Fortinet FortiDB Database Security and Compliance Software Administration Guide
광고
광고
Administration Guide
FortiDB
Version 3.2
www.fortinet.com
FortiDB Administration Guide
Version 3.2
December 19, 2008
15-32000-81360-20081219
© Copyright 2008 Fortinet, Inc. All rights reserved. No part of this publication including text, examples, diagrams or illustrations may be reproduced, transmitted, or translated in any form or by any means, electronic, mechanical, manual, optical or otherwise, for any purpose, without prior written permission of
Fortinet, Inc.
Trademarks
ABACAS, APSecure, FortiASIC, FortiBIOS, FortiBridge, FortiClient, FortiDB, FortiGate, FortiGuard,
FortiGuard-Antispam, FortiGuard-Antivirus, FortiGuard-Intrusion, FortiGuard-Web, FortiLog,
FortiManager, Fortinet, FortiOS, FortiPartner, FortiProtect, FortiReporter, FortiResponse, FortiShield,
FortiVoIP, and FortiWiFi are trademarks of Fortinet, Inc. in the United States and/or other countries. The names of actual companies and products mentioned herein may be the trademarks of their respective owners
Table of Contents
Table of Contents
RDBMS Privilege Matrix by FortiDB MA Module................................................. 11
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
1
2
Table of Contents
Comparing DB2-Audit-Based and Event Monitor-Based Auditing for DB2 V8 .................49
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Table of Contents
PostgreSQL Maintemance: vacuum (for Standalone users only) ..................................81
Appendix A: FortiDB MA Properties Setting ....................................................... 83
Appendix B: Using SNMP with FortiDB MA......................................................... 99
Traps for Adding, Modifying, Deleting, Enabling or Disabling Rules...............................100
Trap with Conventional Option ...............................................104
Trap Format for Loss of Connection to Target Databases ........................105
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
3
Table of Contents
Trap Format for Tomcat Up and Down ........................................ 106
Trap Format for Internal Database Up and Down ............................... 106
4
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
FortiDB MA Feature Summary
FortiDB MA Feature Summary
The main components of the FortiDB MA Database Security and Compliance
Solution are:
• Monitoring to examine and alert on changes in permissions, critical content, and metadata, on policy violation and on unusual behavior
• Auditing and Analysis to provide 100% assured access log recording and analysis reports that assist in regulatory compliance.
Each component is an important element of information security and integrity, but when integrated into a complete security framework, FortiDB MA Database
Security and Compliance Solution, they provide a value greater than the sum of their parts:
• Unusual-activity alerts, so you can react in a meaningful way.
• Major-change control
• Policy violations and unusual access
Fortinet offers these components with support for four major RDBMS types,
Oracle, DB2 UDB, MS SQL Server, and Sybase.
Some specific FortiDB MA features include:
• Alert notifications to assigned security personnel. Presented via the FortiDB
MA GUI, email, or SNMP traps, these alerts originate from the target database, access information, system data and the content and get stored in the FortiDB
MA internal database
• Capability of monitoring remote databases within your enterprise via a webbased management console.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
5
FortiDB MA Feature Summary
• The FortiDB MA Command Line Interface (CLI) for performing various FortiDB tasks.
• Auto Discovery. By supplying a range of IP addresses and port numbers, you can have FortiDB MA discover all active, distributed databases, registered or not, within your enterprise.
6
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Account and Password Management Creating Non-Administrative FortiDB MA Users
Account and Password Management
This chapter describes how to create FortiDB MA account, use the account lock feature, and manage password.
This chapter describes the following topics:
• Creating Non-Administrative FortiDB MA Users
• Viewing Users Assigned to the Various Roles
• Properties of FortiDB MA Account and Password
• Locking/Unlocking an Account
Creating Non-Administrative FortiDB MA Users
1
2
3
4
5
6
7
The Administrative user for FortiDB MA should set up one or more non-
Administrative FortiDB MA users.
To create non-administrative users, the Administrative user take the following steps:
Log in as the Administrative user (the default username and password are admin and fortidb1!$, respectively.)
Click the right arrow of User Administration at the left side tree or GO in the right.
The User Administration page displays.
Click Add New User. The Add New User dialog displays.
Fill out users’ information in all fields.
Specify what FortiDB MA features each user should use by selecting the appropriate radio buttons. If you assign the SOX Reports role, the Custom
Reports role will be enabled by default.
Decide if you want to make the user immediately active by choosing the Active radio button; otherwise choose the Locked radio button.
Click Save.
For more information about Account Locking and Password Rules and
Management, see Account and Password Management
.
Deleting Non-Administrative FortiDB MA User
1
2
3
To delete non-administrative users, the Administrative user take the following steps:
Log in as the Administrative user (the default username and password are admin and fortidb1!$, respectively.)
Click the right arrow of User Administration at the left side tree or GO in the right.
The User Administration page displays.
Check the checkbox next to the User name you want to delete.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
7
Viewing Users Assigned to the Various Roles
4
5
Click Delete User. The confirmation dialog displays.
Click OK.
Viewing Users Assigned to the Various Roles
Account and Password Management
8
Role Assignments
By clicking on a selection in the View by Software Module dropdown, you can see which users have been assigned to which roles.
Password Management
FortiDB MA enforces password rules and will lock an account if those rules are not followed.
FortiDB MA will change an account Status to Locked if:
• The user has not successfully logged in within a specified number of days. The initial expiration period default, shipped with FortiDB MA, is 30 days.
•
• An incorrect password is entered more than a specified number of times. The initial value, shipped with FortiDB MA, is 3 times.
Note:
Both the above rules do not apply to the FortiDB MA Administrative user.
In general, FortiDB MA recommends a password that consists of a minimum of 14 characters, including numbers and special characters. Specifically, FortiDB MA specifies that the password must:
• Be changed within a specified number of days. The initial value, shipped with
FortiDB MA, is 90 days. (If the password has expired, the user will be taken to the Change Password page)
• Be at least ‘n’ characters long. The initial value, shipped with FortiDB MA, is 8 characters
• Contain at least one number and one special (any non-alphanumeric character) character
• Not contain the user name as part of the password
• Not contain the user name reversed as part of the password
• Not be stored in an unencrypted form
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Locking/Unlocking an Account Properties of FortiDB MA Account and Password
Properties of FortiDB MA Account and Password
The table below shows properties related to accounts and passwords in dssConfig.properties.
Note:
Of the above, only the dss.minpasswordlength and dss.passwordlifetime properties apply to the FortiDB MA Administrative user
Property
dss.lockaccountd
ays dss.passwordlife
time dss.failedlogina
ttempts dss.minpasswordl
ength
Purpose
Specifies, in days, how long an account can be inactive before the user's account Status will be set to
Locked.
Specifies, in days how long a password can be used before it has to be changed. If a password has expired when the user logs on, the user will be taken directly to the
Change Password page where the user will have to change the password before being allowed to logon to the system.
Specifies how many login attempts the user is entitled to before the user's account Status will be set to
Locked.
Specifies the minimum length of a user password.
Possible Values Default
Any positive integer; if <=0, then this property is not considered
30
Any positive integer; if <=0, then this property is not considered
90
Any positive integer; if <=0, then this property is not considered
3
Any positive integer; if <=0, then this property is not considered
8
Locking/Unlocking an Account
1
2
Users are managed in one of two status categories Active or Locked, the latter of which might be established if one of the password rules is violated. The user
Status can also be set to Locked by the administrator on the User Administration page.
Note:
If the user account status is set to Locked, it will override any of the other conditions required for successful login and the user will not be able to log in.
To lock or unlock an account:
Log in as the Administrative user.
In the Administrator main page, click the right arrow of User Administration at the left side tree or GO in the right. The User Administration page displays.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
9
Changing Passwords Locking/Unlocking an Account
5
6
3
4
Click Modify in the line of the user you want to change the status.
