{"id":11356,"date":"2018-06-20T15:47:55","date_gmt":"2018-06-20T13:47:55","guid":{"rendered":"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/"},"modified":"2018-06-20T15:47:55","modified_gmt":"2018-06-20T13:47:55","slug":"remote-syslog-from-linux-and-solaris","status":"publish","type":"post","link":"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/","title":{"rendered":"Remote syslog from Linux and Solaris"},"content":{"rendered":"<h2>By Franck Pachot<\/h2>\n<p>.<br \/>\nAuditing operations with Oracle Database is very easy. The default configuration, where SYSDBA operations go to &#8216;audit_file_dest&#8217; (the &#8216;adump&#8217; directory) and other operations go to the database may be sufficient to log what is done but is definitely not a correct security audit method as both destinations can have their audit trail deleted by the DBA. If you want to secure your environment by auditing the most privileged accounts, you need to send the audit trail to another server.<\/p>\n<p>This is easy as well and here is a short demo involving Linux and Solaris as the audited environments. I&#8217;ve created those 3 computer services in the Oracle Cloud:<br \/>\n<a href=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/CaptureSyslog000.png\"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/CaptureSyslog000.png\" alt=\"CaptureSyslog000\" width=\"1024\" height=\"71\" class=\"aligncenter size-large wp-image-24456\" \/><\/a><br \/>\n<!--more--><br \/>\nSo, I have an Ubuntu service where I&#8217;ll run the Oracle Database (XE 11g) and the hostname is &#8216;ubuntu&#8217;<\/p>\n<pre><code>\nroot@ubuntu:~# grep PRETTY \/etc\/os-release\nPRETTY_NAME=\"Ubuntu 16.04.4 LTS\"\n<\/code><\/pre>\n<p>I have a Solaris service which will also run Oracle, and the hostname is &#8216;d17872&#8217;<\/p>\n<pre><code>\nroot@d17872:~# cat \/etc\/release\n                             Oracle Solaris 11.3 X86\n  Copyright (c) 1983, 2016, Oracle and\/or its affiliates.  All rights reserved.\n                            Assembled 03 August 2016\n<\/code><\/pre>\n<p>I have an Oracle Enterprise Linux service which will be my audit server, collecting syslog messages from remote hosts, the hostname is &#8216;b5e501&#8217; and the IP address in the PaaS network is 10.29.235.150<\/p>\n<pre><code>\n[root@b5e501 ~]# grep PRETTY \/etc\/os-release\nPRETTY_NAME=\"Oracle Linux Server 7.5\"\n<\/code><\/pre>\n<h3>Testing local syslog<\/h3>\n<p>I start to ensure that syslog works correctly on my audit server:<\/p>\n<pre><code>\n[root@b5e501 ~]# jobs\n[1]+  Running                 tail -f \/var\/log\/messages &amp;\n[root@b5e501 ~]#\n[root@b5e501 ~]# logger -p local1.info \"hello from $HOSTNAME\"\n[root@b5e501 ~]# Jun 20 08:28:35 b5e501 bitnami: hello from b5e501\n<\/code><\/pre>\n<h3>Remote setting<\/h3>\n<p>On the aduit server, I un-comment the lines about receiving syslog from TCP and UDP on port 514<\/p>\n<pre><code>\n[root@b5e501 ~]# grep -iE \"TCP|UDP\" \/etc\/rsyslog.conf\n# Provides UDP syslog reception\n$ModLoad imudp\n$UDPServerRun 514\n# Provides TCP syslog reception\n$ModLoad imtcp\n$InputTCPServerRun 514\n# Remote Logging (we use TCP for reliable delivery)\n<\/code><\/pre>\n<p>I restart syslog service<\/p>\n<pre><code>\n[root@b5e501 ~]# systemctl restart rsyslog\nJun 20 08:36:47 b5e501 systemd: Stopping System Logging Service...\nJun 20 08:36:47 b5e501 rsyslogd: [origin software=\"rsyslogd\" swVersion=\"8.24.0\" x-pid=\"2769\" x-info=\"http:\/\/www.rsyslog.com\"] exiting on signal 15.\nJun 20 08:36:47 b5e501 systemd: Starting System Logging Service...\nJun 20 08:36:47 b5e501 rsyslogd: [origin software=\"rsyslogd\" swVersion=\"8.24.0\" x-pid=\"2786\" x-info=\"http:\/\/www.rsyslog.com\"] start\nJun 20 08:36:47 b5e501 systemd: Started System Logging Service.