Audit log - Oracle DB setup

This page shows how to prepare an Oracle DB server for the audit log. Oracle DB 19c and later is supported.

Creating the user

In Oracle DB, a schema belongs to a user, so creating the user is all that is needed. As an administrative user, create a user named zato_audit_log with an unlimited quota on its default tablespace. The audit log creates its table and indexes the first time a server connects.

Now, point the servers at the database - Zato_Audit_Log_DB_Name is the service name of the database:

export Zato_Audit_Log_DB_Type=oracle
export Zato_Audit_Log_DB_Host=db.example.com
export Zato_Audit_Log_DB_Port=1521
export Zato_Audit_Log_DB_Username=zato_audit_log
export Zato_Audit_Log_DB_Password=my.secret.password
export Zato_Audit_Log_DB_Name=ORCLPDB1

Enabling SSL/TLS on the server

Oracle DB encrypts connections through the TCPS protocol. Create a wallet holding the server certificate:

orapki wallet create -wallet /opt/oracle/wallet -auto_login -pwd "wallet.password"
orapki wallet add -wallet /opt/oracle/wallet -trusted_cert -cert /path/to/ca.crt -pwd "wallet.password"
orapki wallet add -wallet /opt/oracle/wallet -user_cert -cert /path/to/server.crt -pwd "wallet.password"

Add a TCPS endpoint to listener.ora:

LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCP)(HOST = 0.0.0.0)(PORT = 1521))
      (ADDRESS = (PROTOCOL = TCPS)(HOST = 0.0.0.0)(PORT = 2484))
    )
  )

WALLET_LOCATION =
  (SOURCE = (METHOD = FILE)(METHOD_DATA = (DIRECTORY = /opt/oracle/wallet)))

And restart the listener:

lsnrctl stop && lsnrctl start

With the server prepared, enable TLS on the client side, pointing the port at the TCPS endpoint:

export Zato_Audit_Log_DB_Port=2484

export Zato_Audit_Log_DB_SSL=on
export Zato_Audit_Log_DB_SSL_CA_File=/path/to/ca.crt

All the client-side variables are described in the audit log documentation.

Learn more