Click Delete User. The confirmation dialog displays.
In the Status field, you click Active to unlock or Locked to lock the account
Click the Modify button at the bottom.
Note: Whenever a FortiDB MA System Administrator user unlocks a user account, the following occurs:
• The account status is set to Active.
• The last logon time of the user is reset to the current system time.
Changing Passwords
4
5
6
1
2
3
FortiDB imposes password management rules, including password expiration.
Use the MY ACCOUNT link to change your password.
To change your account information:
Log in to your account.
Click MY ACCOUNT at the top bar. My Account Information dialog displays
Enter your old password in the Old Password field.
Enter your new password in the New Password field.
Enter your new password again in the New Password Again field.
Click the Update button.
Once in the My Account Information page, you will be asked to supply your existing password as well as the password you want use in the future.
Note:
The new password chosen must not be the same as current password.
10
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
RDBMS Privilege Matrix by FortiDB MA Module Content Monitor
RDBMS Privilege Matrix by FortiDB MA Module
Using FortiDB MA without any impact on your target database is ideal. However, in order to provide you with the information necessary to secure your database, this is not always possible. The following tables indicate the privileges necessary in order to use FortiDB MA on your target-database.
To grant privileges to your fortiDB user, use the GRANT statement. Some examples are:
GRANT SELECT_CATALOG_ROLE TO fortiDB
GRANT SELECT ON dbo.syscolumns TO fortiDB
GRANT SELECT ON SYSIBM.SYSCOLAUTH TO fortiDB
GRANT ROLE SSO_ROLE TO fortiDB
For MS SQL Server, use the following command to add a login as a member of sysadmin: sp_addsrvrolemember 'FortiDB', 'sysadmin'
To allow FortiDB MA to assess or monitor the databases, create a user on the target database with the following privileges for the various FortiDB MA modules:
Content Monitor
Content Monitor users need the following privileges:
RDBMS Type
Oracle
MSSQL
Sybase
DB2 UDB
Required Privilege(s)
SELECT on the monitored tables
SELECT on the monitored tables
SELECT on the monitored tables
SELECT
on the monitored tables
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
11
Metadata Monitor RDBMS Privilege Matrix by FortiDB MA Module
Metadata Monitor
Metadate Monitor users need the following privileges:
RDBMS Type
Oracle
MSSQL 2000
MSSQL 2005
Required Privilege(s)
•CREATE SESSION
•SELECT_CATALOG_ROLE or, for use with Audit:
•CREATE SESSION
•AUDIT SYSTEM
•SELECT_CATALOG_ROLE
SELECT on:
• sys.columns
• sys.comments
• sys.objects
• sys.types
• sys.indexes
• sys.users
• spt_datatype_info
Or, for use with the Audit Data Retrieval
Method:
• member of sysadmin
SELECT on:
• information_schema.columns
• sysindexes
• sysobjects
• information_schema.routines
• sys.objects obj
• sys.sql_modules
• information_schema.views
12
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
RDBMS Privilege Matrix by FortiDB MA Module Privilege Monitor
RDBMS Type
Sybase
DB2 UDB
Required Privilege(s)
SELECT on:
• sys.comments
• sys.objects
• sys.indexes
EXECUTE on:
• sp_columns
• sp_stored_procedures
SELECT on the following SYSIBM tables:
• SYSCOLUMNS
• SYSINDEXES
• SYSPLAN
• SYSTABLES
• SYSTABLESPACES
• SYSTRIGGERS
• SYSVIEWS
Privilege Monitor
Privilege Monitor users need the following privileges:
Oracle
RDBMS Type Required Privilege(s)
•CREATE SESSION
•SELECT_CATALOG_ROLE or, for use with the Audit Data Retrieval Method
•CREATE SESSION
•AUDIT SYSTEM
•SELECT_CATALOG_ROLE
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
13
Privilege Monitor
14
RDBMS Privilege Matrix by FortiDB MA Module
RDBMS Type
MSSQL 2000
MSSQL 2005
Sybase
DB2 UDB
Required Privilege(s)
SELECT on:
• sys.columns
• sys.members
• sys.objects
• sys.protects
• sys.users
Or, for use with the Audit Data Retrieval
Method
• member of sysadmin
SELECT on:
• sys.columns
• sys.database_role_members
• sys.database_permissions
• sys.objects
• sys.database_principals
• sys.sql_logins
EXECUTE
on:
• sp_helpsrvrolemember
SELECT on:
• sys.columns
• sys.objects
• sys.protects
• sys.users
SELECT on the following SYSIBM tables:
• SYSCOLAUTH,
• SYSDBAUTH, SYSINDEXAUTH,
• SYSPLANAUTH,
• SYSSCHEMAAUTH,
• SYSTABAUTH,
• SYSTBSPACEAUTH
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
RDBMS Privilege Matrix by FortiDB MA Module User Behavior Monitor
User Behavior Monitor
User Behavior Monitor users need the following privileges:
RDBMS Type
Oracle
MSSQL
Sybase
DB2 UDB
Required Privilege(s)
For audit_trail=DB:
• CREATE SESSION
• SELECT_CATALOG_ROLE
• DELETE_CATALOG_ROLE
• AUDIT ANY
• AUDIT SYSTEM
• SELECT SYS.AUD$
• SELECT on the monitored tables or SELECT ANY TABLE
For audit_trail=OS:
• CREATE SESSION
• SELECT_CATALOG_ROLE
• AUDIT ANY
• AUDIT SYSTEM
• SELECT on the monitored tables or SELECT ANY TABLE member of sysadmin
ROLE SSO_ROLE
DBADM ON DATABASE
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
15
User Behavior Monitor RDBMS Privilege Matrix by FortiDB MA Module
16
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Connecting to Target Databases
Connecting to Target Databases
FortiDB MA supports multiple database connections in each of its modules.
Database-connection status is indicated in several ways.
Open
Open Databases; Open and Running Databases
A database connection that is Open enables creation and configuration of policies/rules, but does not start monitoring and will be indicated by:
Open and Running
Stopped
Closed
• A icon in the tree navigator.
• A red-colored Database Connection name in the Choose The Target Database list box.
A Privilege Check: No link in the localhost Status area in the upper-right corner of the screen.
A database connection that is Open and Running enables creation and configuration of policies/rules. In addition, according a user-specified (or default) schedule, it also starts monitoring for the PM, MM, UBM, CM modules.
An Open and Running connection will be indicated by:
• A icon in the tree navigator.
• A green-colored Database Connection name in the Choose The Target Database list box.
A Privilege Check: Yes link in the localhost Status area in the upper-right corner of the screen.
The icon indicates that an open connection has stopped running.
•Will not be listed in the tree navigator.
•Will display as a black-colored Database Connection name in the Choose The Target
Database list box.
No database specified link in the localhost Status area in the upper-right corner of the screen.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
17
Opening a Target Database Connection Connecting to Target Databases
Opening a Target Database Connection
Once one or more database connections have been established, you can invoke the Open Target Database screen from Database -> Open in the menu.
18
Open Database Menu
All database connections, active or not, are shown. Choose from the list of already existing connections and then click the Open button.
Open Database Icon
An Open database connection is one for which any scheduled monitoring is stopped.
Disconnected Database Icon
You must Open and Run a connection in order to enable scheduled monitoring.
Open and Running Database Icon
A disconnected database connection is one for which the database connection is no longer established. This would occur if a target-database agent, required by
FortiDB MA, is down or the database, or database instance, itself is down.
Note: If a database connection is deleted, all user configuration input is lost. Use
[Modify] in order to change database information.
