Oracle® Audit Vault

1.1 All Platforms (Single Instance and Oracle RAC)

This section describes known issues and workarounds for single instance and Oracle RAC installations on all platforms.

This section contains:

• The Required Storage Space Calculation Is Not Automatically Updated When Adding Member Disks to the ASM Disk Group

• The Same SYSDBA Password Is Required for Audit Vault and ASM

• An Error Occurs After Selecting a Non-Empty Oracle Home for Agent Installation

• Error File Getting Generated During Audit Vault Server Installation

• The -record Option Is Not Supported

• The Silent Installer Does Not Issue an Error When the SID Is Omitted

• The Silent Installer for the Agent Does Not Validate Against the Server

• Silent Installation May Not Report on a Failed DVCA Command

• Silent Installation Proceeds Even When Variables Are Not Populated

• Manual Cleanup Is Required After Uninstalling the Audit Vault Database

• Audit Vault Server Installer Prints Time Zone on Console When Run for Upgrade

• Deinstalling Upgraded Audit Vault Server Does Not Remove Entry from Oratab File

• Automated Backup Job Not Properly Created with Audit Vault Server Installation

• Errors Appear in Agent Log File After Installing Oracle Audit Vault Agents

"Supplied ASM SYSDBA password is invalid"

Recommendation: Choose a new Oracle Home or a home that contains 
Oracle Database 10g Client Release 1 software of a home that contains 
Oracle Database 10g Release 2 software for installing this product.

Runtime exception during validation of variable :s_racSid 
java.lang.NullPointerException 
        at 
Components.oracle.rdbms.dv.v10_2_0_3_0.CompContext.validate_s_racSid(Unknown 
Source) 
        at 
Components.oracle.rdbms.dv.v10_2_0_3_0.CompContext.validate(Unknown Source) 
        at 
oracle.sysman.oii.oiis.OiisVariable.validate(OiisVariable.java:1409) 
        at 
oracle.sysman.oii.oiis.OiisVariable.validateChildVariables(OiisVariable.java:1836)
        at 
oracle.sysman.oii.oiis.OiisVariable.setValue(OiisVariable.java:1124) 
        at 
oracle.sysman.oii.oiis.OiisVariable.setVariable(OiisVariable.java:2197) 
        at 
oracle.sysman.oii.oiis.OiisCompContext.doOperation(OiisCompContext.java:1093) 
        at 
oracle.sysman.oii.oiif.oiifb.OiifbLinearIterator.iterate(OiifbLinearIterator.java:147) 
        at 
oracle.sysman.oii.oiic.OiicCompsWizEngine.doOperation(OiicCompsWizEngine.java:202) 
        at 
oracle.sysman.oii.oiif.oiifb.OiifbLinearIterator.iterate(OiifbLinearIterator.java:147) 
        at 
oracle.sysman.oii.oiic.OiicInstallSession$OiicSelCompsInstall.doOperation(OiicInstallSession.java:3838) 

./runInstaller -silent -responseFile absolute_path_to_av.rsp_file 

setup.exe -silent -responseFile absolute_path_to_av.rsp_file

'SEVERE:Abnormal program termination. An internal error has occured.
Please provide the following files to Oracle Support :'.

2008/04/29 13:03:38 Thread-10 level of detail(low): error invoking validtion 
for input=agent2 method=validateName 
java.lang.NoClassDefFoundError: javax/servlet/ServletRequest 
    at java.lang.Class.getDeclaredMethods0(Native Method) 
    at java.lang.Class.privateGetDeclaredMethods(Class.java:1655) 
    at java.lang.Class.getMethod0(Class.java:1901) 
    at java.lang.Class.getMethod(Class.java:984) 
    at oracle.av.util.BeanValidator.invoke(BeanValidator.java:49) 
    at oracle.av.util.BeanValidator.validate(BeanValidator.java:97) 
    at 
@ oracle.av.avca.CommandArguments.validateArguments(CommandArguments.java:170) 
    at oracle.av.avca.Avca.startCA(Avca.java:106) 
    at oracle.av.avca.Avca.main(Avca.java:448) 
2008/04/29 13:03:38 Thread-10 level of detail(low): validationg getAgentName 

1.2 All Platforms (RAC) Only

This section describes known issues and workarounds for Oracle RAC installations on all platforms.

