Skip Headers

Oracle® Audit Vault Administrator's Guide Release 10.2.3.1 Part Number E13841-02 |
Home | Book List | Contents | Index | Contact Us

Previous | Next
| View PDF

# 3 Managing Oracle Audit Vault

This chapter contains:

- About Managing Oracle Audit Vault

- Managing the Audit Vault Server

- Altering Collector Properties and Attributes

- Managing the Oracle Audit Vault Data Warehouse

- Altering Source Database Attributes

- Removing Source Databases from Oracle Audit Vault

## 3.1 About Managing Oracle Audit Vault

This chapter describes common management activities that you need to perform after you have completed the configuration tasks in Chapter 2. You can use the Audit Vault Console or the command-line tools described in this chapter to manage Oracle Audit Vault.

## 3.2 Managing the Audit Vault Server

This section contains:

- About Managing the Audit Vault Console

- Checking the Audit Vault Console Status

- Starting the Audit Vault Console

- Stopping the Audit Vault Server Console

- Globally Disabling and Enabling Alert Settings

- Viewing Audit Event Categories

- Viewing Operational Errors That Oracle Audit Vault Catches

### 3.2.1 About Managing the Audit Vault Console

The Audit Vault Console is a graphical user interface that you can use to perform commonly used Oracle Audit Vault administration tasks. If you prefer to use a command-line interface, you can use equivalent commands in the `AVCA` and `AVCTL` utilities.

### 3.2.2 Checking the Audit Vault Console Status

To check the status of the Audit Vault Console:

1. Open a shell for the Audit Vault Server.

2. Follow the instructions in Section 2.2.2 to set the environment variables for the Audit Vault Server.

3. Run the following command:

       $ avctl show_av_status

### 3.2.3 Starting the Audit Vault Console

To start the Audit Vault Console:

1. Access the shell used for the Oracle Audit Vault collection agent.

   If you have closed this shell, see the following sections:

   - Section 2.2.3 describes how to set environment variables for the collection agent.

   - If you installed the collection agent on Microsoft Windows, do not set any environment variables. Instead, go to the `ORACLE_HOME``\``agent_dir``\bin` directory.

2. Ensure that the agent OC4J is running.

   Run the following `AVCTL` command in the Oracle Audit Vault Agent home (`ORACLE_HOME``/``agent_dir``/bin`) to check its status.

       $ avctl show_oc4j_status

3. If the agent OC4J is not running, run the `avctl start_oc4j` command.

       $ avctl start_oc4j

4. Access the shell used for the Audit Vault Server.

   If you have closed this shell, reset its environment variables. See Section 2.2.2.

5. Ensure that the Audit Vault Console is running.

       $ avctl show_av_status

   If the `avctl show_status` command indicates that the Audit Vault Console is not running, enter the following command:

       $ avctl start_av

At this stage, you can log in to the Audit Vault Console.

1. From a Web browser, enter the following URL:

       http://host:port/av

   In this specification:

   - `host`: The host computer on which you installed the Audit Vault Server.

   - `port`: The port number reserved for the Audit Vault Server.

   If you are unsure of the host and port number values, then enter the `avctl show_av_status` command, which displays this information.

2. In the Login page, enter the following information:

   - User Name: Enter the name of a user who has been granted the `AV_ADMIN` role.

   - Password: Enter the user's password.

   - Connect As: From the list, select AV_ADMIN.

3. Click Login.

### 3.2.4 Stopping the Audit Vault Server Console

To stop the Audit Vault Server console:

1. In a shell for the Audit Vault Server, set its environment variables.

   See Section 2.2.2 for more information.

2. Run the following command:

       $ avctl stop_av

### 3.2.5 Globally Disabling and Enabling Alert Settings

If you need to perform maintenance tasks or other similar activities that do not require alert settings to be active, you can globally enable or disable the alert settings that Oracle Audit Vault auditors create. Do not disable alerts unless you are directed to do so by Oracle Support Services or encounter a problem with the alerts table. By default, alerts are enabled.

To globally disable and enable alerts:

1. Log in to the Audit Vault Console as a user who has been granted the `AV_ADMIN` role.

   See Section 3.2.3 for login instructions.