Closing Databases Connections
You can close a database connection from the Database -> Close in the menu. If you merely want to stop the monitoring process, you need not close the connection. Instead, click the <Module> Check: Yes link, where <Module> is the name of the Module you are presently managing.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Connecting to Target Databases Deleting Databases Connections
Module Status
Uncheck the Yes checkbox and click on the Update button.
Changing Monitoring Status
Deleting Databases Connections
If a database connection is deleted, all user configuration input and previously monitored information for that database is lost. Use [Modify] in order to change database information.
Creating Connections
For any supported target-RDBMS type, these values must be established before a successful Database Connection can occur:
• Database Connection Name
• Database Server Name/IP (with port)
• Database Name
• Database Server type
• Username
• Password
You can configure connections to your target databases by:
• Manually completing the Database Connection form
• Importing connection information
• Auto Discovery of database connection information
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
19
Modifying a Connection Connecting to Target Databases
1
2
The RDBMS type you are configuring determines whether a port number needs to be explicitly specified. The following table shows which RDBMS types require specific port information as well as the default port numbers by RDBMS:
RDBMS
Oracle
MS SQL
DB2
Sybase
Default Port
1521
1433
50000
5000
Must Explicitly Be
Specified (Y/N)
Y
N
Y
Y
In order to manually enter database-connection information, the steps are:
Selecting Database -> New from the menu.
Fill in at least the required information, marked with an asterisk (*); namely:
• Database Connection Name (any name that you care to call it)
• Database Server Name or IP address followed, if applicable, by a colon(:) and the port number (E.g., 192.168.2.63:1521)
• Database Name (name of database as of its creation time)
• Database Server Type (Oracle, SQL Server, etc.)
• Username (name user will use in order to connect to the database)
• Password (password user will use in order to connect to the database)
It might also be useful to fill in the other, non-required, fields for problem-resolution purposes in the future.
20
Modifying a Connection
You might want to modify one or more of your database connection parameters without having to completely recreate the connection. Almost every field except
Database Nameis available for modification.
Example: Changing Your Password
1
As an example of modifying a database-connection parameter, assume you have just changed the password for the FortiDB MA database user by executing: alter <user> identified by <password>; commit;
You now want to change the value of the Password originally used when you created your database connection in FortiDB MA. The steps are:
Make sure no modules have Open or Open and Running connections to the database for which you want to change the password.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Connecting to Target Databases Audit Capabilities by RDBMS
3
4
2
In one of the modules for which you intend to use the connection with a new password, choose Database->Open from the FortiDB MA menu.
From the Choose The Target Database list box choose the name of the connection you are interested in and click the Modify button.
On the resulting Modify Database Connection page, enter the new password and click the Modify button.
Audit Capabilities by RDBMS
Oracle offers either AUDIT_TRAIL=DB, or for better performance,
AUDIT_TRAIL=OS. For all RDBMS types supported by FortiDB MA, here is a table of audit configuration settings available when creating a new database connection:
RDBMS UBM
MS SQL Server
DB2 UDB
Sybase
Oracle
Y
Y
Y
Y where Y means the Audit feature is available.
Audit
Y
N
N
Y
MM and PM
No Audit
Y
Y
Y
Y
Uploading Database-Connection Information
Creating and maintaining dozens of database connections can become a time consuming task. FortiDB MA provides the ability to upload a text file with the database connection information.
Note: Since this file contains password information, we recommend that you store in a safe place or remove it from the drive after it has been imported.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Upload Button on Database Connection Screen
21
Uploading Database-Connection Information
22
Connecting to Target Databases
9
10
11
12
7
8
5
6
13
14
15
16
17
3
4
1
Field
#
Name
dbalias
2 serverip dbname dbtype
1
2
To use this feature:
Choose the Database -> New menu
Click the Upload on the Create Database Connection page. Once selected, you are prompted for the name of the text file that contains the database connection and administration information.
The file is a text file in which each line represents a single database-connection.
Within each line, the fields are separated by an exclamation point (!). There are !delimited fields in each line.
Fields should be listed in the order shown here and contain:
Description Default Comments
Database Connection Name
Database Server Name/IP (with
Port)
Database Name
Database Server Type
no default no default no default no default
Supported Entries: db28: DB2 UDB V8 ora: all supported versions of Oracle msql: all supported versions of SQL
Server sybase: all supported version of Sybase
uname(user) Username pwd(passwor d) appname
Password
Monitored Application name dblocation Database Location dba1name dba1tel dba1emailc dba2name
DBA1 Name
DBA1 Tel
DBA1 Email
DBA2 Name dba2tel dba2email region division
DBA2 Tel
DBA2 Email
Region
Division business unit Business Unit
default no default no default no default no default no default no default no default no default no default no default no default no default no
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Connecting to Target Databases Uploading Database-Connection Information
18
19
20
21
22
23
24
25
26 usage auditoption useAgent agentIP agentPort
Usage
Data Retrieval Method (Audit or
No Audit)
Use Agent or not
Agent IP Address or Hostname
Agent Port
SQLclientfreq Agent Poll Frequency (secs) tracefolderna SQL Server Trace Folder Name me db2agent db2levelinfo
DB2 Agent
Filename and Location or output of DB2 level command
no default
N
N no default no default
60 no default
N no default
Y (Audit) ; N (No Audit)
Y (use Agent) ; N (do not use Agent)
Y (use Agent) ; N (do not use Agent)
Trailing entries can be left off if they are not needed, but the first six entries for each line are mandatory. Here are some examples:
For the first six required entries: my-oradb!192.168.1.165:1521!myOra9i!ora!system!manager!
Where a null value (the seventh field, Monitored Application Name, in this case) is used: sun920!192.168.1.22:1521!sun920!ora!system!FortiDB!!Seattl
e
Note: Diacritical characters should not be used.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
23
Database Auto Discovery Connecting to Target Databases
Database Auto Discovery
You can establish connections to databases that have been automatically discovered on your network.
24
User Administration: Distinct Modules for Auto Discovery
For more information on Auto Discovery, see the
FortiDB MA Utilities User
Guide.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Monitoring Oracle OS Audit Option
Monitoring Oracle
This chapter explains how to monitor Oracle target databases. For necessary privileges to monitor Oracle target database, please refer to
This chapter describes the following topics:
• OS Audit Option
• Using OS File Agent (only UNIX based target machines)
• Monitoring SYS User Activity
• Maintenance
Troubleshooting and limitation
OS Audit Option
For Oracle target databases, you can record auditing information either in a database table (sys.aud$) or into OS files. Using the latter, OS-file option is more secure and improves the database performance on the target side compared to the database-table option. The OS-file option necessitates the use of an agent that can reside on the target database machine. If you are a standalone user, the agent can reside either on the target database machine or the machine that contains FortiDB MA.
The OS-file agent, used for gathering audit data, only functions on Oracle target machines using Solaris, Linux, HP-UX, or AIX. Oracle on Windows writes to the event log when the OS option is specified and FortiDB MA does not support reading audit records from the Windows event log.
Parameter Settings of Oracle target database
Parameter
audit_trail audit_file_dest
Setting
OS location to which
Oracle will write audit files
Comments
Activates the OS-File
Audit option
This must be changed from the default value of ‘?/rdbms/audit’ to a valid location
1
2
3
4 audit_sys_operations
true
Restart the Oracle instance.
Login to the target machine as the oracle user
Go to the directory containing the transferred files
If the target database is not on a Solaris machine, replace SunOS in this line of
iplocks_ora.sh:
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
25
Using the OS-File Agent Monitoring Oracle
26
5
6
if [ "$os_name" = "SunOS" ]; then
with LINUX, AIX, or HP-UX, for Linux, AIX, or HP-UX-based target databases, respectively:
(Optionally) in order to restrict the maximum amount of Java memory that the OS-
File agent consumes, you can change this line of iplocks_ora.sh: java -jar iplocks_ora.jar
to, for example: java -Xmx256m -jar iplocks_ora.jar
where 256m represents 256 MB. (You might have to experiment to derive an optimum value for your environment.)