\n<\/code><\/pre>\n<p>I tail the \/var\/log\/messages (which is my default destination for &#8220;*.info;mail.none;authpriv.none;cron.none&#8221;)<\/p>\n<pre><code>\n[root@b5e501 ~]# tail -f \/var\/log\/messages &amp;\n[root@b5e501 ~]# jobs\n[1]+  Running                 tail -f \/var\/log\/messages &amp;\n<\/code><\/pre>\n<p>I test with local1.info and check that the message is tailed even when logger is sending it though the network:<\/p>\n<pre><code>\n[root@b5e501 ~]# logger -n localhost -P 514 -p local1.info \"hello from $HOSTNAME\"\nJun 20 09:18:07 localhost bitnami: hello from b5e501\n<\/code><\/pre>\n<p>That&#8217;s perfect.<\/p>\n<p>Now I can test the same from my Ubuntu host to ensure that the firewall settings allow for TCP and UDP on port 514<\/p>\n<pre><code>\nroot@ubuntu:\/tmp\/Disk1# logger --udp -n 10.29.235.150 -P 514 -p local1.info \"hello from $HOSTNAME in UDP\"\nroot@ubuntu:\/tmp\/Disk1# logger --tcp -n 10.29.235.150 -P 514 -p local1.info \"hello from $HOSTNAME in TCP\"\n<\/code><\/pre>\n<p>Here are the correct messages received:<\/p>\n<pre><code>\nJun 20 09:24:46 ubuntu bitnami hello from ubuntu in UDP\nJun 20 09:24:54 ubuntu bitnami hello from ubuntu in TCP\n<\/code><\/pre>\n<h3>Destination setting for the audit<\/h3>\n<p>As I don&#8217;t want to have all messages into \/var\/log\/messages, I&#8217;m now setting, in the audit server, a dedicated file for &#8220;local1&#8221; facility and &#8220;info&#8221; level that I&#8217;ll use for my Oracle Database audit destination<\/p>\n<pre><code>\n[root@b5e501 ~]# touch \"\/var\/log\/audit.log\"\n[root@b5e501 ~]# echo \"local1.info \/var\/log\/audit.log\" &gt;&gt; \/etc\/rsyslog.conf\n[root@b5e501 ~]# systemctl restart rsyslog\n<\/code><\/pre>\n<p>After testing the same two &#8216;logger&#8217; commands from the remote host I check the entries in my new file:<\/p>\n<pre><code>\n[root@b5e501 ~]# cat \/var\/log\/audit.log\nJun 20 09:55:09 ubuntu bitnami hello from ubuntu in UDP\nJun 20 09:55:16 ubuntu bitnami hello from ubuntu in TCP\n<\/code><\/pre>\n<h3>Remote logging<\/h3>\n<p>Now that I validated that remote syslog is working, I set automatic forwarding of syslog messages on my Ubuntu box to send all &#8216;local1.info to the audit server&#8217;:<\/p>\n<pre><code>\nroot@ubuntu:\/tmp\/Disk1# echo \"local1.info @10.29.235.150:514\" &gt;&gt; \/etc\/rsyslog.conf\nroot@ubuntu:\/tmp\/Disk1# systemctl restart rsyslog\n<\/code><\/pre>\n<p>This, with a single &#8216;@&#8217; forwards in UDP. You can double the &#8216;@&#8217; to forward using TCP.<\/p>\n<p>Here I check with logger in local (no mention of the syslog host here):<\/p>\n<pre><code>\nroot@ubuntu:\/tmp\/Disk1# logger -p local1.info \"hello from $HOSTNAME with forwarding\"\n<\/code><\/pre>\n<p>and I verify that the message is logged in the audit server into \/var\/log\/audit.log<\/p>\n<pre><code>\n[root@b5e501 ~]# tail -1 \/var\/log\/audit.log\nJun 20 12:00:25 ubuntu bitnami: hello from ubuntu with forwarding\n<\/code><\/pre>\n<h3>Repeated messages<\/h3>\n<p>Note that when testing, you may add &#8220;$(date)&#8221; to your message in order to see it immediately because syslog keeps the message to avoid flooding when the message is repeated. This:<\/p>\n<pre><code>\nroot@ubuntu:\/tmp\/Disk1# logger -p local1.info \"Always the same message\"\nroot@ubuntu:\/tmp\/Disk1# logger -p local1.info \"Always the same message\"\nroot@ubuntu:\/tmp\/Disk1# logger -p local1.info \"Always the same message\"\nroot@ubuntu:\/tmp\/Disk1# logger -p local1.info \"Always the same message\"\nroot@ubuntu:\/tmp\/Disk1# logger -p local1.info \"Always the same message\"\nroot@ubuntu:\/tmp\/Disk1# logger -p local1.info \"Always the same message\"\nroot@ubuntu:\/tmp\/Disk1# logger -p local1.info \"Then another one\"\n<\/code><\/pre>\n<p>is logged as this:<\/p>\n<pre><code>\nJun 20 12:43:12 ubuntu bitnami: message repeated 5 times: [ Always the same message]\nJun 20 12:43:29 ubuntu bitnami: Then another one\n<\/code><\/pre>\n<p>I hope that one day this idea will be implemented by Oracle when flooding messages to the alert.log \ud83d\ude09<\/p>\n<h3>Oracle Instance<\/h3>\n<p>The last step is to get my Oracle instance sending audit message to the local syslog, with facility.level local1.info so that they will be automatically forwarded to my audit server. I have to set audit_syslog_level to &#8216;local1.info&#8217; and the audit_trail to &#8216;OS&#8217;:<\/p>\n<pre><code>\noracle@ubuntu:~$ sqlplus \/ as sysdba\n&nbsp;\nSQL*Plus: Release 11.2.0.2.0 Production on Wed Jun 20 11:48:00 2018\n&nbsp;\nCopyright (c) 1982, 2011, Oracle.  