This section contains:

• After an Oracle RAC Installation, an Error Is Issued During Creation of the Database

• In an Oracle RAC Environment, an SPFILE Error Is Issued During Installation

Failed to retrieve network listener Resources

Error executing task INIT_AUDIT_SYS_OPERATIONS:java.sql.SQLException:
ORA-32001: write to SPFILE requested but no SPFILE specified at startup
Error executing task INIT_REMOTE_OS_AUTHENT:java.sql.SQLException: ORA-32001:
write to SPFILE requested but no SPFILE specified at startup
Error executing task INIT_REMOTE_OS_ROLES:java.sql.SQLException: ORA-32001:
write to SPFILE requested but no SPFILE specified at startup
Error executing task INIT_OS_ROLES:java.sql.SQLException: ORA-32001: write to
SPFILE requested but no SPFILE specified at startup
Error executing task INIT_SQL92_SECURITY:java.sql.SQLException: ORA-32001:
write to SPFILE requested but no SPFILE specified at startup
Error executing task INIT_OS_AUTHENT_PREFIX:java.sql.SQLException: ORA-32001:
write to SPFILE requested but no SPFILE specified at startup
Error executing task INIT_REMOTE_LOGIN_PASSWORDFILE:java.sql.SQLException:
ORA-32001: write to SPFILE requested but no SPFILE specified at startup
Error executing task INIT_RECYCLEBIN:java.sql.SQLException: ORA-32001: write
to SPFILE requested but no SPFILE specified at startup

audit_sys_operations=TRUE
remote_os_authent=FALSE
remote_os_roles=FALSE
os_roles=FALSE
sql92_security=TRUE
os_authent_prefix=''
remote_login_passwordfile=EXCLUSIVE
recyclebin=OFF

1.3 Linux and UNIX Platforms (Single Instance and Oracle RAC)

This section describes installation and uninstallation issues in Linux and UNIX platforms for single instance and Oracle Real Application Clusters (RAC) installations.

This section contains:

• Oracle Audit Vault Installation Creates an Error Log File

• Accessing Help Displays a Blank Window

EM Configuration issue. 
@ /oracle/av/10.2.3/AV01/av_oh/mycompany.us.oracle.com_ not found. 

1.4 Microsoft Windows Platform

This section contains:

• Special Message for Security Patch Installation in Audit Vault Agent Upgrade

ATTENTION                                   ** 
** 
** 
** Please note that the Security Patch Installation (Patch Deinstallation) is 
** 
** not complete until all the Post Installation (Post Deinstallation) 
** 
** instructions noted in the Readme accompanying this patch, have been  
** 
** successfully completed.

2.1 Audit Vault Source Database Audit Trail Clean-Up Feature Patch

New for this release of Oracle Audit Vault is the integration with a new PL/SQL package, DBMS_AUDIT_MGMT in Oracle Database. The package provides a set of PL/SQL procedures that you can use to perform audit trail clean-up tasks. In addition to this package, four audit trail clean-up related data dictionary views are provided. This functionality will be available in upcoming versions of Oracle Database. To use this functionality in an existing Oracle 10.2.0.3.0 database, you must download and install Patch 6989148 on the Audit Vault source database.

To download and install Patch 6989148:

1. Log in to OracleMetaLink from the following URL:

   http://metalink.oracle.com

2. In Quick Find, select Patch Number from the list of categories. In the second Quick Find field, enter 6989148 for the patch number. Then, click Go.

3. On the Patch 6989148 page, download and install the patch onto the Audit Vault source database, using the instructions in the provided readme file.