Run the command:
./iplocks_ora.sh &
Using the OS-File Agent
In order to facilitate using the OS-file audit option along with the FortiDB MA application, FortiDB MA requires an OS agent that can read the OS files and transmit the data to FortiDB MA for processing. The communication between
FortiDB MA and the agent is transparent to you, once the agent is started.
You can run the agent on the target-database machine, and then transfer the audit files over to the FortiDB MA machine for processing.
Target Database Environment Settings
Here are some environment settings required in Oracle target side:
• Make sure you are using Java 1.4.x or later
• After downloading the agent files to your target machine, make the Oracle user the owner of the files.
• Give execution permission on iplocks_ora.sh
• Increase the amount of displayed debugging information by changing the agent property file named serverConfig.properties, the value of these two parameters to true: dotopdebug dodebug
• Make sure that the Oracle parameter audit_file_dest on the target Oracle server is set to a valid location.
Running Oracle OS-File Agent
1
To download and run the agent files at your target machine, take the following steps:
Login to FortiDB MA as the Administrator user.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Monitoring Oracle Configuring Parameters
2
3
4
5
6
In Administrator Main Page, click Download DB Agents to download Oracle database agent.
Transfer the files to the target-machine directory in which you plan to install the agent.
Connect to the target machine as the oracle user and go to the directory to which you transferred the files.
Make sure that the oracle user has EXECUTE permission on
iplocks_ora_start.sh.
From the target-machine directory, start the agent by executing:
./iplocks_ora_start.sh
or java –jar iplocks_ora.jar
Note: In order to see debug information about the client for the OS-file audit option, you can set the ubmflow parameter to true in
debug.properties
file on the FortiDB MA application side. For details about how to change properties, see
CLI Reference.
Stopping Oracle OS-File Agent
To stop running Oracle OS-File Agent, execute the following command:
./iplocks_ora_stop.sh
If you use iplocks_ora.jar to run Oracle OS-File Agent, you cannot use iplocks_ora_stop.sh to stop the agent.
Checking the Status of Oracle OS-File Agent
To check the status of Oracle OS-File Agent, execute the following command:
./iplocks_ora_status.sh
If you use iplocks_ora.jar to run Oracle OS-File Agent, you cannot use iplocks_ora_status.sh to check the status.
Configuring Parameters
In order to control some aspects of the communication between the OS agent and the FortiDB MA application, there are configurable parameters in the following properties:
• serverConfig.properties: Agent-side properties
• dssConfig.properties files. FortiDB MA side properties
Note: Whenever you make changes to the
serverConfig.properties
or dssConfig.properties
files, you must restart the agent and/or FortiDB MA, respectively, for the changes to have effect. For details about how to change properties, see the
Appendix A: FortiDB MA Properties Setting
A: FortiDB MA
Properties Setting.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
27
Configuring Parameters Monitoring Oracle
Agent-side parameters
The configurable parameters on the agent side are in
serverConfig.properties
and are as follows:
• port: The port the server will use to listen. The default value is 51234.
Note: For correct behavior of the agent and the FortiDB MA application, the value set here must match the value of the dss.ubm.oracle.osOptPort parameter in dssConfig.properties file on the FortiDB MA application side.
• dotruncate: Whether Oracle audit files should be truncated. If this option is set, when a) the audit files exceed the size specified in the maxfilesize parameter (see below) and b) the current time at the target database is outside of the “do not truncate” time, the audit file is truncated. The default value is false.
Note: For correct behavior of the agent and the FortiDB MA application, the value set here must match the value of the dss.ubm.oracle.osOptDoTruncate parameter in dssConfig.properties file on the FortiDB MA application side.
• maxfilesize: The maximum size (in MB) that the audit file can reach before it is truncated. The default value is 100.
Note: For correct behavior of the agent and the FortiDB MA application, the value set here must match the value of the dss.ubm.oracle.osOptMaxFileSize parameter in dssConfig.properties file on the FortiDB MA application side.
• timeout: The maximum time, in seconds, the agent will wait for client response before it times out. The default value is 60. (The number of seconds specified for this parameter should match the number of seconds specified for
dss.ubm.oracle.osOptTimeout. See
• maxclients: The maximum number of clients that can connect to the agent at a time. The default value is 10. The value you set here should match the value set for dss.ubm.oracle.osOptThreadPoolSize on the FortiDB
MA machine. (In a high-traffic environment, you might try increasing this value.)
• dotopdebug: To print top level debug messages. The default value is false.
• dodebug: To print out lengthier version of debug messages. The default value is false.
Note: Enable both the dodebug and the dotopdebug flags to get detailed debug information. Besides being printed on the console, the debug information is recorded in the log file located in the same directory as that of the agent files
• islocalagent: Used to specify whether the agent resides locally on the
FortiDB MA machine or remotely. The default value is false. Presently
FortiDB MA doesn’t support this property.
The next two parameters allow the user to specify the hours (in 24-hour format) between which truncation should not be carried out, even if file size is exceeded.
• fromhr: The default value is 8. (corresponding to 8 AM).
• tohr: The default value is 18 (corresponding to 6 PM).
28
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Monitoring Oracle Troubleshooting and Tuning
FortiDB MA-side parameters
The configurable parameters, in dssConfig.properties, on the FortiDB MA application side are as follows:
• dss.ubm.oracle.osOptPort: The port on which the FortiDB MA application should connect to the agent. The default value is 51234.
Note: For correct behavior of the agent and the FortiDB MA application, the value set here must match the value of the port parameter in serverConfig.properties file on the remote-agent side.
• dss.ubm.oracle.osOptDoTruncate: Whether Oracle audit files should be truncated. If this option is set, when a) the audit files exceed the size specified in the dss.ubm.oracle.osOptMaxFileSize parameter and b) the current time at the target database is outside of the “do not truncate” time, the audit file is truncated. The default value is false.
Note: For correct behavior of the agent and the FortiDB MA application, the value set here must match the value of the dotruncate parameter in
serverConfig.properties file on the agent side.
• dss.ubm.oracle.osOptMaxFileSize The maximum size (in MB) that the audit file can reach before it is truncated. The default value is 100.
Note: For correct behavior of the agent and the FortiDB MA application, the value set here must match the value of the maxfilesize parameter in
serverConfig.properties file on the remote-agent side.
• dss.ubm.oracle.osOptTimeout: The maximum time in seconds the
FortiDB MA application will wait for agent response before it times out. The default value is 60 seconds.
• dss.ubm.oracle.osOptRecordBatchSize: The number of audit records which are batched together before processing as a single file. The default value is 20.
• dss.ubm.oracle.osOptThreadPoolSize: The maximum number of worker threads which are spawned in order to transfer files, in parallel, to the
FortiDB MA machine. The default value is 10. The value you set here should match the value set for maxclients on the agent machine. (In a high-traffic environment, you might try increasing this value.)
• dss.oracle.osLocalAgent: This option can be used to specify whether the agent resides locally on the FortiDB MA server or remotely. The default value is false. Currently FortiDB MA doesn’t support this parameter.
• dss.auditretrievaldelay: Determines the delay in seconds, following a timeout, that FortiDB MA will wait to retrieve audit-related OS files. (This should be set to a value greater than or equal to the values set for dss.ubm.oracle.osOptTimeout and timeout, which should both be the same).
Troubleshooting and Tuning
This topic describes troubleshooting and tuning for monitoring Oracle using Audit log agent.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
29
Monitoring the SYS User Activity Monitoring Oracle
This describes the following topics:
• Administration tuning
• Troubleshooting on the Agent side
Administration Tuning: File truncation
Here are some file-truncation steps you can use in order to reduce disk usage and improve performance:
• Specify times NOT to truncate using agent-side fromhr and tohr
parameters. (See Agent-side parameters )
• Set to true the parameter dss.ubm.oracle.osOptMaxFileSize on the
FortiDB MA machine and the parameter maxfilesize on the agent-side machine.
