The Geek Diary

Manage ASM Audit Files with syslog – configure lograte and auditing

by

The audit file destination directories for an ASM instance can grow to contain a very large number of files if they are not regularly maintained. Having a very large number of files can cause the file system to run out of free disk space or inodes, or can cause Oracle to run very slowly due to file system directory scaling limits, which can have the appearance that the ASM instance is hanging on startup.

This post explains how to use the Linux syslog facility to manage ASM auditing records so that ASM auditing records are recorded by the operating system syslog facility instead of individual files in the audit_dump_dest directory.

These steps must be performed for the ASM instance on every database server. This document explains how to manage the auditing records for ASM instances only.

Configuration

These steps must be performed for the ASM instance on every database server.

Step 1 – Set ASM initialization parameters AUDIT_SYSLOG_LEVEL and AUDIT_SYS_OPERATIONS

In the ASM initialization file, set parameters AUDIT_SYSLOG_LEVEL and AUDIT_SYS_OPERATIONS to the following values:

AUDIT_SYSLOG_LEVEL='local0.info'
AUDIT_SYS_OPERATIONS=TRUE

Step 2 – Configure /etc/syslog.conf for ASM auditing

Configure syslog configuration file /etc/syslog.conf or /etc/rsyslog.conf for ASM auditing by making the following two changes:

1. Add the following line in /etc/syslog.conf or /etc/rsyslog.conf

local0.info   /var/log/asmaudit.log

2. To the line that configures logging for /var/log/messages in /etc/syslog.conf, add local0.none. For example:

*.info;mail.none;authpriv.none;cron.none;local0.none   /var/log/messages

Step 3 – Configure logrotate to manage syslog log files

The Linux logrotate utility is used to manage the size and number of syslog log files for ASM auditing. Create the file /etc/logrotate.d/asmaudit with the following content:

# vi /etc/logrotate.d/asmaudit
/var/log/asmaudit.log {
  weekly
  rotate 4
  compress
  copytruncate
  delaycompress
  notifempty
}

Step 4 – Restart ASM instances and syslog service

ASM instances and the syslog service must be restarted for the changes to take effect. An ASM instance is restarted by stopping and starting grid infrastructure by using the “crsctl stop” and “crsctl start” commands. This action requires database instances to shutdown. 

# GRID_HOME/grid/bin/crsctl stop cluster
# GRID_HOME/grid/bin/crsctl start cluster

To restart the syslog service, run the “service syslog restart” command:

# service syslog restart
Shutting down kernel logger:                               [  OK  ]
Shutting down system logger:                               [  OK  ]
Starting system logger:                                    [  OK  ]
Starting kernel logger:                                    [  OK  ]

Step 5 – Verify ASM audit records are created in /var/log/asmaudit.log

Verify that a privileged connection to ASM (e.g. SYSDBA or SYSASM connection) result in an entry created in /var/log/asmaudit.log similar to the following:

Oracle Audit[8738]: LENGTH : '142' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[5] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[0]

Troubleshooting

If syslog audit records are recorded in /var/log/messages, then ensure /etc/syslog.conf has been properly configured to add “local0.none” to the /var/log/messages entry.

You May Also Like