{"id":86,"date":"2020-11-03T13:50:01","date_gmt":"2020-11-03T12:50:01","guid":{"rendered":"https:\/\/ptdb.ch\/?p=86"},"modified":"2020-11-03T13:50:01","modified_gmt":"2020-11-03T12:50:01","slug":"how-to-implement-unified-auditing-for-an-oracle-19c-asm-instance","status":"publish","type":"post","link":"https:\/\/ptdb.ch\/?p=86","title":{"rendered":"How To Implement Unified Auditing For An Oracle 19c ASM Instance"},"content":{"rendered":"<p>Do you know what is going on in your Oracle database? Probably yes, because you have implemented auditing and check the audit trail regularly. But do you know what is going on in your Oracle ASM instance? Probably not, because not many in the Oracle wild take care of this one. However, under some circumstance it can be beneficial to know what is going on in your ASM instance. This is where auditing of the ASM instance comes into play. Oracle ASM 19c gives you 3 different methods to configure your audit trail. The first one is Oracle ASM auditing with syslog, the second one is the operating system audit trail and last but not least, you can manage Oracle ASM audit records in the unified audit trail.<\/p>\n<p>In this blog post I will take a closer look at ASM with unified auditing, and how to activate and configure it. To make it more readable, I divided it into two major objectives:<\/p>\n<ul>\n<li>How to activate unified auditing for an ASM instance<\/li>\n<li>How to configure some basic purging policies for the unified audit trail<\/li>\n<\/ul>\n<h3>How to activate unified auditing for an ASM instance<\/h3>\n<p>To activate unified auditing for an ASM instance, we need to do a few steps, and we will need downtime too, because we need to relink the oracle binary. Please notice that unified auditing with ASM is turned off per default.<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nSQL&gt; SELECT VALUE FROM V$OPTION WHERE PARAMETER = 'Unified Auditing';\n\nVALUE\n----------------------------------------------------------------\nFALSE\n\nSQL&gt; show parameter audit\n\nNAME                                 TYPE        VALUE\n------------------------------------ ----------- ------------------------------\naudit_file_dest                      string      \/u01\/grid\/19c\/rdbms\/audit\naudit_sys_operations                 boolean     TRUE\naudit_syslog_level                   string      LOCAL0.INFO\naudit_trail                          string      NONE\nunified_audit_sga_queue_size         integer     1048576\nSQL&gt;\n<\/pre>\n<p>To enable the unified audit trail with ASM, we need to stop HAS and relink the ASM oracle binary afterwards.<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n&#x5B;oracle@ocm200 ~]$ crsctl stop has\nCRS-2791: Starting shutdown of Oracle High Availability Services-managed resources on 'ocm200'\nCRS-2673: Attempting to stop 'ora.evmd' on 'ocm200'\nCRS-2673: Attempting to stop 'ora.DATA.dg' on 'ocm200'\nCRS-2673: Attempting to stop 'ora.FRA.dg' on 'ocm200'\nCRS-2673: Attempting to stop 'ora.LISTENER.lsnr' on 'ocm200'\nCRS-2677: Stop of 'ora.FRA.dg' on 'ocm200' succeeded\nCRS-2677: Stop of 'ora.DATA.dg' on 'ocm200' succeeded\nCRS-2673: Attempting to stop 'ora.asm' on 'ocm200'\nCRS-2677: Stop of 'ora.LISTENER.lsnr' on 'ocm200' succeeded\nCRS-2677: Stop of 'ora.evmd' on 'ocm200' succeeded\nCRS-2677: Stop of 'ora.asm' on 'ocm200' succeeded\nCRS-2673: Attempting to stop 'ora.cssd' on 'ocm200'\nCRS-2677: Stop of 'ora.cssd' on 'ocm200' succeeded\nCRS-2793: Shutdown of Oracle High Availability Services-managed resources on 'ocm200' has completed\nCRS-4133: Oracle High Availability Services has been stopped.\n<\/pre>\n<p>But take care of the permissions of the $GI_HOME\/bin directory, if you want to avoid some ugly errors.