• Set to true the parameter dss.ubm.oracle.osOpDoTruncate on the
FortiDB MA machine and the parameter dotruncate on the agent-side machine.
Troubleshooting on the Agent Side
Here are some agent-side steps you can use in order to troubleshoot problems:
• check the log file for errors
• In order to increase the amount of displayed debugging information change, in
serverConfig.properties, the value of these two parameters to true and then
restart FortiDB MA: dotopdebug=false dodebug=false
Monitoring the SYS User Activity
The OS-File Audit option enables the monitoring of some SYS user activities. You can use a UBM User policy to record the SYS user activity; however, the alert message will not include information about which object was accessed. You could use UBM Object Policies to get object information.
In order to monitor SYS activity associated with a UBM User Policy:
Note: You should not expect to be able to monitor sys user actions with PM, MM, or with Session or Object policies in UBM.
Note: SYS user activity can only be gathered when the Oracle target is on a Unixflavored, not a Windows, machine.
30
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Monitoring Oracle Monitoring the SYS User Activity
• When audit_trail=DB for the Oracle target database.
1 Set dss.oracle.monitorSysOp=true (in dssConfig.properties on FortiDB MA)
2 Set audit_sys_operation=true (on the target Oracle machine)
Note: Under these conditions, FortiDB MA looks for an agent on the target server in order to retrieve SYS-related OS files. Setting dss.oracle.monitorSysOp to true tells FortiDB MA that it must get SYS-related OS files, as well as targetdatabase table data for non-SYS actions.
• When audit_trail=OS for the Oracle target database.(See
)
1 Set dss.oracle.monitorSysOp=true or false (in
dssConfig.properties on FortiDB MA)
2 Set audit_sys_operation= true (on the target Oracle machine)
Limitations
Oracle does not log very detailed information about the actions of the SYS user. In fact, the information is
much more
limited that what is logged, either in the audit files or the audit sys.aud$ table, for other users. Here is a comparison example:
sys user
Thu Mar 17 14:53:17 2005
ACTION : 'select * from scott.emp'
DATABASE USER: 'sys'
PRIVILEGE : SYSDBA
CLIENT USER: FortiDB
CLIENT TERMINAL: FORTIDBHOST
STATUS: 0
non-sys user
Tue Mar 21 08:58:38 2006
SESSIONID: "153807"
ENTRYID: "1"
STATEMENT: "1"
USERID: "SCOTT"
ACTION: "100"
RETURNCODE: "0"
COMMENT$TEXT: "Authenticated by:
DATABASE"
OS$USERID: "oracle"
PRIV$USED: 5
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
31
Monitoring the SYS User Activity Monitoring Oracle
OS-File Option Files (Windows)
Some User Policy Settings (e.g., Suspicious Object Rule) for the SYS user may not always provide the expected results. However, enabling all the Access
Violation Settings, without any filtering via the Edit buttons to change default values does give you the option of capturing all the actions of the SYS user and even getting more detail via the UBM Drilldown feature.
Note: Alert messages for the SYS user generated by the UBM User policy will not display specific actions (like select/insert etc) performed by the SYS user. The comment_text field in drilldown will give the SQL statements corresponding to the SYS user actions.
32
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Monitoring Oracle
Limitation
Limitations of the Oracle audit utility
For UNIX- and Linux-based Oracle target databases, the Oracle audit utility cannot retrieve the terminal name from which a suspicious activity may have emanated. For an Oracle target on any platform, the Oracle audit utility cannot retrieve the application name. The following Logon Trigger will resolve this limitation by writing this data to the audit log.
connect / as sysdba
CREATE OR REPLACE TRIGGER FORTIDB_get_application
AFTER LOGON ON DATABASE
WHEN (user != 'SYS')
DECLARE
l_program VARCHAR2(50);
l_machine VARCHAR2(20);
BEGIN
SELECT substr(program, 1, 43), substr(machine, 1, 20)
INTO l_program, l_machine
FROM v$session
WHERE audsid = sys_context('USERENV','SESSIONID');
/
dbms_session.set_identifier(l_program || ':' || l_machine);
EXCEPTION WHEN OTHERS THEN NULL;
END;
Read-Only Limitations
When a target database is opened as READ ONLY, the following UBM rules do not generate alerts.
• Extremely Long Session
• Excessive Read Activities
• High Read Ratio
Maintenance
For audit_trail=db, maintain the sys.aud$ audit-log table on the target database side.
Location of Audit Files if audit_trail=OS
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Limitation
33
Maintenance Monitoring Oracle
For audit_trail=OS, go to the location specified by the Oracle audit_file_dest variable and maintain oldest files there. For example, you might remove only files older than 15 days.
Note: audit_trail=OS only applies to Linux or UNIX-based target databases.
34
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Monitoring DB2 UDB Event Monitor-Based Auditing
Monitoring DB2 UDB
FortiDB MA can capture audit records of DB2 UDB target databases using either one of them:
• Event Monitors
• DB2 Audit.
For more comparative information about the FortiDB MA usage of the two methodologies with DB2 V8, see
Comparing DB2-Audit-Based and Event
Monitor-Based Auditing for DB2 V8
Note: Once you have decided on Event-Monitor-, or DB2-Audit-, based auditing and then establish your database connection, you cannot change to the other auditing type without having to create a new database connection.
Event Monitor-Based Auditing
The FortiDB MA behavior for Event Monitor-Based Auditing has the following features:
• Event-monitor data is written to database tables. You can create Tablespaces if using other than the default.
• Event monitor-based auditing requires no agent.
• You can specify the number (greater than 0) of policies per event monitor in the Create New (or Modify) Database Connection screen.
Creating a Database Connection
This section explains how to create a connection to DB2 for Event Monitor based auditing.
When you create a database connection to a DB2 UDB target database with
Event Monitor based auditing, the Event Monitor check box should be checked as
Data Retrieval Method.
When you create a database connection to a DB2 UDB target database, you have an opportunity to specify the number of User Policies that should be included in each associated EVM. (The default is 15)
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
35
Event Monitor-Based Auditing Monitoring DB2 UDB
36
Default Create New Database Connection Screen for DB2 UDB V8
You can create EVMs in a specific Tablespace or use the default Tablespace.
Initially, on the Database Connection screen, FortiDB MA presents the
Tablespace Name value as <default>. However, you can specify your own name for a Tablespace on the target database, in which you want to have your
EVMs created.
Note: This user-specified Tablespace must already exist in order to successfully connect
Note: Once the Tablespace is verified as existing and once at least one EVM has been created, you cannot change the Tablespace name you have chosen.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Monitoring DB2 UDB
Event Monitor Consolidation
Event Monitor-Based Auditing
Default Number of Policies per Event Monitor (V8)
DB2 allows only 32 EVMs to be simultaneously active. Multiple FortiDB MA policies can be consolidated within individual DB2 EVMs, effectively removing the
32-policies limit for DB2 UDB target databases.
You specify how many User
1
Policies per EVM when defining your database connection. The default is 15. Assuming you use this value, the maximum number of FortiDB MA policies is then 480 (15 * 32).
Later, you can modify your original value for Policies per event monitor without creating a new database connection.
Note: Event monitors have only two states: started and stopped. There is no special state for an enabled FortiDB MA policy and another for a disabled FortiDB
MA policy.
Usage Guidelines
If you are monitoring users with minimal transaction activity, you might want a large number of User policies per EVM. On the other hand, if you have users with extremely high transaction activity, you might choose a small number of User policies per EVM.