2. Select the Configuration tab, and then select the Alert subpage.

   The Alert Settings page appears.

   Description of the illustration alertsettings.gif

3. At the Alert Processing Status label, select either Disable or Enable.

4. Click Apply.

### 3.2.6 Viewing Audit Event Categories

Audit event category management consists of viewing the Oracle Audit Vault audit event categories, their attributes, and their audited events. An audit event category defines how various types of events are organized. For example, invalid records are placed in the Invalid Record event category. See Oracle Audit Vault Auditor's Guide for more information about audit event categories.

1. Log in to the Audit Vault Console as a user who has been granted the `AV_ADMIN` role.

   See Section 3.2.3 for login instructions.

2. Select the Configuration tab, and then select the Audit Event Category subpage.

   The Audit Event Category Management page appears.

3. Select an audit event category, and then click View to find detailed information about that category.

   The View Audit Event Category page appears.

4. From the Audit Source Type list, select from the available source types: ORCLDB, MSSQLDB, SYBDB, and DB2DB.

5. Select the Attributes or Audit Events subpages to view detailed information about these categories.

6. Click OK when you complete viewing the audit event information for the category you selected.

Figure 3-1 shows the Audit Event Category Management page.

Figure 3-1 Audit Event Category Management Page

Description of "Figure 3-1 Audit Event Category Management Page"

On the Audit Event Category Management page, audit event categories appear in a table with the following columns:

- Audit Event Category

- Audit Event Category Description

- Format Name

- Format Module

### 3.2.7 Viewing Operational Errors That Oracle Audit Vault Catches

You can use the Audit Vault Console to view operational errors that Oracle Audit Vault catches, such as broken database connections and missing files.

To view errors using Oracle Audit Vault:

1. Log in to the Audit Vault Console as a user who has been granted the `AV_ADMIN` role.

   See Section 3.2.3 for login instructions.

2. Select the Management tab, and then select the Audit Errors subpage.

   The Audit Errors page appears.

3. After the Error Time label, specify a time range of errors to view.

   Select from the Last 24 Hours, Last One Week, or Last One Month options to view errors from those times, or select The Period and then enter a start date in the From field and end date in the To field to specify a different time range.

4. Click Go.

Figure 3-2 shows the Audit Errors page with audit errors from the last 24 hours.

Figure 3-2 Audit Errors Page

Description of "Figure 3-2 Audit Errors Page"

The Audit Errors page displays error information as a table with the following column headings:

- Error Time: Local time when the audit error was generated

- Audit Source: The audit source database on which the audit error originated

- Collector: The collector on which the audit error originated

- Module: The module name involved in the audit error

- Message: The content of the audit error message

## 3.3 Altering Collector Properties and Attributes

This section contains:

- About Collector Properties and Attributes

- Altering Collector Properties and Attributes Using the Audit Vault Console

- Altering Collector Properties and Attributes Using a Shell

### 3.3.1 About Collector Properties and Attributes

After you add a collector to a database source, Oracle Audit Vault creates the collector with a set of default properties that are internal to Oracle Audit Vault. They have no effect on the source database. These properties control aspects such as the frequency of audit data collection from the source database, the name of the source database, and so on.

### 3.3.2 Altering Collector Properties and Attributes Using the Audit Vault Console

To alter collector properties and attributes using the Audit Vault Console:

1. Log in to the Audit Vault Console as a user who has been granted the `AV_ADMIN` role.

   See Section 3.2.3 for login instructions.

2. Select the Configuration tab, and then select the Audit Source subpage.

   The Source Configuration Management page appears.

3. Select the Collector subpage.

   The Collector Configuration Management page appears, which displays the current settings for the available collectors.

4. Select the collector that you want to modify, and then click the Edit button.

   The Edit Collector page appears.