This issue is tracked with Oracle bug 6989148.

2.2 Sybase Collector Is Not Available for This Release

The Sybase collector functionality is not available in this release. Contact your Oracle Support representative for more information.

Workaround: None.

This issue is tracked with Oracle bug 7137733.

2.3 Garbled Multi-byte User Name Is Displayed on the Login Page

If you enter an invalid multi-byte user name on the login page for the Audit Vault Console, an error is displayed and the user name is displayed in a garbled manner.

For example, this problem occurs if you do the following:

1. Set the browser to simplified Chinese.

2. Access the Audit Vault Console URL.

3. On the login page, enter an invalid multi-byte user name and then click Login.

Workaround: None.

This issue is tracked with Oracle bug 5899718.

2.4 Subpools for Streams Can Become Too Large

The REDO collector uses Oracle Streams technology to retrieve logical change records (LCRs) from the redo logs. On the source database, a Streams capture process uses LogMiner to extract new LCRs from the redo logs based on capture rules that are defined by the user.

If you configure initialization parameters for a streams pool with subpool durations for instance, session, cursor, and execution, you can receive an ORA-4031 error.

Workaround: Use one of the following:

• Find what allocations made a particular duration subpool too large and change their durations, for example, from session to cursor or execution.

• Combine the durations into one pool using the following initialization parameter in the init.ora initialization file:

  _enable_shared_pool_durations = false
  

  However, be aware that setting this parameter prevents the Streams pool from shrinking.

This issue is tracked with Oracle bug 5919096.

2.5 Need to Enable DV_SECANALYST to Access the DVSYS.AUDIT_TRAIL$ Table

Audit Vault extracts the Oracle Database Vault audit trail records by using the DV_ADMIN or DV_OWNER role to read the contents of the DVSYS.AUDIT_TRAIL$ table for Oracle Database 11g Release 1 (11.1). For better security, Audit Vault should be able to use the DV_SECANALYST role to read the DVSYS.AUDIT_TRAIL$ table.

Workaround:

1. Log in to SQL*Plus as a user who has been granted the DV_OWNER role.

2. Grant the DV_ADMIN role to the user account that was created on the source database for Audit Vault.

This issue is tracked with Oracle bug 7022650.

2.6 Time Values in Reports Do Not Display the Time Zone

The time values displayed in the Oracle Audit Vault reports do not display the time zone. Oracle Audit Vault bases the time zone value the TZ environment variable setting on Linux32 (other platforms vary) that was in place when you start the Audit Vault database. The Home page and all other pages in the Audit Vault Console explicitly use Coordinated Universal Time (UTC) and display the time zone. Therefore, if you start the Audit Vault database in a time zone other than UTC, the timestamps between different parts of the Audit Vault Console are different.

When you install Oracle Audit Vault, Oracle Universal Installer starts the database in UTC. If you then shut down and subsequently restart Audit Vault, time values in the reports can be different. As a result, you cannot determine which time zone in which the report was generated.

Workaround: Always start Oracle Audit Vault using the UTC. For example:

1. In a shell window, set the TZ environment variable to UTC.

   setenv TZ UTC
   

2. Start the listener.

   lsnrctl start
   

3. Start the Audit Vault database.

   sqlplus sys/as sysoper
   Enter password: password
   Connected.
   SQL> startup
   

4. Start the Audit Vault console.

   avctl start_av
   

This issue is tracked with Oracle bug 7027265.

2.7 Audit Vault Duplicates FGA Policies if Policy Name Is Lower Case

If an auditor creates a fine-grained audit policy and then specifies the policy name using lower-case letters, then Oracle Audit Vault creates a duplicate fine-grained audit policy. The duplicate policy uses upper-case letters for the policy name.

Workaround: Use one of the following solutions:

• Choose a different policy name.

• Delete the fine-grained audit policy and then create a new one having same policy name with previous fine-grained audit policy.