Starting Event Monitoring
You can defer the starting of EVMs until FortiDB MA itself starts by choosing the
MANUALSTART mode on the Create (or Modify) Database Connection screen.
Alternatively, when you use the default AUTOSTART mode, EVMs start along with the target-database instance.
FortiDB MA starts event monitoring via:
• Clicking Open or Open and Run on the Open Target Database screen
• The User Behavior Check checkbox on the Status screen
1.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
For Session policies, all policies are consolidated into a single Event Monitor.
37
Event Monitor-Based Auditing Monitoring DB2 UDB
Starting Event Monitoring via the Open Target Database Screen
Starting Existing Event Monitors via the Open Target Database Screen
Starting Event Monitoring via User Behavior Check on the
Status Screen
38
Starting Existing Event Monitors via the Status Screen
Stopping Event Monitoring
FortiDB MA stops event monitoring after:
• Clicking Close in the Database menu
• Disabling the User Behavior Check checkbox on the Status screen
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Monitoring DB2 UDB Audit-Based Auditing
Audit-Based Auditing
In order to overcome performance problems associated with event monitors, you may also use the DB2 Audit-based method in order to capture records of DB2 V8 audit events.
DB2 Audit insures the possibility of capturing of all transactions on the targetdatabase machine, though at the expense of requiring an agent on that machine.
Obtaining FortiDB MA DB2 Audit Log Agent
3
4
1
2
5
To obtain DB2 Audit Log Agent, take the following steps:
Login as the Administrator user.
Go to the Download DB Agents.
Click the Download Db2 Agent button.
Create a directory on your target-database machine to accommodate the agent files
Save the agent file to the appropriate directory in your target machine.
Configuring Audit-Based auditing
The audit-based-retrieval agent for MM and PM should be run by the DB2 owner, so it will have access to the proper files. In general, the DB2 account (say db2inst1) will have a directory sqllib under its home directory. In order to set this up, execute one of the following, noting that there is a '.' at the beginning of each: or:
. /home/db2inst1/sqllib/db2profile
. ~/sqllib/db2profile
Figure 1: Starting the Agent
To activate the audit log agent, you need to consider the following items:
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
39
Audit-Based Auditing Monitoring DB2 UDB
• Make sure you have execute permissions on the db2audit.jar file. If not, change permissions as follows: chmod 755 db2audit.jar
• The DB2 audit agent should be executed by the DB2 instance user. In order to accomplish this, the DB2 instance owner(e.g., db2inst1) should execute the following commands: chmod -R 755 /opt/IBM/db2/V8.1/security chown -R db2inst1:db2grp1 /opt/IBM/db2/V8.1/security where db2inst1 belongs to primary group db2grp1
• The DB2 instance user should have write access to the security folder (by default: /opt/ibm/db2/V8.1/security).
Note: On AIX, the security folder can be found within /usr/opt/db2_08_01.
40
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Monitoring DB2 UDB Audit-Based Auditing
• Change, in the serverConfigDB28.properties file, any parameters necessary.
Here is the file as shipped with default values.
#Server Configuration Information
#port server should listen at port=51236
#maximum time server will wait for client response (in milliseconds) timeout=60000
#maximum number of clients which can connect to the agent at a time maxclients=10
#DEBUG INFO - Enable both flags for detailed info
#print top level debug messages dotopdebug=false
#print out lengthier version of debug messages?
dodebug=false
#print out audit debug messages?
dodb2auditdebug=false
#true - prune date, false - prune all db2prunebyhour=false
#prune interval in seconds pruneInterval=60
Parameter in serverConfig
DB28.properti
es on target machine
port
#db2 extract directory Db2 instance user should have write/access.
db2extractdir = /tmp
• The values in this target-side file must match the values in the FortiDB MAside dssConfig.properties file. For details how to change the default value of dssConfig.properties, see
Appendix A: FortiDB MA Properties Setting .
Value Corresponding
Property in dssConfig.properties on FortiDB MA machine
51236
dss.db28auditPort
Value
51236
Comments
If you need to connect to multiple databases within the same DB2 instance, a separate connection, with the same port number, is required
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
41
Audit-Based Auditing
42
Monitoring DB2 UDB
timeout
60000
(mill iseco nds)
dss.db2Timeout
60
(second s) miliseconds
Note: db2extractdir helps alleviate I/O-contention and/or disk-space problems. The default is /tmp. You might want to choose another disk location if you encounter an excessively large db2audit.out file.
Executing DB2 Audit Log Agent
In the directory you created on the target machine, execute for UNIX-based targets:
./db2audit.sh
or, as an Administrator-level user, for Windows-based targets, run: db2audit.bat
Properties
A property, db2extractdir, has been introduced in order to help alleviate I/Ocontention and/or disk-space problems. This property supports the agent used for
DB2-Audit-based auditing used with DB2 UDB V8 target databases.
This property resides in serverConfigDB28.properties file which resides on the target-database machine. The default is /tmp. You might want to choose another disk location if you encounter an excessively large db2audit.out file.
Filtering
You must manually add the dss.db2sqlstatement.level property (and a value that represents your desired filtering level) to the dssConfig.properties file in order to perform filtering. Otherwise, dss.db2sqlstatement.level is considered NOT set (or is considered to be set to 0 (zero)) for which NO filtering occurs. For details about filtering, see (
Filtering Audit Logs (Oracle, DB2)
.
Creating a Database Connections
To create DB2 connections for audit based auditing, DB2 audit log agent has to be running.
DB2 audit log agent is required for the following connections for PM and MM and
UBM.
PM
Audit(Agent is required)
No Audit (Agent is not required)
MM
Audit(Agent is required)
No Audit (Agent is not required)
UBM
Audit (Agent is required)
Event Monitor
(Agent is not required)
DB2 UDB Connections in the PM and MM Modules
When you create a database connection with a DB2 UDB target database in
Privilege Monitor (PM) or Metadata Monitor (MM) and choose Audit as your Data
Retrieval Method, your transaction log file might become full faster than you anticipate. To avoid this, ask your DB Admin to do one or more of the following in database configuration file:
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Monitoring DB2 UDB Audit-Based Auditing
• Increase the log file size (LOGFILSIZ). (The default is 1000 4K-byte pages.)
• Increase the number of primary log files (LOGPRIMARY). (The default is 3.)
• Increase the number of secondary log files (LOGSECOND). (The default is 2.)
Creating a Connection to DB2 UDB Audit
DB2 Audit Section of Database Connection Screen for DB2 V8
Once you have chosen DB2-Audit-based retrieval, you can then further specify agent and record-type parameters. Specifically, you can specify:
• An agent port number other than the default of 51236. (The default value is from db28auditPort in dssConfig.properties on the FortiDB MA. You need to specify the SAME port number in serverConfigDB28.properties on the target-database machine. The value you set in serverConfigDB28.properties automatically overwrites the value in the FortiDB MA internal database.)
• The violation category of the captured events.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
43
Audit-Based Auditing
Specifying Which Records to Retrieved
Monitoring DB2 UDB
Default Type Settings for Retrieved Records
When you establish your database connection, you have the opportunity to specify the type of captured events you are interested in.
• Normal Access Choose this if you want audit records containing databaseoperation (or context) information.
• Security Violation Access Choose this if you want audit records containing authorization-checking and user-validation information.
Note: You must check the Security Violation Access checkbox if you want to capture audit records related to:
• Login Failure (Policy Setting) in a Session policy or:
• Security Violation (Access Violation Setting) in a User policy
Only Security Violation Access Checked
The default is for both Normal Access and Security Violation Access to be checked. If you decide on other than the default, the behavior is as follows.
Normal Access Unchecked
44
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Monitoring DB2 UDB Audit-Based Auditing
Unavailable User-Policy Choices When Only Security Violation Access
Enabled (UBM)
If you uncheck Normal Access, a number of User-policy rules are disabled, as shown above.
