I'm trying to extract a field from the Oracle audit logs. For some reason I can't seem to get the regex just right. Any suggestions?
Search:
index=main sourcetype="audit_log" | head 10000 | rex "(?i) DATABASE\s+USER:.+'(?P<DBA>.+)'" | top 50 DBA
Source:
Audit file /u01/app/oracle/admin/prodprt/adump/prodprt1_ora_31495_1.aud
Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit Production
With the Partitioning, Real Application Clusters, Automatic Storage Management, OLAP,
Data Mining and Real Application Testing options
ORACLE_HOME = /u01/app/oracle/product/11.2.0/prodprt
System name: Linux
Node name: prodprtdb01
Release: 2.6.18-164.el5
Version: #1 SMP Thu Sep 3 04:15:13 EDT 2009
Machine: x86_64
Instance name: prodprt1
Redo thread mounted by this instance: 1
... 1 line omitted ...
Unix process pid: 31495, image: oracle@prodprtdb01 (TNS V1-V3)
Tue Mar 1 13:04:28 2011 -07:00
LENGTH : '155'
ACTION :[7] 'CONNECT'
DATABASE USER:[1] '/'
PRIVILEGE :[6] 'SYSDBA'
CLIENT USER:[6] 'oracle'
CLIENT TERMINAL:[0] ''
There probably is no space character before the word "DATABASE" in the data. You probably just need to remove that from the regex (or replace it with a ^
or \v
).
BTW, something like this is probably a useful extraction for Oracle audit log data in general:
props.conf:
[audit_log]
REPORT-orcl_txt_audit = oracle_text_audit_log
transforms.conf:
[oracle_text_audit_log]
REGEX = (^|\v)([\w\s]*\w)\s*:(?:\[\d*\])?\s*([\'\"])?([^\']*)\2
FORMAT = $1::$3
Approximately.
Can you please post the settings (in Oracle) that you use to spit out this level of information? I have a client who really needs all this data but their level of auditing isn't outputting the correct fields yet.
There probably is no space character before the word "DATABASE" in the data. You probably just need to remove that from the regex (or replace it with a ^
or \v
).
BTW, something like this is probably a useful extraction for Oracle audit log data in general:
props.conf:
[audit_log]
REPORT-orcl_txt_audit = oracle_text_audit_log
transforms.conf:
[oracle_text_audit_log]
REGEX = (^|\v)([\w\s]*\w)\s*:(?:\[\d*\])?\s*([\'\"])?([^\']*)\2
FORMAT = $1::$3
Approximately.
Just change [^\']
to [^\'\v]
instead.
Hmm, I tried this and it seems to work now . . . (?im)DATABASE\s+USER:[\d+]\s+'(?P
Thanks, Gkanapathy. That worked for the above search but when I tried to add an extract it will grab the user and everything else (the following 3 lines). I tried to modify the regex to not be greedy with the single quote - but I can't seem to tweak it just right.