5. Under Attributes, modify the attributes for the collectors by editing the values in the Value column.

   For more information about these attributes, see the following sections:

   - Section 8.4 for the Oracle Database collector attributes

   - Section 9.4 for the SQL Server collector attributes

   - Section 10.4 for the Sybase ASE collector attributes

   - Section 11.4 for the IBM DB2 collector attributes

6. Click OK.

### 3.3.3 Altering Collector Properties and Attributes Using a Shell

To alter collector properties using a shell:

1. In a shell for the Audit Vault Server, ensure that you have set its environment variables.

   See Section 2.2.2 for more information.

2. Run the `alter_collector` command for each collector type, as shown in the following examples:

   For Oracle Database:

       $ avorcldb alter_collector -srcname hrdb.example.com -collname DBAUD_Collector  AUDAUDIT_DELAY_TIME=60

   See Section 8.4 for more information about the `avorcldb alter_collector` command.

   For Microsoft SQL Server:

       $ avmssqldb alter_collector -srcname mssqldb4 -collname MSSQLCollector NO_OF_RECORDS=1500 DESCRIPTION="MSSQLDB collector 45" SERVERSIDE_FILEPATH="c:\SQLAuditFile*

   See Section 9.4 for more information about the `avmssqldb alter_collector` command.

   For Sybase ASE:

       $ avsybdb alter_collector -srcname sybdb4 -collname SybaseCollector
       NO_OF_RECORDS=1500 DESCRIPTION="Sybase collector 45"

   See Section 10.4 for more information about the `avsybdb alter_collector` command.

   For IBM DB2:

       $ avdb2db alter_collector -srcname db2db4 -collname DB2Collector
       NO_OF_RECORDS=1500 DESCRIPTION="IBM DB2 collector 95"

   See Section 11.4 for more information about the `avdb2db alter_collector` command.

## 3.4 Managing the Oracle Audit Vault Data Warehouse

This section contains:

- About Managing the Oracle Audit Vault Data Warehouse

- Setting the Audit Vault Data Warehouse Refresh Schedule and Retention Period

- Manually Refreshing Audit Vault Data Warehouse Audit Data

- Loading Data to the Oracle Audit Vault Data Warehouse

- Purging Data from the Oracle Audit Vault Data Warehouse

### 3.4.1 About Managing the Oracle Audit Vault Data Warehouse

The collectors collect audit data from their source database and send it to the Oracle Audit Vault repository. The repository stores the data in an internal format. The repository also contains a data warehouse. A database job periodically refreshes the data warehouse with the latest audit records. Oracle Audit Vault provides predefined reports that display the data in the warehouse to the auditor.

You can perform the following activities with the Oracle Audit Vault data warehouse:

- Set the Audit Vault data warehouse refresh schedule. This schedule determines how frequently the data warehouse is refreshed with current data collected by the collectors.

- Set a retention period for the data that has been refreshed. The data warehouse then contains the most recent data for that length of time after each refresh.

- Load older data from the raw audit data store into the data warehouse tables. You can load older data into the data warehouse so that it can be available for analysis in the Oracle Audit Vault reports. However, you cannot load data from outside sources—just data that has been previously collected by the collectors but is too old to be loaded into the data warehouse as part of a normal refresh.

- Purge audit data. If you load older audit data into the warehouse, you can purge it from the data warehouse. Oracle Audit Vault still maintains this data in the Audit Vault repository but does not make is available for analysis in the warehouse.

### 3.4.2 Setting the Audit Vault Data Warehouse Refresh Schedule and Retention Period

This section contains:

- About Setting the Refresh Schedule and Retention Period

- Scheduling the Audit Data Refresh Settings Using the Audit Vault Console

- Scheduling the Audit Data Refresh Settings Using a Shell

#### 3.4.2.1 About Setting the Refresh Schedule and Retention Period

The refresh schedule moves data from the raw audit data store (that is, the internal format) into the data warehouse, so that it can be made available for the Oracle Audit Vault reports. The data warehouse is implemented as a sliding window over the audit data that has been collected. Each refresh of the data warehouse moves this window forward in time so that it always contains the latest audit records. The size of the window specifies how far back in time the window extends.

By default, Oracle Audit Vault refreshes the data warehouse once every 24 hours. You can set a retention period that determines the size of a sliding window of time for the data warehouse to hold this audit data.