Unavailable Session-Policy Choices When Only Security Violation Access
Enabled (UBM)
If you uncheck Normal Access, a number of the Session-policy rules are disabled, as shown above.
Only Normal Access Checked
If you uncheck Security Violation Access, then the Security Violation Userpolicy rule is disabled, as shown below.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Security Violation Access Unchecked
45
Audit-Based Auditing Monitoring DB2 UDB
Unavailable User-Policy Choice When Only Normal Access Enabled (UBM)
In addition, if you uncheck Security Violation Access, then the Login Failure
Session-policy rule is disabled, as shown below.
46
Unavailable Session-Policy Choice When Only Normal Access Enabled
Maintenance of DB2 V8 Audit Log Agent
Property
In order to delete audit record from the audit log, you might want to use prune control.
Prune Control
Two properties control the pruning process that is responsible for periodically deleting audit-log records after they have been sent to FortiDB MA. They are:
Default
Value
Effect Comments
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Monitoring DB2 UDB Audit-Based Auditing
db2prunebyhour
false
pruneInterval
60
If left set to false, pruning, via the DB2
prune all command,
takes place at the pruneInterval frequency.
If set to true, pruning, via the DB2 prune date
<timestamp>
command, takes place at the pruneInterval frequency.
Number of seconds between prune operations
prune all causes the pruning of all records to be
deleted from the audit log.
Note: The FortiDB MA agent performs:
• flush
• extract
• prune all
When using prune all, an automatic flush, independent of FortiDB MA, could occur during the extract process and result in data loss. This can be mitigated by using a positive value for DB2's
AUDIT_BUF_SZ parameter. You should change this to a value that works in your environment (in limited
FortiDB MA testing, a value of 30-40 MB seemed reasonable). After changing this value, make sure you restart DB2.
prune date <timestamp:YYYYMMDDHH> causes
the deleting of all audit-log records up to, but not including, the timestamp value. (The granularity is limited to an hour)
If db2prunebyhour is set to true, FortiDB MA recommends setting pruneInterval to a largerthan-default value, but less than 3600 sec, in order to avoid duplicate audit data being sent to the
FortiDB MA internal database.
Limitations of DB2 Audit feature
The limitations associated with the DB2 Audit feature are:
• DB2-Audit-based audit records do not show the error status for SQL statements. As a result, FortiDB MA cannot distinguish between successful and unsuccessful SQL statements. For example, this would impact UBM's
Suspicious SQL Statement rule: an alert might be generated for ANY statement despite the GUI-claim of "Alert any successful access..."
• Depending upon the application from which the SQL statement originates,
FortiDB MA may generate up to two alerts for the same statement. FortiDB MA get SQL statements by using the CONTEXT configuration scope, which might generate the same statement as, for example, a PREPARE or EXECUTE event. Therefore, FortiDB MA uses the event type in the alert's SQL
Statement field in order to distinguish statements. For example:
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
47
Audit-Based Auditing Monitoring DB2 UDB
48
PM or MM
Setting
Audit-based
Audit-based
Snapshot
Snapshot
Alert Showing Event Name
• There is a limitation of one agent per instance, even though the instance may involve multiple databases.
• ALTER Action behavior in MM: ALTER-related actions are not available for monitoring
1
. Therefore, Metadata Monitor with the db2audit facility monitors only CREATE_OBJECT, RENAME_OBJECT, and DROP_OBJECT.
• Handling a 'AUD0001N Operation Failed' Error: If one of your users, who is running db2 audit agent, sees this error:
AUD0001N Operation failed.
java.lang.Exception: Extraction db2audit is failed:
AUD0003N I/O error on accessing
"C:\IBM\SQLLIB\DB2\security\db2audit.log" make sure the directory/file exists and has the correct permissions.
• then the instance owner should configure correct permissions for that user.You cannot use, in UBM, a DB2 Audit-based database connection established in
MM (or PM). Conversely, you cannot use, in MM (or PM), a DB2 Audit-based connection established in UBM. (However, you can share connections that do not involve the FortiDB MA DB2-Audit-based agent.) The following table elaborates on this:
UBM Setting Sharing Information
Audit-based
EVM-based
Audit-based
FortiDB MA cannot share connections; a different connection is required.
FortiDB MA can share connections, but create the connection from within PM or MM
FortiDB MA can share connections, but create the connection from within UBM
FortiDB MA can share connections EVM-based
• When you Close your database connection or turn off monitoring you will get a dialog. If auditing is stopped for a particular database, it is stopped for all databases belonging to that instance. This is due to the fact that a single
FortiDB MA DB2 Audit agent manages all databases for an instance.
1.
since they are not included in the OBJMAINT Audit Layout facility on DB2.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Monitoring DB2 UDB Comparing DB2-Audit-Based and Event Monitor-Based Auditing for DB2 V8
Comparing DB2-Audit-Based and Event Monitor-Based Auditing for DB2 V8
It might be useful to compare the management and analysis information provided by DB2-Audit-based auditing and Event-Monitor-based auditing. In addition to a potential performance benefit offered by the former, this section discusses some other differences.
Functional Differences
These are the Guarded-Item rule differences
User Policy Differences
Rule
Security Violation
Suspicious OS User
Suspicious Auth ID
Suspicious SQL
Statement
Suspicious DB Object
Suspicious Location
Suspicious Client
Application
Security Violation
Multiple Dimension DB
User Rule
Session Policy Differences
EVM-Based Auditing Audit-Based Auditing
Y
Y
N
N
Y
N
Y
Y
Y
Y
N
Y
Y
N
Y
Y
Y
Y
Rule
Login Failure
Suspicious Login Time
Extremely Long
Session
Excessive Read
Activities
High Read Ratio
Suspicious OS User
Suspicious Auth ID
EVM-Based Auditing Audit-Based Auditing
N
Y
Y
Y
Y
Y
Y
Y
Y
N
N
N
N
Y
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
49
Comparing DB2-Audit-Based and Event Monitor-Based Auditing for DB2 V8 Monitoring DB2 UDB
Rule
Suspicious Location
Suspicious Client
Application
Multiple Dimension DB
User Rule
EVM-Based Auditing Audit-Based Auditing
Y
Y
Y
Y
Y Y
50
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Monitoring MS SQL Server Connecting to MS SQL Server
Monitoring MS SQL Server
This chapter explains monitoring MS SQL Server.
Connecting to MS SQL Server
FortiDB MA offers two methods of data retrieval: audit-based and snapshotbased, which are activated on the Database Connection screen with Audit or No
Audit, respectively. Snapshot-based retrieval is less intrusive on the target database and can provide some SELECT statements not provided by the auditbased method. However, audit-based retrieval gives more detail and, in hightraffic situations, can provide data missed by the snapshot method, which only gathers at predetermined intervals.
Consideration for connections
Whenever a user creates a connection to a target database in UBM or PM (with the Audit option) or MM (with the Audit option), s/he needs to specify a trace folder that must reside on the target-database machine. Make sure that the folder does not contain any old trace files created by FortiDB MA. (This needs to be checked only when the very first database connection is made. Subsequent connections to the same target database will not conflict with trace files created by the earlier database connections.)
Server-Level Monitoring
FortiDB MA allows you to monitor and audit databases in one of two ways:
• Database Level: allows scanning of only a single database at a time
• Server Level: allows scanning of multiple databases at a time.
The Server Level mode allows you to scan hundreds, or even thousands, of databases within a single database server and precludes your needing a database connection for each target database of interest. This provides reduced overhead in policy creation and management, as well as facilitates the management of alerts.
Note: Content Monitor (CM) does not support Server Level monitoring.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
51
Server-Level Monitoring
52
Monitoring MS SQL Server
Database and Owner Names Qualify Object with a Server Level Connection
Note: For RDBMS type using audit-based connections, like MS SQL Server 2000, you can expect database.user.object-type qualification.
