the server where the AVDF agent is being deployed
Click on Save and make a note of the Activation Key – we will need this later
Download the Audit Vault Agent
Copy the downloaded AVDF agent to the server where the agent will be deployed
[oracle@hcm ~]$ cd /media/sf_software/
[oracle@hcm sf_software]$ cp agent.jar /u01/app/oracle
Install the AVDF agent
[oracle@hcm sf_software]$ export JAVA_HOME=$ORACLE_HOME/jdk
[oracle@hcm sf_software]$ export PATH=$JAVA_HOME/bin:$PATH
[oracle@hcm sf_software]$ java -version
java version “1.8.0_251”
Java(TM) SE Runtime Environment (build 1.8.0_251-b08)
Java HotSpot(TM) 64-Bit Server VM (build 25.251-b08, mixed mode)
[oracle@hcm sf_software]$ cd /u01/app/oracle
[oracle@hcm oracle]$ java -jar agent.jar -d /u01/app/oracle/avdf_agent
Agent installed successfully.
If deploying hostmonitor please refer to product documentation for additional installation steps.
Start the AVDF agent
[oracle@hcm ~]$ cd /u01/app/oracle/avdf_agent/bin
[oracle@hcm bin]$ ./agentctl start -k
Enter Activation Key:
Checking for updates…
Agent is updating. This operation may take a few minutes. Please wait…
Agent updated successfully.
Agent started successfully.
Check the status of the AVDF agent
Create the database AVDF user and grant appropriate privileges
SQL> alter session set container=pdb1;
Session altered.
SQL> create user avdfuser identified by Oracle_4U;
User created.
SQL> @/u01/app/oracle/avdf_agent/av/plugins/com.oracle.av.plugin.oracle/config/oracle_user_setup.sql AVDFUSER SETUP
Session altered.
Granting privileges to “AVDFUSER” … Done.
Disconnected from Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 – Production
Version 19.8.0.0.0
[oracle@hol2 bin]$ cd /u01/app/oracle/avdf_agent/av/plugins/com.oracle.av.plugin.oracle/config/
[oracle@hol2 config]$ sqlplus sys as sysdba
SQL*Plus: Release 19.0.0.0.0 – Production on Tue Mar 30 12:28:45 2021
Version 19.8.0.0.0
Copyright (c) 1982, 2020, Oracle. All rights reserved.
Enter password:
Connected to:
Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 – Production
Version 19.8.0.0.0
SQL> alter session set container=pdb1;
Session altered.
SQL> @/u01/app/oracle/avdf_agent/av/plugins/com.oracle.av.plugin.oracle/config/oracle_user_setup.sql avdfuser SPA
Session altered.
Granting privileges to “AVDFUSER” … Done.
Disconnected from Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 – Production
Version 19.8.0.0.0
[oracle@hol2 config]$ sqlplus sys as sysdba
SQL*Plus: Release 19.0.0.0.0 – Production on Tue Mar 30 12:29:03 2021
Version 19.8.0.0.0
Copyright (c) 1982, 2020, Oracle. All rights reserved.
Enter password:
Connected to:
Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 – Production
Version 19.8.0.0.0
SQL> alter session set container=pdb1;
Session altered.
SQL> @/u01/app/oracle/avdf_agent/av/plugins/com.oracle.av.plugin.oracle/config/oracle_user_setup.sql avdfuser ENTITLEMENT
Session altered.
Granting privileges to “AVDFUSER” … Done.
Disconnected from Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 – Production
Version 19.8.0.0.0
[oracle@hol2 config]$
[oracle@hol2 config]$ sqlplus sys as sysdba
SQL*Plus: Release 19.0.0.0.0 – Production on Tue Mar 30 12:31:01 2021
Version 19.8.0.0.0
Copyright (c) 1982, 2020, Oracle. All rights reserved.
Enter password:
Connected to:
Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 – Production
Version 19.8.0.0.0
SQL> alter session set container=pdb1;
Session altered.
SQL> select granted_role from dba_role_privs where grantee=’AVDFUSER’;
GRANTED_ROLE
——————————————————————————–
AUDIT_ADMIN
AUDIT_VIEWER
RESOURCE
SQL> select privilege from dba_sys_privs where grantee=’AVDFUSER’;
PRIVILEGE
—————————————-
AUDIT ANY
AUDIT SYSTEM
CREATE SESSION
Register the Target
Add the Audit Trail
Configure Auditing in the database
SQL> col owner format a10
SQL> col table_name format a15
SQL> col tablespace_name format a12
SQL> col interval format a20
SQL> set lines 300
SQL> select owner,table_name,interval,partitioning_type,partition_count,def_tablespace_name from dba_part_Tables where owner=’AUDSYS’;
OWNER TABLE_NAME INTERVAL PARTITION PARTITION_COUNT DEF_TABLESPACE_NAME
———- ————— ——————– ——— ————— ——————————
AUDSYS AUD$UNIFIED INTERVAL ‘1’ MONTH RANGE 1048575 SYSAUX
SQL> create tablespace avdf_aud_data
datafile ‘/u02/app/oracle/oradata/CDB1/pdb1/avdf_aud_data01.dbf’ size 2048m;
Tablespace created.
SQL> BEGIN
DBMS_AUDIT_MGMT.SET_AUDIT_TRAIL_LOCATION(
audit_trail_type => dbms_audit_mgmt.audit_trail_unified,
audit_trail_location_value => ‘AVDF_AUD_DATA’);
END;
/
PL/SQL procedure successfully completed.
SQL> BEGIN
DBMS_AUDIT_MGMT.INIT_CLEANUP(
AUDIT_TRAIL_TYPE => DBMS_AUDIT_MGMT.AUDIT_TRAIL_ALL,
DEFAULT_CLEANUP_INTERVAL => 1 );
END;
/
PL/SQL procedure successfully completed.
SQL> BEGIN
DBMS_AUDIT_MGMT.CREATE_PURGE_JOB (
AUDIT_TRAIL_TYPE => DBMS_AUDIT_MGMT.AUDIT_TRAIL_ALL,
AUDIT_TRAIL_PURGE_INTERVAL => 1,
AUDIT_TRAIL_PURGE_NAME => ‘CLEANUP_OS_DB_AUDIT_RECORDS’,
USE_LAST_ARCH_TIMESTAMP => TRUE );
END;
/
PL/SQL procedure successfully completed.
SQL> select owner,table_name,interval,partitioning_type,partition_count,def_tablespace_name from dba_part_Tables where owner=’AUDSYS’;
OWNER
——————————————————————————–
TABLE_NAME
——————————————————————————–
INTERVAL
——————————————————————————–
PARTITION PARTITION_COUNT DEF_TABLESPACE_NAME
——— ————— ——————————
AUDSYS
AUD$UNIFIED
INTERVAL ‘1’ MONTH
RANGE 1048575 AVDF_DATA