<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n...\nchmod 755 \/u01\/grid\/19c\/bin\nchmod: changing permissions of '\/u01\/grid\/19c\/bin': Operation not permitted\nmake: &#x5B;ins_rdbms.mk:540: preinstall] Error 1 (ignored)\n...\n<\/pre>\n<p>After changing the permissions of the $GI_HOME\/bin directory, you should be able to relink the oracle binary with unified auditing enabled.<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n&#x5B;oracle@ocm200 19c]$ ls -l | grep bin\ndrwxr-x---.  2 root   oinstall     12288 Oct 28 10:32 bin\n\n&#x5B;oracle@ocm200 19c]$ sudo chmod 770 bin\/\n&#x5B;oracle@ocm200 19c]$ sudo chown oracle bin\/\n\n&#x5B;oracle@ocm200 19c]$ ls -l | grep bin\ndrwxrwx---.  2 oracle oinstall     12288 Oct 28 10:32 bin\n\n&#x5B;oracle@ocm200 lib]$ make -f ins_rdbms.mk uniaud_on ioracle\n\/usr\/bin\/ar cr \/u01\/grid\/19c\/rdbms\/lib\/libknlopt.a \/u01\/grid\/19c\/rdbms\/lib\/kzaiang.o\nchmod 755 \/u01\/grid\/19c\/bin\n\n - Linking Oracle\nrm -f \/u01\/grid\/19c\/rdbms\/lib\/oracle\n\/u01\/grid\/19c\/bin\/orald  -o \/u01\/grid\/19c\/rdbms\/lib\/oracle -m64 -z noexecstack -Wl,--disable-new-dtags -L\/u01\/grid\/19c\/rdbms\/lib\/ -L\/u01\/grid\/19c\/lib\/ -L\/u01\/grid\/19c\/lib\/stubs\/   \n-Wl,-E \/u01\/grid\/19c\/rdbms\/lib\/opimai.o \/u01\/grid\/19c\/rdbms\/lib\/ssoraed.o \/u01\/grid\/19c\/rdbms\/lib\/ttcsoi.o -Wl,--whole-archive -lperfsrv19 -Wl,--no-whole-archive \/u01\/grid\/19c\/lib\/nautab.o\n\/u01\/grid\/19c\/lib\/naeet.o \/u01\/grid\/19c\/lib\/naect.o \/u01\/grid\/19c\/lib\/naedhs.o \/u01\/grid\/19c\/rdbms\/lib\/config.o  -ldmext -lserver19 -lodm19 -lofs -lcell19 -lnnet19 -lskgxp19 -lsnls19 \n-lnls19  -lcore19 -lsnls19 -lnls19 -lcore19 -lsnls19 -lnls19 -lxml19 -lcore19 -lunls19 -lsnls19 -lnls19 -lcore19 -lnls19 -lclient19  -lvsnst19 -lcommon19 -lgeneric19 -lknlopt -loraolap19 \n-lskjcx19 -lslax19 -lpls19  -lrt -lplp19 -ldmext -lserver19 -lclient19  -lvsnst19 -lcommon19 -lgeneric19 `if &#x5B; -f \/u01\/grid\/19c\/lib\/libavserver19.a ] ; then echo &quot;-lavserver19&quot; ; \nelse echo &quot;-lavstub19&quot;; fi` `if &#x5B; -f \/u01\/grid\/19c\/lib\/libavclient19.a ] ; then echo &quot;-lavclient19&quot; ; fi` -lknlopt -lslax19 -lpls19  -lrt -lplp19 -ljavavm19 -lserver19  -lwwg  \n`cat \/u01\/grid\/19c\/lib\/ldflags`    -lncrypt19 -lnsgr19 -lnzjs19 -ln19 -lnl19 -lngsmshd19 -lnro19 `cat \/u01\/grid\/19c\/lib\/ldflags`    -lncrypt19 -lnsgr19 -lnzjs19 -ln19 -lnl19 -lngsmshd19 \n-lnnzst19 -lzt19 -lztkg19 -lmm -lsnls19 -lnls19  -lcore19 -lsnls19 -lnls19 -lcore19 -lsnls19 -lnls19 -lxml19 -lcore19 -lunls19 -lsnls19 -lnls19 -lcore19 -lnls19 -lztkg19 \n`cat \/u01\/grid\/19c\/lib\/ldflags`    -lncrypt19 -lnsgr19 -lnzjs19 -ln19 -lnl19 -lngsmshd19 -lnro19 `cat \/u01\/grid\/19c\/lib\/ldflags`    -lncrypt19 -lnsgr19 -lnzjs19 -ln19 -lnl19 -lngsmshd19 \n-lnnzst19 -lzt19 -lztkg19   -lsnls19 -lnls19  -lcore19 -lsnls19 -lnls19 -lcore19 -lsnls19 -lnls19 -lxml19 -lcore19 -lunls19 -lsnls19 -lnls19 -lcore19 -lnls19 `if \/usr\/bin\/ar \ntv \/u01\/grid\/19c\/rdbms\/lib\/libknlopt.a | grep &quot;kxmnsd.o&quot; &gt; \/dev\/null 2&gt;&amp;1 ; then echo &quot; &quot; ; else echo &quot;-lordsdo19 -lserver19&quot;; fi` -L\/u01\/grid\/19c\/ctx\/lib\/ -lctxc19 -lctx19 -lzx19 -lgx19 \n-lctx19 -lzx19 -lgx19 -lclscest19 -loevm -lclsra19 -ldbcfg19 -lhasgen19 -lskgxn2 -lnnzst19 -lzt19 -lxml19 -lgeneric19 -locr19 -locrb19 -locrutl19 -lhasgen19 -lskgxn2 -lnnzst19 -lzt19 -lxml19 \n-lgeneric19  -lgeneric19 -lorazip -loraz -llzopro5 -lorabz2 -lorazstd -loralz4 -lipp_z -lipp_bz2 -lippdc -lipps -lippcore  -lippcp -lsnls19 -lnls19  -lcore19 -lsnls19 -lnls19 -lcore19 \n-lsnls19 -lnls19 -lxml19 -lcore19 -lunls19 -lsnls19 -lnls19 -lcore19 -lnls19 -lsnls19 -lunls19  -lsnls19 -lnls19  -lcore19 -lsnls19 -lnls19 -lcore19 -lsnls19 -lnls19 -lxml19 -lcore19 \n-lunls19 -lsnls19 -lnls19 -lcore19 -lnls19 -lasmclnt19 -lcommon19 -lcore19  -ledtn19 -laio -lons  -lmql1 -lipc1 -lfthread19    `cat \/u01\/grid\/19c\/lib\/sysliblist` -Wl,-rpath,\/u01\/grid\/19c\/lib \n-lm    `cat \/u01\/grid\/19c\/lib\/sysliblist` -ldl -lm   -L\/u01\/grid\/19c\/lib `test -x \/usr\/bin\/hugeedit -a -r \/usr\/lib64\/libhugetlbfs.so &amp;&amp; test -r \/u01\/grid\/19c\/rdbms\/lib\/shugetlbfs.o &amp;&amp; echo \n-Wl,-zcommon-page-size=2097152 -Wl,-zmax-page-size=2097152 -lhugetlbfs`\nrm -f \/u01\/grid\/19c\/bin\/oracle\nmv \/u01\/grid\/19c\/rdbms\/lib\/oracle \/u01\/grid\/19c\/bin\/oracle\nchmod 6751 \/u01\/grid\/19c\/bin\/oracle\n(if &#x5B; ! -f \/u01\/grid\/19c\/bin\/crsd.bin ]; then \\\n    getcrshome=&quot;\/u01\/grid\/19c\/srvm\/admin\/getcrshome&quot; ; \\\n    if &#x5B; -f &quot;$getcrshome&quot; ]; then \\\n        crshome=&quot;`$getcrshome`&quot;; \\\n        if &#x5B; -n &quot;$crshome&quot; ]; then \\\n            if &#x5B; $crshome != \/u01\/grid\/19c ]; then \\\n                oracle=&quot;\/u01\/grid\/19c\/bin\/oracle&quot;; \\\n                $crshome\/bin\/setasmgidwrap oracle_binary_path=$oracle; \\\n            fi \\\n        fi \\\n    fi \\\nfi\\\n);\n\n\n&#x5B;oracle@ocm200 19c]$ sudo chown root bin\/\n&#x5B;oracle@ocm200 19c]$ sudo chmod 750 bin\/\n&#x5B;oracle@ocm200 19c]$\n&#x5B;oracle@ocm200 19c]$ ls -l | grep bin\ndrwxr-x---.  2 root   oinstall     12288 Nov  2 07:42 bin\n\n\n&#x5B;oracle@ocm200 ~]$ crsctl start has\nCRS-4123: Oracle High Availability Services has been started.\n\n<\/pre>\n<p>Cool, now we got unified auditing enabled for our ASM instance.<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nSQL&gt; SELECT VALUE FROM V$OPTION WHERE PARAMETER = 'Unified Auditing';\n\nVALUE\n----------------------------------------------------------------\nTRUE\n<\/pre>\n<p>After the startup of ASM, you should already see the first unified audit trail entries, which are<br \/>\nexposed via the v$unified_audit_trail view.<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nSQL&gt; select count(*) from v$unified_audit_trail;\n\n  COUNT(*)\n----------\n        44\n\n<\/pre>\n<p>And you will see the audit*bin files as well.<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n&#x5B;oracle@ocm200 +ASM]$ pwd\n\/u01\/app\/oracle\/audit\/+ASM\n&#x5B;oracle@ocm200 +ASM]$ ls -la\ntotal 52\ndrwxr-x---. 2 oracle oinstall   158 Nov  2 07:52 .\ndrwxr-x---. 4 oracle oinstall    29 Nov  2 07:44 ..\n-rw-------. 1 oracle oinstall  1024 Nov  2 07:44 ora_audit_00.bin\n-rw-------. 1 oracle oinstall 10752 Nov  2 07:51 ora_audit_0148.bin\n-rw-------. 1 oracle oinstall 13312 Nov  2 07:52 ora_audit_0289.bin\n-rw-------. 1 oracle oinstall  9728 Nov  2 07:44 ora_audit_0424.bin\n-rw-------. 1 oracle oinstall  3584 Nov  2 07:44 ora_audit_0430.bin\n-rw-------. 1 oracle oinstall  3072 Nov  2 07:52 ora_audit_06.bin\n<\/pre>\n<h3>How to configure some basic purging policies for the unified audit trail<\/h3>\n<p>After we have compiled the oracle binary, we can start with the unified audit configuration.<\/p>\n<p>Oracle 19c delivers a whole bunch of tools for managing the audit trail. In total there are 16 tools and all of them are part of the ASMCMD command.<\/p>\n[table \u201c1\u201d not found \/]<br \/>\n\n<p>&nbsp;<\/p>\n<p>Let&#8217;s start with one of them, to set max age to 14 days and max size to 1048576 KB for unified auditing<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nASMCMD&gt; audsetproperty --file_max_age --val 14 --uni\nASMCMD&gt; audsetproperty --file_max_size --val 1048576 --uni\n<\/pre>\n<p>In case you prefer OS auditing, you simply need to switch from &#8211;uni to &#8211;os.