The refresh schedule and retention period work together as follows: Suppose you have configured two source databases with Oracle Audit Vault. One database has 4 years of audit data accumulated and the other has 3 years of audit data. You want to retain only exactly the last year of data after each refresh. To accomplish this, you must do the following:

1. Schedule the refresh to start on a given day. For example, assuming that today is August 8, 2008, you set it for today.

2. Specify a frequency of once a day for the refresh to occur.

3. Set the retention period to 1 year. This retention period refers to the year before and leading up to the date that you specified in Step 1.

When the first refresh occurs, Oracle Audit Vault loads into the data warehouse the audit data that began 1 year ago, starting on August 8, 2007, to the current date, August 8, 2008. When the next refresh occurs on August 9, 2008, only the new audit data is retrieved. The retention period shifts forward: now this period is from August 9, 2007, to August 9, 2008. Oracle Audit Vault then discards the audit data from August 8, 2007, because now it is older than the retention period. This way, you always have the most recent year of audit data, right up to the current date.

There are two ways that you can create a refresh schedule:

- Create the schedule once, directly in Oracle Audit Vault. The schedule settings remain in place until the next time you modify these settings.

- Create one or more predefined schedules by using the DBMS_SCHEDULER PL/SQL package. You can create this schedule in SQL*Plus (or another SQL tool such as SQL Developer). Afterward, you use Oracle Audit Vault to select the schedule that you want to use. For more information about the `DBMS_SCHEDULER` package, see Oracle Database PL/SQL Packages and Types Reference.

You can create a schedule and retention period from either the Audit Vault Console or at a shell by using the `AVCA` utility.

#### 3.4.2.2 Scheduling the Audit Data Refresh Settings Using the Audit Vault Console

To create the refresh schedule and retention period using the Audit Vault Console:

1. Log in to the Audit Vault Console as a user who has been granted the `AV_ADMIN` role.

   See Section 3.2.3 for login instructions.

2. Select the Management tab, and then select the Configuration subpage.

   The Warehouse Settings page appears.

   Description of the illustration dw_mgmt.gif

3. Either select an existing schedule or create a new one.

   To select an existing schedule:

   1. Under Schedule to Send New Data, select Use Pre-defined Schedule.

   2. From the Schema list, select the name of the schema in which the schedule was created.

   3. From the Schedule list, select the name of the schedule.

      Information about the schedule appears: a brief description, repeat times (frequency of to repeating the schedule), interval, repeat time (the time to repeat the schedule), and start and end dates. If settings have been omitted (for example, an interval time), then these labels are blank.

   To create a new, standard schedule:

   1. Under Schedule to Send New Data, select Standard.

   2. Enter the following information:

      Frequency Type: From the list, select a frequency type, such as By Hours.

      Interval (frequency type): Enter the frequency for the type of frequency that you selected. For example, `1` for once every hour.

      Start Date: Specify the date on which the refresh occurs. If you select a date that is earlier than today's date, then the refresh today.

      Start Time: Enter the time at which the refresh occurs.

4. Set the retention window, that is, the period of time during which the data sent to the Oracle Audit Vault data warehouse remains in storage.

   For example, suppose that you scheduled Oracle Audit Vault to refresh the raw audit data store every 2 hours, starting on August 19, 2008 at 2 a.m., and you want to keep this data in storage for the next year and a half. To do so, you would enter `1` in the Year field and `6` in the Months field.

5. Click Apply.

#### 3.4.2.3 Scheduling the Audit Data Refresh Settings Using a Shell

To create the refresh schedule and retention period using a shell:

1. In a shell for the Audit Vault Server, ensure that you have set its environment variables.

   See Section 2.2.2 for more information.

2. Run the `avca set_warehouse_schedule` command to either specify an existing schedule or to create a new one.

   For example, to select an existing schedule named `daily_refresh`:

       $ avca set_warehouse_schedule -schedulename 'daily_refresh'

   To create a new schedule:

       $ avca set_warehouse_schedule -startdate 01-JUL-06 -rptintrv 'FREQ=DAILY;BYHOUR=0'

   In this example:

   - `startdate` specifies the date for the first refresh to begin.