All rights reserved.\n&nbsp;\nConnected to:\nOracle Database 11g Express Edition Release 11.2.0.2.0 - 64bit Production\n&nbsp;\nSQL&gt; alter system set audit_syslog_level='local1.info' scope=spfile;\n&nbsp;\nSystem altered.\n&nbsp;\nSQL&gt; alter system set audit_trail='OS' scope=spfile;\n&nbsp;\nSystem altered.\n&nbsp;\nSQL&gt; shutdown immediate;\nDatabase closed.\nDatabase dismounted.\nORACLE instance shut down.\nSQL&gt; startup\nORACLE instance started.\n&nbsp;\nTotal System Global Area 1068937216 bytes\nFixed Size                  2233344 bytes\nVariable Size             616565760 bytes\nDatabase Buffers          444596224 bytes\nRedo Buffers                5541888 bytes\nDatabase mounted.\nDatabase opened.\n<\/code><\/pre>\n<p>It is very easy to check that it works as the SYSDBA and the STARTUP are automatically audited. Here is what I can see in my audit server \/var\/log\/audit.log:<\/p>\n<pre><code>\n[root@b5e501 ~]# tail -f \/var\/log\/audit.log\nJun 20 11:55:47 ubuntu Oracle Audit[27066]: LENGTH : '155' ACTION :[7] 'STARTUP' DATABASE USER:[1] '\/' PRIVILEGE :[4] 'NONE' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[13] 'Not Available' STATUS:[1] '0' DBID:[0] ''\nJun 20 11:55:47 ubuntu Oracle Audit[27239]: LENGTH : '148' ACTION :[7] 'CONNECT' DATABASE USER:[1] '\/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[5] 'pts\/0' STATUS:[1] '0' DBID:[0] ''\nJun 20 11:55:51 ubuntu Oracle Audit[27419]: LENGTH : '159' ACTION :[7] 'CONNECT' DATABASE USER:[1] '\/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[5] 'pts\/0' STATUS:[1] '0' DBID:[10] '2860420539'\n<\/code><\/pre>\n<p>In the database server, I have no more files in the adump since this startup:<\/p>\n<pre><code>\noracle@ubuntu:~\/admin\/XE\/adump$ \/bin\/ls -alrt\ntotal 84\ndrwxr-x--- 6 oracle dba 4096 Jun 20 11:42 ..\n-rw-r----- 1 oracle dba  699 Jun 20 11:44 xe_ora_26487_1.aud\n-rw-r----- 1 oracle dba  694 Jun 20 11:44 xe_ora_26515_1.aud\n-rw-r----- 1 oracle dba  694 Jun 20 11:44 xe_ora_26519_1.aud\n-rw-r----- 1 oracle dba  694 Jun 20 11:44 xe_ora_26523_1.aud\ndrwxr-x--- 2 oracle dba 4096 Jun 20 11:48 .\n-rw-r----- 1 oracle dba  896 Jun 20 11:48 xe_ora_26574_1.aud\n<\/code><\/pre>\n<h3>Solaris<\/h3>\n<p>I have also started a Solaris service:<\/p>\n<pre><code>\nopc@d17872:~$ pfexec su -\nPassword: solaris_opc\nsu: Password for user 'root' has expired\nNew Password: Cl0udP01nts\nRe-enter new Password: Cl0udP01nts\nsu: password successfully changed for root\nOracle Corporation      SunOS 5.11      11.3    June 2017\nYou have new mail.\nroot@d17872:~#\n<\/code><\/pre>\n<p>Here, I add the forwarding to \/etc\/syslog.conf (tab is a required separator which cannot be replaced with spaces) and restart the syslog service:<\/p>\n<pre><code>\nroot@d17872:~# echo \"local1.info\\t@10.29.235.150\" &gt;&gt; \/etc\/syslog.conf\nroot@d17872:~# svcadm restart system-log\n<\/code><\/pre>\n<p>Then logging a message locally<\/p>\n<pre><code>\nroot@d17872:~# logger -p local1.info \"hello from $HOSTNAME with forwarding\" \n<\/code><\/pre>\n<p>Here is the messaged received from the audit server:<\/p>\n<pre><code>\n[root@b5e501 ~]# tail -f \/var\/log\/audit.log\nJun 20 05:27:51 d17872.compute-a511644.oraclecloud.internal opc: [ID 702911 local1.info] hello from d17872 with forwarding\n<\/code><\/pre>\n<p>Here in Solaris I have the old &#8216;syslog&#8217; with no syntax to change the UDP port. The default port is defined in \/etc\/services, which is the one I&#8217;ve configured to listen to on my audit server:<\/p>\n<pre><code>\nroot@d17872:~# grep 514 \/etc\/services\nshell           514\/tcp         cmd             # no passwords used\nsyslog          514\/udp\n<\/code><\/pre>\n<p>If you want more features, you can install syslog-ng or rsyslog on Solaris.