<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nASMCMD&gt; audsetproperty --file_max_age --val 14 --os\nASMCMD&gt; audsetproperty --file_max_size --val 1048576 --os\n\nASMCMD&gt; lsaudconfigparams\nType   Parameter Name             Parameter Value            Parameter Unit\n       FILE MAX SIZE              1048576                    KB\n       FILE MAX SIZE              1048576                    KB\n       FILE MAX AGE               14                         Day(s)\n       FILE MAX AGE               14                         Day(s)\n       AUDIT TRACE LEVEL          ERROR\n       AUDFILE_DISKGROUP\nASMCMD&gt;\n<\/pre>\n<p>To set the timestamp used by audit purge job and audcleanaudittrail use the audsettimestamp command.<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nASMCMD&gt; audsettimestamp --uni 02-NOV-2020 14:00:00\nASMCMD&gt;\n\nASMCMD&gt; audshowtimestamp\nType   Last Archived\nUNI    02-NOV-20 02.00.00.000000 PM +00:00\nASMCMD&gt;\n<\/pre>\n<p>Now we can create the audit purge job for the ASM audit files. This can be achieved by issuing the audcreatejob command, which comes with the following options.<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nDescription\n        The options for audcreatejob command are described below\n      --name          -  to specify name of the purge job\n      &lt;job_name&gt;      -  name of the purge job\n      --int           -  to specify purge interval in hours\n      &lt;purge_int&gt;     -  interval used to purge\n      --os            -  audit files of OS trail type\n      --uni           -  audit files of unified audit trail type\n      --no_use        -  ignore the timestamp specified earlier\n\n<\/pre>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nASMCMD&gt; audcreatejob --name ASMAUDITPURGE --int 12 --uni\nASMCMD&gt;\n\nASMCMD&gt; lsaudcleanupjobs\nType   Name                      Status     Frequency\nUNI    ASMAUDITPURGE             ENABLED    12\n<\/pre>\n<p>Or in case of a space pressure, you can manually delete all unified audit trail records one shot.<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\n&#x5B;oracle@ocm200 +ASM]$ ls -l\ntotal 76\n-rw-------. 1 oracle oinstall  1024 Nov  2 07:44 ora_audit_00.bin\n-rw-------. 1 oracle oinstall 20480 Nov  2 08:03 ora_audit_0148.bin\n-rw-------. 1 oracle oinstall 28160 Nov  2 08:04 ora_audit_0289.bin\n-rw-------. 1 oracle oinstall  9728 Nov  2 07:44 ora_audit_0424.bin\n-rw-------. 1 oracle oinstall  3584 Nov  2 07:44 ora_audit_0430.bin\n-rw-------. 1 oracle oinstall  6656 Nov  2 08:03 ora_audit_06.bin\n&#x5B;oracle@ocm200 +ASM]$\n\nASMCMD&gt; audcleanaudittrail --uni\nASMCMD&gt;\n\n&#x5B;oracle@ocm200 +ASM]$\n&#x5B;oracle@ocm200 +ASM]$ ll\ntotal 4\n-rw-------. 1 oracle oinstall 2560 Nov  2 08:04 ora_audit_0289.bin\n&#x5B;oracle@ocm200 +ASM]$\n<\/pre>\n<p>As mention beforehand, the unified audit trails are exposed via the v$unified_audit_trail. Via this view you can scan for any suspicious behavior in your ASM instance.<\/p>\n<pre class=\"brush: plain; title: ; notranslate\" title=\"\">\nSQL&gt; set linesize 144\nSQL&gt; set pagesize 1024\nSQL&gt; col os_user format a8\nSQL&gt; col sql_text format a88\nSQL&gt; col EVENT_TIMESTAMP format a28\nSQL&gt; set long 10000\nSQL&gt; SELECT OS_USER, EVENT_TIMESTAMP, SQL_TEXT FROM v$unified_audit_trail ORDER BY EVENT_TIMESTAMP;\n\nOS_USER  EVENT_TIMESTAMP              SQL_TEXT\n-------- ---------------------------- ----------------------------------------------------------------------------------------\noracle   02-NOV-20 01.04.41.000650 PM   DECLARE\n                                          