This issue is tracked with Oracle bug 6975309.

2.8 SQL Server avmssqldb Command Returns Incorrect Warning Message

When you run the avmssqldb verify or avmssqldb setup command, and if the source user you specify does not have SYSADMIN privilege, then the avmssqldb command returns an error message claiming that you need the SYSADMIN privilege.

This error message is correct for SQL Server 2000 but incorrect for SQL Server 2005. For SQL Server 2005, you do not need the SYSADMIN privilege.

Workaround: You can ignore this message. The command succeeds in spite of the error message.

This issue is tracked with Oracle bug 7122168.

3.1 Long Source Database Name Is Garbled in Top Five Audit Sources by Number of Alerts Graph

If the source database has a long name and appears on the Y-axis of the graph Top Five Audit Sources by Number of Alerts, the graph is squeezed to the point that the X-axis becomes one dimensional and does not show the two-dimensional aspect of the graph.

Workaround: Create a reasonably short source name, about 15 characters long, using the -srcname srcname argument when you add the source to Oracle Audit Vault.

This issue is tracked with Oracle bug 6837441.

3.2 SQL Server Source and Audit Vault Event Times Differ

The source database event time and Audit Vault event times differ for SQL Server. This time difference is small, however.

Table 1 demonstrates this problem. In the values listed in the Audit Vault Timestamp column, there is a trailing, recurring last digit followed by zeros. For some cases, the leading zero is dropped. This could pose problems because the event_time value is usually used as a basis for co-relating events.

Workaround: None.

This issue is tracked with Oracle bug 6890264.

4.1 Collector Startup Can Be Slow

After several restarts, a collector can take a while to start. In most cases, when the avctl start_collector command is successful, the avctl show_collector_status command and Audit Vault Console indicate that the collector is running. However, in some cases the collector status may indicate that it is not running. This can be due to working in a slow environment and it takes more time to respond to the metrics query, or the collector is doing an initialization and recovery.

Workaround: Wait until the startup completes. Operations should be normal after the collector has finished starting. Before reperforming a collector status query, wait a bit longer. The collector status will eventually indicate a running state.

This issue is tracked with Oracle bug 5937597.

4.2 SQL Server Collector Status Not Updated

If you run the Audit Vault SQL Server avmssqldb command on the source database, and then try to start the SQL Server collector, the command succeeds but the collector status remains unchanged. It should show a status indicating that the SQL Server collector has started. To find if this error has occurred, check the $ORACLE_HOME/av/log directory of the Agent and see if the SQL Collector log file has a Generic Wallet Error. If this wallet error is present, then it is most likely this bug.

Typically, you follow these steps:

1. On the Audit Vault Server side, you add the source and collectors as follows:

   avmssqldb add_source -srcname src_name ...
   avmssqldb add_collector -collname collector_name ...
   

2. On the Audit Vault Agent side, you run the following set-up command:

   avmssqldb setup -srcname src_name
   

3. Then, on the Audit Vault Server side, you run these commands:

   avctl start_collector -srcname src_name -collname collector_name
   avctl show_collector_status -srcname src_name -collname collector_name
   

If you omit Step 2, then no error displays when you run the avctl start_collector command in Step 3. When you run the avctl show_collector_status command next, then the status displays a not running message.

Workaround: Run the avmssqldb setup command on the agent, and then restart the collector.

This issue is tracked with Oracle bug 7010699.

4.3 Invalid Path Error Appears in SQL Server Collector Log File

The SQL Server collector log file erroneously states that the directory path specified by the C2_TRACE_FILEPATH attribute setting is incorrect.

Workaround: Specify the complete file name, with the wildcard asterisk (*) instead of .trc in the C2_TRACE_FILEPATH parameter. For example, if the file name is C:\MyTrace.trc, then specify the value C:\MyTrace*.

This issue is tracked with Oracle bug 7030424.