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>By Franck Pachot . Auditing operations with Oracle Database is very easy. The default configuration, where SYSDBA operations go to &#8216;audit_file_dest&#8217; (the &#8216;adump&#8217; directory) and other operations go to the database may be sufficient to log what is done but is definitely not a correct security audit method as both destinations can have their audit [&hellip;]<\/p>\n","protected":false},"author":27,"featured_media":11357,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[59],"tags":[73,96,1380,1115,1273],"type_dbi":[],"class_list":["post-11356","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-oracle","tag-linux","tag-oracle","tag-remote","tag-solaris","tag-syslog"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.2 (Yoast SEO v27.2) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>Remote syslog from Linux and Solaris - dbi Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Remote syslog from Linux and Solaris\" \/>\n<meta property=\"og:description\" content=\"By Franck Pachot . Auditing operations with Oracle Database is very easy. The default configuration, where SYSDBA operations go to &#8216;audit_file_dest&#8217; (the &#8216;adump&#8217; directory) and other operations go to the database may be sufficient to log what is done but is definitely not a correct security audit method as both destinations can have their audit [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/\" \/>\n<meta property=\"og:site_name\" content=\"dbi Blog\" \/>\n<meta property=\"article:published_time\" content=\"2018-06-20T13:47:55+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/CaptureSyslog000.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1897\" \/>\n\t<meta property=\"og:image:height\" content=\"131\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Oracle Team\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Oracle Team\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/\"},\"author\":{\"name\":\"Oracle Team\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee\"},\"headline\":\"Remote syslog from Linux and Solaris\",\"datePublished\":\"2018-06-20T13:47:55+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/\"},\"wordCount\":689,\"commentCount\":0,\"image\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/CaptureSyslog000.png\",\"keywords\":[\"Linux\",\"Oracle\",\"remote\",\"Solaris\",\"syslog\"],\"articleSection\":[\"Oracle\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/\",\"name\":\"Remote syslog from Linux and Solaris - dbi Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/CaptureSyslog000.png\",\"datePublished\":\"2018-06-20T13:47:55+00:00\",\"author\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/#primaryimage\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/CaptureSyslog000.png\",\"contentUrl\":\"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/CaptureSyslog000.png\",\"width\":1897,\"height\":131},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Accueil\",\"item\":\"https:\/\/www.dbi-services.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Remote syslog from Linux and Solaris\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#website\",\"url\":\"https:\/\/www.dbi-services.com\/blog\/\",\"name\":\"dbi Blog\",\"description\":\"\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee\",\"name\":\"Oracle Team\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g\",\"caption\":\"Oracle Team\"},\"url\":\"https:\/\/www.dbi-services.com\/blog\/author\/oracle-team\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Remote syslog from Linux and Solaris - dbi Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/","og_locale":"en_US","og_type":"article","og_title":"Remote