Applies To
All Users
Summary
-
In a 2-node RAC environment, one node consistently generated frequent audit records in the OS message log, while the other node had none in OS message log. May 11 03:39:21 <HOST> journal: Oracle Audit3552: LENGTH : '244' ACTION :7 'CONNECT' DATABASE USER:1 '/' PRIVILEGE :6 'SYSDBA' CLIENT USER:6 'oracle' CLIENT TERMINAL:0 '' STATUS:1 '0' DBID:0 '' SESSIONID:10 '4294967295' USERHOST:[
10] '<HOST>' CLIENT ADDRESS:0 '' ACTION NUMBER:3 '100'
May 11 03:39:29 <HOST> journal: Oracle Audit3756: LENGTH : '244' ACTION :7 'CONNECT' DATABASE USER:1 '/' PRIVILEGE :6 'SYSDBA' CLIENT USER:6 'oracle' CLIENT TERMINAL:0 '' STATUS:1 '0' DBID:0 '' SESSIONID:10 '4294967295' USERHOST:[
10] '<HOST>' CLIENT ADDRESS:0 '' ACTION NUMBER:3 '100'
May 11 03:39:33 <HOST> journal: Oracle Audit3775: LENGTH : '244' ACTION :7 'CONNECT' DATABASE USER:1 '/' PRIVILEGE :6 'SYSDBA' CLIENT USER:6 'oracle' CLIENT TERMINAL:0 '' STATUS:1 '0' DBID:0 '' SESSIONID:10 '4294967295' USERHOST:[
10] '<HOST>' CLIENT ADDRESS:0 '' ACTION NUMBER:3 '100'
May 11 03:39:34 <HOST> journal: Oracle Audit3783: LENGTH : '244' ACTION :7 'CONNECT' DATABASE USER:1 '/' PRIVILEGE :6 'SYSDBA' CLIENT USER:6 'oracle' CLIENT TERMINAL:0 '' STATUS:1 '0' DBID:0 '' SESSIONID:10 '4294967295' USERHOST:[
10] '<HOST>' CLIENT ADDRESS:0 '' ACTION NUMBER:3 '100'
May 11 03:39:35 <HOST> journal: Oracle Audit3794: LENGTH : '244' ACTION :7 'CONNECT' DATABASE USER:1 '/' PRIVILEGE :6 'SYSDBA' CLIENT USER:6 'oracle' CLIENT TERMINAL:0 '' STATUS:1 '0' DBID:0 '' SESSIONID:10 '4294967295' USERHOST:[
10] '<HOST>' CLIENT ADDRESS:0 '' ACTION NUMBER:3 '100'
May 11 03:39:38 <HOST> journal: Oracle Audit3826: LENGTH : '244' ACTION :7 'CONNECT' DATABASE USER:1 '/' PRIVILEGE :6 'SYSDBA' CLIENT USER:6 'oracle' CLIENT TERMINAL:0 '' STATUS:1 '0' DBID:0 '' SESSIONID:10 '4294967295' USERHOST:[
10] '<HOST>' CLIENT ADDRESS:0 '' ACTION NUMBER:3 '100'
-
Both nodes had the same audit setting, and ASM instances set audit_syslog_level=LOCAL0.INFO. ASM Instances:
NAME TYPE VALUE
audit_file_dest string /u01/app/19.3/grid/rdbms/audit
audit_sys_operations boolean TRUE
audit_syslog_level string LOCAL0.INFO <<<<<<<<--
audit_trail string NONE
unified_audit_sga_queue_size integer 1048576
DB Instances:
NAME TYPE VALUE
audit_file_dest string /u01/app/oracle/admin/<DB_NAME>/adump
audit_sys_operations boolean TRUE
audit_syslog_level string
audit_trail string DB
unified_audit_common_systemlog string
unified_audit_sga_queue_size integer 1048576
unified_audit_systemlog string
Solution
-
To redirect these audit logs, add the corresponding configuration entries to /etc/rsyslog.conf and restart the rsyslog service. For example:
vi /etc/rsyslog.conf
-- add redirect setting
local0.info /var/log/oraasmaudit.log
local1.info /var/log/oraiosaudit.log
local2.info /var/log/oraapxaudit.log
systemctl restart rsyslog
-
To prevent the generation of traditional audit logs, enable Unified Auditing. For example:
--On all nodes
crsctl stop crs
su - grid
cd GI_HOME/rdbms/lib
$ make -f ins_rdbms.mk uniaud_on ioracle
$ su - root
crsctl start crs
Attachments :
Cause
Applied GIRU 19.22.
Due to Bug 28400367, the following configuration entries were not updated in /etc/rsyslog.conf on the affected node during the GIRU patching. As a result, audit logs were written to the default messages file instead of their redirected log files:
local0.info /var/log/oraasmaudit.log
local1.info /var/log/oraiosaudit.log
local2.info /var/log/oraapxaudit.log
These audit records were generated by traditional auditing, as mandatory audit logs when agents connected to the ASM instance as SYSDBA, triggered by the CHECK_INTERVAL setting in the GI resource properties.