4.4 DBAUD Collector Collects Invalid Object from Oracle Database Vault

Violations to Oracle Database Vault settings (such as command rule violations) are not being properly recorded by the DBAUD collector. The violations are correctly recorded in the Database Vault DVSYS.AUDIT_TRAIL$ audit table. Oracle Audit Vault collects the audit record, but adds it to the Invalid Record audit event category instead of the Database Vault audit event category. The reason the record is invalid is because on Microsoft Windows, the PROCESS# column has a format process#:thread#. This string cannot be converted into number format.

In addition, the DBAUD collector log file includes related errors, similar to the following:

ERROR @ '25/04/2008 02:07:57 09:00':  On line 7613: OCI-22062: invalid input 
string : [3708:3568] 
WARNING @ '25/04/2008 02:07:57 09:00': errors are produced during converting 
column PROCESS# at <3708:3568> 

Workaround: None.

This issue is tracked with Oracle bug 7000223.

4.5 Invalid Error Message Appears After Failed Provisioning

Provisioning an invalid audit setting can result in an invalid error message. This error appears in the Audit Vault Console (under Audit Setting/Overview) after you click the Submit button. For example, suppose an auditor provisions a fine-grained audit policy using a source user who does not have the EXECUTE privilege for the DBMS_FGA PL/SQL package, which is required to create this type of policy. The provisioning will fail, and an error message unrelated to the problem appears, similar to the following:

collector ORCLDB_REDO is not deployed on the source.

Workaround: None.

This issue is tracked with Oracle bug 6994067.

4.6 OS Collector Does Not Pick Up the OSAUD_LOG_LEVEL Parameter from the Database

The OS collector is not reading the OSAUD_LOG_LEVEL parameter. You cannot change this value using the Audit Vault Console.

Workaround:

1. Stop all the collectors running in the agent using the avctl stop_collector command on the server.

2. Stop the agent using the avctl stop_agent command on the server.

3. Stop OC4J using the avctl stop_oc4j command on the agent.

4. Start OC4J using the correct log level (avctl start_oc4j -loglevel error warning info debug).

5. Restart the agent and collectors.

This issue is tracked with Oracle bug 7008473.

4.7 Audit Records from SYSLOG Have the Wrong Date

Some records collected by the OSAUD collector from SYSLOG have the Event Time field set to a value one year in the past. This happens because of a bug in Oracle Audit Vault and because the SYSLOG file format does not contain year and time zone information for the timestamp. As a result, the SYSLOG audit records do not record the debug level. The records are sent to the Audit Vault repository, but the activity graph does not display the records. There are no errors in the OS collector log. This problem occurs if you set the AUDIT_TRAIL initialization parameter to OS and the AUDIT_SYSLOG_LEVEL to syslog.info in the source database. It does not occur for the DB collector, REDO collector, OS Collector(XML), or OS Collector(Aud).

Workaround: None.

This issue is tracked in Oracle bug 7109942.

4.8 XML and SYSLOG Audit Files Are Garbled When Collected by the OSAUD Collector

Multi-bye words collected by the XML collector and SYSLOG audit files are garbled if you do the following in the source database:

• XML: If the source database is configured to send the audit trail to XML or XML, EXTENDED audit files, and the audit trail contains multi-byte characters in non-UTF8 encodings, those characters are garbled in the Audit Vault repository.

• SYSLOG: If the source database is configured to send the audit trail to SYSLOG, and the audit trail contains multi-byte characters in non-UTF8 encodings, those characters are garbled in the Audit Vault repository.

Afterwards, data in the Audit Vault Repository is garbled. This problem occurs even if you start the agent and collector with the correct NLS_LANG set.

Workaround: None.

This issue is tracked with Oracle bug 7045602.

4.9 OSAUD Collector Dies Intermittently When Collecting from SYSLOG

The OSAUD collector dies intermittently when collecting the Oracle Database audit trail from SYSLOG.

Workaround: None.

This issue is tracked with Oracle bug 7151126.