syslog from Linux and Solaris","og_description":"By Franck Pachot . Auditing operations with Oracle Database is very easy. The default configuration, where SYSDBA operations go to &#8216;audit_file_dest&#8217; (the &#8216;adump&#8217; directory) and other operations go to the database may be sufficient to log what is done but is definitely not a correct security audit method as both destinations can have their audit [&hellip;]","og_url":"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/","og_site_name":"dbi Blog","article_published_time":"2018-06-20T13:47:55+00:00","og_image":[{"width":1897,"height":131,"url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/CaptureSyslog000.png","type":"image\/png"}],"author":"Oracle Team","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Oracle Team","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/#article","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/"},"author":{"name":"Oracle Team","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee"},"headline":"Remote syslog from Linux and Solaris","datePublished":"2018-06-20T13:47:55+00:00","mainEntityOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/"},"wordCount":689,"commentCount":0,"image":{"@id":"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/CaptureSyslog000.png","keywords":["Linux","Oracle","remote","Solaris","syslog"],"articleSection":["Oracle"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/","url":"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/","name":"Remote syslog from Linux and Solaris - dbi Blog","isPartOf":{"@id":"https:\/\/www.dbi-services.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/#primaryimage"},"image":{"@id":"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/#primaryimage"},"thumbnailUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/CaptureSyslog000.png","datePublished":"2018-06-20T13:47:55+00:00","author":{"@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee"},"breadcrumb":{"@id":"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/#primaryimage","url":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/CaptureSyslog000.png","contentUrl":"https:\/\/www.dbi-services.com\/blog\/wp-content\/uploads\/sites\/2\/2022\/04\/CaptureSyslog000.png","width":1897,"height":131},{"@type":"BreadcrumbList","@id":"https:\/\/www.dbi-services.com\/blog\/remote-syslog-from-linux-and-solaris\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Accueil","item":"https:\/\/www.dbi-services.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Remote syslog from Linux and Solaris"}]},{"@type":"WebSite","@id":"https:\/\/www.dbi-services.com\/blog\/#website","url":"https:\/\/www.dbi-services.com\/blog\/","name":"dbi Blog","description":"","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.dbi-services.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/www.dbi-services.com\/blog\/#\/schema\/person\/66ab87129f2d357f09971bc7936a77ee","name":"Oracle Team","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/f711f7cd2c9b09bf2627133755b569fb5be0694810cfd33033bdd095fedba86d?s=96&d=mm&r=g","caption":"Oracle Team"},"url":"https:\/\/www.dbi-services.com\/blog\/author\/oracle-team\/"}]}},"_links":{"self":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/11356","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/comments?post=11356"}],"version-history":[{"count":0,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/posts\/11356\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media\/11357"}],"wp:attachment":[{"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/media?parent=11356"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/categories?post=11356"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/tags?post=11356"},{"taxonomy":"type","embeddable":true,"href":"https:\/\/www.dbi-services.com\/blog\/wp-json\/wp\/v2\/type_dbi?post=11356"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}