Check the extension information you can find it under
Log Management and Analytics
Audit log files tracking
Check log file's location
- SELECT name, value FROM v$parameter WHERE name = 'audit_trail';
OS means that the audit logs are stored locally in the file.
- SELECT value FROM v$parameter WHERE name = 'audit_file_dest';
specifies the log file's location
Add LogAgent security rules
Configure LogAgent's security rules to allow access to local files, by adding the oracle.json file under :
- on Linux/UNIX: /var/lib/dynatrace/oneagent/agent/config/logmodule
- on Windows: %PROGRAMDATA%\dynatrace\oneagent\agent\config\logmodule
{
"@version": "1.0.0",
"allowed-log-paths-configuration": [
{
"directory-pattern": "/u01/app/oracle/admin/oracle_standalone/adump/",
"file-pattern": "*.aud",
"action": "INCLUDE"
}
]
}Agent restart is not required, this config will be applied within 1 minute.
Configure custom log source and log ingest rules
Custom log source
Use the log file location fetched via the query executed in the first step, e.g. /u01/app/oracle/admin/oracle_standalone/adump/*.
Log ingest rules
An example configuration that includes only ORA-01017 that reports invalid username or password logon attempts could be configured using: Log content is any of: (.*)RETURNCODE:\[(\d+)\] "1017 AND Log source is any of: /u01/app/oracle/admin/oracle_standalone/adump/*
Accessing logs
Logs collected the way described above can be accessed using following DQL query: fetch logs | filter matchesValue(log.source, "/u01/app/oracle/admin/oracle_standalone/adump/*").
Metrics extraction
Log processing rule
Configure log processing rule to extract log attributes out of the log content:
- Rule name: preferred name
- Matcher: matchesValue(log.source, "/u01/app/oracle/admin/oracle_standalone/adump/*")
- Processor definition:
PARSE(content, "
DATA ' RETURNCODE:['INT']' SPACE '\"' INT:ora.returncode LD") |
PARSE(content, "
DATA ' USERID:['INT']'SPACE CSVDQS:ora.userid LD") |
PARSE(content, "
DATA ' USERHOST:['INT']'SPACE CSVDQS:ora.userhost LD")
Metric extraction
Extract metrics from log entries to enable alerting:
- Metric key: e.g.log.oracle.invalid_credentials
- Matcher: matchesValue(log.source, "/u01/app/oracle/admin/oracle_standalone/adump/*")
- Metric measurement: Occurence of logs records
- Dimensions: specify the log attributes to be used as metric dimensions