   - `rptintrv` specifies the intervals for the refreshes, in this case, once a day.

   See Section 6.14 for more information about the `avca set_warehouse_schedule` command.

3. Run the `avca set_warehouse_retention` command to set the retention period.

   For example, to specify a period of 1 year and 6 months, enter the following command:

       $ avca set_warehouse_retention -intrv +01-06

   See Section 6.13 for more information about the `avca set_warehouse_retention` command.

### 3.4.3 Manually Refreshing Audit Vault Data Warehouse Audit Data

This section contains:

- About Manually Refreshing the Data Warehouse Data

- Manually Refreshing the Data Warehouse Using the Audit Vault Console

- Manually Refreshing the Data Warehouse Using a Shell

#### 3.4.3.1 About Manually Refreshing the Data Warehouse Data

You can refresh the Oracle Audit Vault data warehouse repository with data from the raw audit data store. As with a scheduled refresh, Oracle Audit Vault collects the raw audit data from its source databases and places it into the Audit Vault data warehouse.

#### 3.4.3.2 Manually Refreshing the Data Warehouse Using the Audit Vault Console

When you manually refresh the data in the Oracle Audit Vault data warehouse, you also can check the history of when refresh operations occurred.

To manually refresh the data warehouse using the Audit Vault Console:

1. Log in to the Audit Vault Console as a user who has been granted the `AV_ADMIN` role.

   See Section 3.2.3 for login instructions.

2. Select the Management tab, and then select the Warehouse subpage.

   The Warehouse Activity page appears.

   Description of the illustration warehserefreshhist2.gif

   The Warehouse Activity page shows the following information:

   - Scheduled: The scheduled time to perform a refresh operation

   - Start Time: The time when a refresh operation started

   - Duration (Minutes): The total time required to complete a refresh operation

   - CPU Used: The amount of CPU time used to complete a refresh operation

   - Error Number: The Oracle ORA- error number, if any, resulting from a refresh operation

   - Message: The error messages, if any, resulting from a refresh operation

   - Status: The current status of a refresh operation: FAILED or SUCCEEDED

3. Click the Refresh Now button.

#### 3.4.3.3 Manually Refreshing the Data Warehouse Using a Shell

To manually refresh the data warehouse using a shell:

1. In a shell for the Audit Vault Server, set its environment variables.

   See Section 2.2.2 for more information.

2. Run the `avctl refresh_warehouse` command.

   For example:

       $ avctl refresh_warehouse -wait

       AVCTL started
       Refreshing warehouse...
       Waiting for refresh to complete...
       done.

   The `-wait` parameter delays refreshing the raw data store until the current refresh job (if one is occurring) completes. See Section 7.4 for more information about the `avctl refresh_warehouse` command.

### 3.4.4 Loading Data to the Oracle Audit Vault Data Warehouse

This section contains:

- About Loading Data into the Oracle Audit Vault Warehouse

- Loading Data Warehouse Data Using the Audit Vault Console

- Loading Data Warehouse Data Using a Shell

#### 3.4.4.1 About Loading Data into the Oracle Audit Vault Warehouse

You can load data that is older than the retention period from the raw audit data store into the Oracle Audit Vault data warehouse tables. After you load this data, it is available to auditors to generate reports or perform analysis.

To find the current retention period setting, view the Warehouse Settings page of the Audit Vault Console (see Section 3.4.2); to find the last time the data was refreshed, view the Warehouse Activity page (Section 3.4.3).

#### 3.4.4.2 Loading Data Warehouse Data Using the Audit Vault Console

To load the data warehouse data using the Audit Vault Console:

1. Log in to the Audit Vault Console as a user who has been granted the `AV_ADMIN` role.

   See Section 3.2.3 for login instructions.

2. Optionally, disable the alert settings.

   See Section 3.2.5 for more information.

3. Select the Management tab, and then select the Warehouse subpage.

   The Warehouse Activity page appears.

4. Select the Load Activity subpage.

   The Load Activity page appears.