bool_val BOOLEAN;\n                                        BEGIN\n                                          IF :usetimestamp = 0 THEN\n                                            bool_val := FALSE;\n                                          ELSE\n                                            bool_val := TRUE;\n                                          END IF;\n\n                                          dbms_audit_mgmt.clean_audit_trail(:trailtype, bool_val);\n                                        END;\n\noracle   02-NOV-20 01.06.50.335987 PM SELECT a.state, b.startup_time FROM v$asm_diskgroup_stat a, v$instance b WHERE a.name =\n                                      :1  \/* asm agent *\/\/* {0:0:2} *\/\n\noracle   02-NOV-20 01.06.50.387623 PM SELECT a.state, b.startup_time FROM v$asm_diskgroup_stat a, v$instance b WHERE a.name =\n                                      :1  \/* asm agent *\/\/* {0:0:2} *\/\n\noracle   02-NOV-20 01.08.30.434801 PM SELECT a.state, b.startup_time FROM v$asm_diskgroup_stat a, v$instance b WHERE a.name =\n                                      :1  \/* asm agent *\/\/* {0:0:2} *\/\n\noracle   02-NOV-20 01.08.30.472994 PM SELECT a.state, b.startup_time FROM v$asm_diskgroup_stat a, v$instance b WHERE a.name =\n                                      :1  \/* asm agent *\/\/* {0:0:2} *\/\n\n\n<\/pre>\n<h3>Conclusion<\/h3>\n<p>In case you are interested in what is going on in your ASM instance, you might want to consider enabling unified auditing. It can help you in identifying suspicious behavior.<\/p>\n<p>Cheers<br \/>\nWilliam<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Do you know what is going on in your Oracle database? Probably yes, because you have implemented auditing and check the audit trail regularly. But do you know what is going on in your Oracle ASM instance? Probably not, because not many in the Oracle wild take care of this one. However, under some circumstance [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ocean_post_layout":"","ocean_both_sidebars_style":"","ocean_both_sidebars_content_width":0,"ocean_both_sidebars_sidebars_width":0,"ocean_sidebar":"","ocean_second_sidebar":"","ocean_disable_margins":"enable","ocean_add_body_class":"","ocean_shortcode_before_top_bar":"","ocean_shortcode_after_top_bar":"","ocean_shortcode_before_header":"","ocean_shortcode_after_header":"","ocean_has_shortcode":"","ocean_shortcode_after_title":"","ocean_shortcode_before_footer_widgets":"","ocean_shortcode_after_footer_widgets":"","ocean_shortcode_before_footer_bottom":"","ocean_shortcode_after_footer_bottom":"","ocean_display_top_bar":"default","ocean_display_header":"default","ocean_header_style":"","ocean_center_header_left_menu":"","ocean_custom_header_template":"","ocean_custom_logo":0,"ocean_custom_retina_logo":0,"ocean_custom_logo_max_width":0,"ocean_custom_logo_tablet_max_width":0,"ocean_custom_logo_mobile_max_width":0,"ocean_custom_logo_max_height":0,"ocean_custom_logo_tablet_max_height":0,"ocean_custom_logo_mobile_max_height":0,"ocean_header_custom_menu":"","ocean_menu_typo_font_family":"","ocean_menu_typo_font_subset":"","ocean_menu_typo_font_size":0,"ocean_menu_typo_font_size_tablet":0,"ocean_menu_typo_font_size_mobile":0,"ocean_menu_typo_font_size_unit":"px","ocean_menu_typo_font_weight":"","ocean_menu_typo_font_weight_tablet":"","ocean_menu_typo_font_weight_mobile":"","ocean_menu_typo_transform":"","ocean_menu_typo_transform_tablet":"","ocean_menu_typo_transform_mobile":"","ocean_menu_typo_line_height":0,"ocean_menu_typo_line_height_tablet":0,"ocean_menu_typo_line_height_mobile":0,"ocean_menu_typo_line_height_unit":"","ocean_menu_typo_spacing":0,"ocean_menu_typo_spacing_tablet":