Dear community,
I have to implement Oracle 12c audit and save/export audit data to a shared drive on SYSLOG server. Splunk will get the data for this SYSLOG server.
In a configuration like that, what is the best approach?
Mixed auditing with OS in audit_trail? This means the logs will be save in windows syslog, not on that specific shared drive...
Pure auditing? This means I need to create a trigger to export data each minute...
My approach is to define pure audit and create 2 procedures:
Transfer UNIFIED_AUDIT_TRAIL content to SYSLOG server;
Clean up the auditing data from time to time.
I know there's DBConnect but for that I must create a specific user, which I don't want.
Is there a step-by-step guide in windows to implement Oracle 12c auditing?
Thanks