   Description of the illustration warehouse_load.gif

5. In the Start Date field, enter the beginning date of the data that you want to load. For example, suppose the source database contains audit data that is 10 years old, and you want to load the last 5 years worth of audit data into the Oracle Audit Vault data warehouse. Assuming that today's date is August 8, 2008, you would specify August 8, 2003 as the start date.

6. In the Number of Days field, enter the number of days, starting from the start date, through which you want to load data.

7. Click the Load Now button.

   Oracle Audit Vault schedules the data load operation, which is listed on this page the next time you access it.

8. Reenable the alert settings if you had disabled them.

   See Section 3.2.5 for more information.

#### 3.4.4.3 Loading Data Warehouse Data Using a Shell

To load the data warehouse data using a shell:

1. Optionally, disable the alert settings.

   See Section 3.2.5 for more information.

2. In a shell for the Audit Vault Server, ensure that you have set its environment variables.

   See Section 2.2.2 for more information.

3. Run the `avctl load_warehouse` command.

   For example, to load 10 days of audit data that was recorded starting on August 8, 2003, enter the following command:

       $ avctl load_warehouse -startdate 08-AUG-03 -numofdays 10

   See Section 7.2 for more information about the `avctl load_warehouse` command.

4. Reenable the alert settings if you had disabled them.

   See Section 3.2.5 for more information.

### 3.4.5 Purging Data from the Oracle Audit Vault Data Warehouse

This section contains:

- About Purging the Oracle Audit Vault Data Warehouse

- Purging Data Warehouse Data Using the Audit Vault Console

- Purging Data Warehouse Data Using a Shell

#### 3.4.5.1 About Purging the Oracle Audit Vault Data Warehouse

When you no longer need the audit data that you have loaded into Audit Vault Server, you can remove it from the Oracle Audit Vault data warehouse. If in the future you decide that you need to run reports against this purged data, follow the instructions in Section 3.4.4 to reload the necessary data into the data warehouse. You can only remove data that is older than the retention period. You can find and reset the retention period from the Audit Vault Console Warehouse Settings page (see Section 3.4.2).

#### 3.4.5.2 Purging Data Warehouse Data Using the Audit Vault Console

To purge the data warehouse data using the Audit Vault Console:

1. Log in to the Audit Vault Console as a user who has been granted the `AV_ADMIN` role.

   See Section 3.2.3 for login instructions.

2. Select the Management tab, and then select the Warehouse subpage.

   The Warehouse Activity page appears.

3. Select the Purge Activity page.

   The Purge Activity subpage appears.

4. In the Start Date field, enter the beginning date of the data that you want to purge.

5. In the Number of Days field, enter the number of days, starting from the start date, through which you want to purge data.

6. Click the Purge Now button.

   Oracle Audit Vault schedules the data purge operation, which is listed on this page the next time you access it.

#### 3.4.5.3 Purging Data Warehouse Data Using a Shell

To purge the data warehouse data using a shell:

1. In a shell for the Audit Vault Server, ensure that you have set its environment variables.

   See Section 2.2.2 for more information.

2. Run the `avctl purge_warehouse` command.

   For example, to purge 10 days of audit data that was recorded starting on January 1, 2004, and to specify that the operation wait until the previous purge job completes, enter the following command:

       $ avctl purge_warehouse -startdate 01-JAN-04 -numofdays 10 -wait

   See Section 7.3 for more information about the `avctl purge_warehouse` command.

## 3.5 Altering Source Database Attributes

This section contains:

- About Source Database Attributes

- Altering Source Database Attributes Using the Audit Vault Console

- Altering Source Database Attributes Using a Shell

### 3.5.1 About Source Database Attributes

After you register a source database, Oracle Audit Vault creates a set of properties that reflect general aspects of the source database itself, such as its port number and IP address. These properties are internal to Oracle Audit Vault and have no effect on the source database.

### 3.5.2 Altering Source Database Attributes Using the Audit Vault Console

To alter the source database attributes using the Audit Vault Console:

1. Log in to the Audit Vault Console as a user who has been granted the `AV_ADMIN` role.

   See Section 3.2.3 for login instructions.

2. Select the Configuration tab, and then select the Audit Source subpage.

   The Source Configuration Management page appears.