0,"ocean_menu_typo_spacing_mobile":0,"ocean_menu_typo_spacing_unit":"","ocean_menu_link_color":"","ocean_menu_link_color_hover":"","ocean_menu_link_color_active":"","ocean_menu_link_background":"","ocean_menu_link_hover_background":"","ocean_menu_link_active_background":"","ocean_menu_social_links_bg":"","ocean_menu_social_hover_links_bg":"","ocean_menu_social_links_color":"","ocean_menu_social_hover_links_color":"","ocean_disable_title":"default","ocean_disable_heading":"default","ocean_post_title":"","ocean_post_subheading":"","ocean_post_title_style":"","ocean_post_title_background_color":"","ocean_post_title_background":0,"ocean_post_title_bg_image_position":"","ocean_post_title_bg_image_attachment":"","ocean_post_title_bg_image_repeat":"","ocean_post_title_bg_image_size":"","ocean_post_title_height":0,"ocean_post_title_bg_overlay":0.5,"ocean_post_title_bg_overlay_color":"","ocean_disable_breadcrumbs":"default","ocean_breadcrumbs_color":"","ocean_breadcrumbs_separator_color":"","ocean_breadcrumbs_links_color":"","ocean_breadcrumbs_links_hover_color":"","ocean_display_footer_widgets":"default","ocean_display_footer_bottom":"default","ocean_custom_footer_template":"","ocean_post_oembed":"","ocean_post_self_hosted_media":"","ocean_post_video_embed":"","ocean_link_format":"","ocean_link_format_target":"self","ocean_quote_format":"","ocean_quote_format_link":"post","ocean_gallery_link_images":"on","ocean_gallery_id":[],"footnotes":""},"categories":[4],"tags":[14,18],"class_list":["post-86","post","type-post","status-publish","format-standard","hentry","category-oracle","tag-asm","tag-oracle","entry"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v26.6 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>How To Implement Unified Auditing For An Oracle 19c ASM Instance - ptdb - Platinum DB<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/ptdb.ch\/?p=86\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How To Implement Unified Auditing For An Oracle 19c ASM Instance - ptdb - Platinum DB\" \/>\n<meta property=\"og:description\" content=\"Do you know what is going on in your Oracle database? Probably yes, because you have implemented auditing and check the audit trail regularly. But do you know what is going on in your Oracle ASM instance? Probably not, because not many in the Oracle wild take care of this one. However, under some circumstance [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/ptdb.ch\/?p=86\" \/>\n<meta property=\"og:site_name\" content=\"ptdb - Platinum DB\" \/>\n<meta property=\"article:published_time\" content=\"2020-11-03T12:50:01+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"10 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/ptdb.ch\/?p=86\",\"url\":\"https:\/\/ptdb.ch\/?p=86\",\"name\":\"How To Implement Unified Auditing For An Oracle 19c ASM Instance - ptdb - Platinum DB\",\"isPartOf\":{\"@id\":\"https:\/\/ptdb.ch\/#website\"},\"datePublished\":\"2020-11-03T12:50:01+00:00\",\"author\":{\"@id\":\"https:\/\/ptdb.ch\/#\/schema\/person\/0b7baf52d23e71d85e1c95442306090b\"},\"breadcrumb\":{\"@id\":\"https:\/\/ptdb.ch\/?p=86#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/ptdb.ch\/?p=86\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/ptdb.ch\/?p=86#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/ptdb.ch\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How To Implement Unified Auditing For An Oracle 19c ASM Instance\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/ptdb.ch\/#website\",\"url\":\"https:\/\/ptdb.ch\/\",\"name\":\"ptdb - Platinum DB\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/ptdb.ch\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/ptdb.ch\/#\/schema\/person\/0b7baf52d23e71d85e1c95442306090b\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/ptdb.ch\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/1a3dffc48c5f6bae0b88a9f0b2a986d48d322673fbc2880c5abbfab96e45da8a?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/1a3dffc48c5f6bae0b88a9f0b2a986d48d322673fbc2880c5abbfab96e45da8a?s=96&d=mm&r=g\",\"caption\":\"admin\"},\"sameAs\":[\"https:\/\/ptdb.ch\"],\"url\":\"https:\/\/ptdb.ch\/?author=1\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"How To Implement Unified Auditing For An Oracle 19c ASM Instance - ptdb - Platinum DB","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/ptdb.ch\/?p=86","og_locale":"en_US","og_type":"article","og_title":"How To Implement Unified Auditing For An Oracle 19c ASM Instance - ptdb - Platinum DB","og_description":"Do you know what is going on in your Oracle database? Probably yes, because you have implemented auditing and check the audit trail regularly. But do you know what is going on in your Oracle ASM instance? Probably not, because not many in the Oracle wild take care of this one. However, under some circumstance [&hellip;]","og_url":"https:\/\/ptdb.ch\/?p=86","og_site_name":"ptdb - Platinum DB","article_published_time":"2020-11-03T12:50:01+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"Written by":"admin","Est. reading time":"10 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/ptdb.ch\/?p=86","url":"https:\/\/ptdb.ch\/?p=86","name":"How To Implement Unified Auditing For An Oracle 19c ASM Instance - ptdb - Platinum DB","isPartOf":{"@id":"https:\/\/ptdb.ch\/#website"},"datePublished":"2020-11-03T12:50:01+00:00","author":{"@id":"https:\/\/ptdb.ch\/#\/schema\/person\/0b7baf52d23e71d85e1c95442306090b"},"breadcrumb":{"@id":"https:\/\/ptdb.ch\/?p=86#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/ptdb.ch\/?p=86"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/ptdb.ch\/?p=86#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/ptdb.ch\/"},{"@type":"ListItem","position":2,"name":"How To Implement Unified Auditing For An Oracle 19c ASM Instance"}]},{"@type":"WebSite","@id":"https:\/\/ptdb.ch\/#website","url":"https:\/\/ptdb.ch\/","name":"ptdb - Platinum DB","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/ptdb.ch\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/ptdb.ch\/#\/schema\/person\/0b7baf52d23e71d85e1c95442306090b","name":"admin","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/ptdb.ch\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/1a3dffc48c5f6bae0b88a9f0b2a986d48d322673fbc2880c5abbfab96e45da8a?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/1a3dffc48c5f6bae0b88a9f0b2a986d48d322673fbc2880c5abbfab96e45da8a?s=96&d=mm&r=g","caption":"admin"},"sameAs":["https:\/\/ptdb.ch"],"url":"https:\/\/ptdb.ch\/?author=1"}]}},"_links":{"self":[{"href":"https:\/\/ptdb.ch\/index.php?rest_route=\/wp\/v2\/posts\/86","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ptdb.ch\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ptdb.ch\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ptdb.ch\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/ptdb.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=86"}],"version-history":[{"count":0,"href":"https:\/\/ptdb.ch\/index.php?rest_route=\/wp\/v2\/posts\/86\/revisions"}],"wp:attachment":[{"href":"https:\/\/ptdb.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=86"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ptdb.ch\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=86"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ptdb.ch\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=86"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}