3. Select the Source subpage.

   The Source Configuration Management page displays the current settings for the available collectors.

   Description of the illustration srcconfigmgmt.gif

4. Select the source database that you want to modify, and then click the Edit button.

   The Edit Source page appears.

5. Under Properties, optionally modify the description of the source database.

6. Under Attributes, modify the attributes for the source database by editing the values in the Value column.

   For more information about these attributes, see the following sections:

   - Section 8.5 for the Oracle Database source database attributes

   - Section 9.5 for the SQL Server source database attributes

   - Section 10.5 for the Sybase ASE source database attributes

   - Section 11.5 for the IBM DB2 source database attributes

7. Click OK.

### 3.5.3 Altering Source Database Attributes Using a Shell

To alter source database attributes using a shell:

1. In a shell for the Audit Vault Server, ensure that you have set its environment variables.

   See Section 2.2.2 for more information.

2. Run the `alter_source` command for each source database type, as shown in the following examples.

   For Oracle Database:

       $ avorcldb alter_source -srcname hrdb.example.com PORT=1522

   See Section 8.5 for more information about the `avorcldb alter_source` command.

   For Microsoft SQL Server:

       $ avmssqldb alter_source -srcname mssqldb4 DESCRIPTION="HR Database"

   See Section 9.5 for more information about the `avmssqldb alter_source` command.

   For Sybase ASE:

       $ avsybdb alter_source -srcname sybdb4 DESCRIPTION="HR Database"

   See Section 10.5 for more information about the `avsybdb alter_source` command.

   For IBM DB2:

       $ avdb2db alter_source -srcname db2db4 DESCRIPTION="HR Database"

   See Section 11.5 for more information about the `avdb2db alter_source` command.

## 3.6 Removing Source Databases from Oracle Audit Vault

This section contains:

- About Removing Source Databases from Oracle Audit Vault

- Removing a Source Database Using the Audit Vault Console

- Removing a Source Database Using a Shell

### 3.6.1 About Removing Source Databases from Oracle Audit Vault

If you no longer need to have a source database registered with Oracle Audit Vault, you can use either the Audit Vault Console or the command-line utilities to remove the source database from Oracle Audit Vault. After you have removed the source database, its audit data still resides in the data warehouse within its retention period. To purge this audit data, see Section 3.4.5. You can check the length of the retention period in the Audit Vault Console; see Section 3.4.2.

Remember that after you have removed a source database, its identity data remains in Oracle Audit Vault so that there will be a record of source databases that have been dropped. Therefore, you cannot add a new source database with the name of a dropped source database. Remove the source database only if you no longer want to collect its data or if it has moved to a new host computer.

### 3.6.2 Removing a Source Database Using the Audit Vault Console

To remove a source database from Oracle Audit Vault using the Audit Vault Console:

1. Log in to the Audit Vault Console as a user who has been granted the `AV_ADMIN` role.

   See Section 3.2.3 for login instructions.

2. Select the Configuration tab, and then select the Audit Source subpage.

   The Source Configuration Management subpage appears.

3. From the list of source databases, select the database that you want to remove, and then click Delete.

   You can search for a source database by entering data in the Source Type and Source fields.

4. Click Yes in the Confirmation window.

### 3.6.3 Removing a Source Database Using a Shell

To remove a source database from Oracle Audit Vault using a shell:

1. In a shell for the Audit Vault Server, ensure that you have set its environment variables.

   See Section 2.2.2 for more information.

2. Run the `drop_source` command for the source database, as shown in the following examples:

   For Oracle Database:

       $ avorcldb drop_source -srcname orcldb.example.com

   See Section 8.7 for more information about the `avorcldb drop_source` command.

   For Microsoft SQL Server:

       $ avmssqldb drop_source -srcname mssqldb4

   See Section 9.7 for more information about the `avmssqldb drop_source` command.

   For Sybase ASE:

       $ avsybdb drop_source -srcname sybdb4

   See Section 10.7 for more information about the `avsybdb drop_source` command.

   For IBM DB2:

       $ avdb2db drop_source -srcname db2db4

   See Section 11.7 for more information about the `avdb2db drop_source` command.