Using This Feature
3
4
5
1
2
The steps to use the Server-Level Monitoring, Reporting, and Policy Management feature are:
Establish a Server Level database connection within FortiDB MA
Define and enable any Guarded Items you intend to use for monitoring, or auditing in one or more FortiDB MA modules
Enable or Disable Pre-Defined Rules according to your needs.
Schedule monitoring.
Generate Reports or monitor for alerts.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Monitoring MS SQL Server Trace File Consolidation
Create New Database Connection, SQL Server, Audit Data Setting
Note: FortiDB MA offers a performance enhancement that consolidates audittrace files.
Trace File Consolidation
This topic describes the trace file consolidation feature available for MS SQL
Server.
Trace File Consolidation (UBM, MM, and PM)
When the Audit option is used for SQL Server target databases, you get:
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
53
Trace File Consolidation
54
Monitoring MS SQL Server
1.
• For UBM, a consolidated file for all Object Policy alerts, another file for all User
Policy alerts, and a third for all Session Policy alerts
• For PM/MM, a single, consolidated file for all System View and Schema Object alerts
The filename syntax is: iplocks_<policy_id>_<db_id>i_<file_bit>_i.trc
where:
• policy_id is the unique identifier for each database connection (available in the databases internal table) for the specific PM System View, MM Schema
Object, or UBM policy
1
.
• db_id is the unique identifier for each database connection (available in the databases internal table).
• file_bit alternates between 0 and 1 if the ubmMssqlKeepTraceFile debug flag in debug.properties is false or increases sequentially starting from
0 if the ubmMssqlKeepTraceFile debug flag is true.
Note: The location for trace files is set on the Database Connection screen. That setting, if any, overwrites the value
1
specified for dss.ubm.mssql.defaultTraceFolder in dssConfig.properties. Specify a trace folder location which is valid for the particular target SQL server you are connecting to, because the value for dss.ubm.mssql.defaultTraceFolder in dssConfig.properties is common to all MS SQL Server connections and, in some cases, might not be valid on some MS SQL Server machines.
The default value in C:\ expressed in regular-expression notation as c:\:\\
Make sure that
• The path you enter, on the Database Connection screen is valid, since you will not have a chance to alter it once it is saved.
• The directory you select already exists, since it will not be created.
• The directory you choose does not contain any old trace files created by
FortiDB MA.
Note: The same location must exist on all of the SQL Server installations or this guard item may fail on some of the servers. If this issue is not fully known prior to creating the policy, we recommend setting individual guard items.
profiler trace utility
FortiDB MA automatically turns on the profiler trace utility to retrieve the required data. The UBM user should have SQL Server Authentication with
System Administrators server role in order to define profiler trace and execute procedures in the stored procedure
xp_cmdshell
. By default, for security purposes, access to this stored procedure is turned off (even for sa). The commands for providing access to the procedure are:
USE master
1.
The <policy_id>s for UBM Object, User, and Session Policies are 200, 201, and 202, respectively; the policy_id for MM and PM policies is 999.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Monitoring MS SQL Server Trace File Consolidation
GO
EXEC sp_configure 'show advanced options', 1
GO
RECONFIGURE WITH OVERRIDE
GO
EXEC sp_configure 'xp_cmdshell', 1
GO
RECONFIGURE WITH OVERRIDE
GO
EXEC sp_configure 'show advanced options', 0
GO
The target-database server can be configured to store trace files in a specified location when you create a new database connection. On the lower part of the screen, you will see a text box for inputting the destination directory for the output of the trace files. In this text box, specify the full path for the trace file. Ensure that the path you enter is valid, as you will not have a chance to alter this setting once it is saved. Also, ensure that the directory you chose already exists, as it will not be created.
The trace files, by default, will be stored under '
C:\'
, which is defined in
dssConfig.properties
. If you wish to globally specify the same location for all MS
SQL Server trace files, you must also modify the
dss.ubm.mssql.defaultTraceFolder
property in
dssConfig.properties
. This setting will take effect the next time FortiDB MA is restarted. Keep in mind that the same location must exist on all of the SQL Server installations or this guard item may fail on some of the servers.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
55
Trace File Consolidation Monitoring MS SQL Server
56
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Monitoring Sybase Configuring Sybase Auditing
Monitoring Sybase
1
2
3
Connecting to a Sybase database is very similar to connecting to a MS SQL
Server database. Both offer Server Level connections. With Sybase, however, you cannot use Trace File Consolidation.
Size of database
Periodically monitor the size of your sybsecurity database and create a new audit table when the audit log file is full and/or no alerts are seen.
Sybase ASE Servers
Establish your security setup by:
Creating the sybsecurity database
Install installsecurity
Configure Auditing
FortiDB MA automatically manages audit settings. The user created for FortiDB
MA UBM should have System Security Officer Role (
sso_role
) in order to enable or disable audit and read audit trail table permissions.
Create sybsecurity
disk init name = "auditdev", physname =
"C:\sybase\data\sybaud.dat", size = 5120 go disk init name = "auditlog", physname =
"C:\sybase\data\sybaudlog.dat", size = 1024 go create database sybsecurity on auditdev log on auditlog go
Install installsecurity
The SQL script installsecurity contains all required stored procedures and tables of audit. The script is located under
$SYBASE/ASE/scripts
.
isql –Usa –Ppassword < installsecurity
Configuring Sybase Auditing
In order to start auditing, the global configuration parameter, auditing, should be set to 1. If the value is set to 0, auditing will be disabled.
sp_configure “auditing”, 1
FortiDB MA will automatically manage the object and user auditing. There are other recommended options by Sybase. Please refer to a Sybase Administration
Guide for details.
sp_dboption sybsecurity, "trunc log on chkpt", true sp_configure "suspend audit when device full", 1 sp_configure “audit queue size”, 250
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
57
Configuring Sybase Auditing Monitoring Sybase
Multiple audit tables should be configured for rotation. This includes the data and log devices, the rotation mechanism, and the threshold control procedures. In data retrieval, the multiple audit tables are taken into consideration in FortiDB MA.
58
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Filtering Audit Logs (Oracle, DB2) Filtering Audit-log Records
Filtering Audit Logs (Oracle, DB2)
When you monitor target database such as Oracle and DB2, various types of audit-log records are collected. However, you rarely need all of these records.
Filtering can be activated in order to reduce the number of audit-log records that will subsequently undergo a matching process to determine whether or not they correspond to FortiDB MA policies. More specifically, filtering can help:
• Decrease FortiDB MA' resource usage
• Save space by not keeping unnecessary data
• Speed up the matching process
To accomplish these benefits, audit-log records can be evaluated, prior to being saved in the internal DB, in order to determine if they might potentially match policy-related audit-log records. If a match is considered possible, the record can be passed through and stored in the FortiDB MA internal database; otherwise, it can be filtered out and then stored in an OS file or discarded.
Filtering Audit-log Records
For filtering audit-log records, you can adjust the level or amount of filtering and choose whether or not to pass through to, or filter out from, the FortiDB MA internal database the following audit-log records:
• Those that do not relate to FortiDB MA policies
• Those that relate only to disabled FortiDB MA policies
• Those that relate only to enabled policies for which there is no violation
• Those that relate to violations of at least one (Access Violation (or Policy)
Setting) rule for any enabled FortiDB MA policy
Using Filtering
1
2
3
The steps you need to perform in order to use audit-level filtering are:
Stop FortiDB MA
Set the appropriate property value for dss.audit.level parameter in
dssConfig.properties. For details about how to change properties, see
Appendix
A: FortiDB MA Properties Setting
A: FortiDB MA Properties Setting and the CLI
Reference Guide.
Restart FortiDB MA. For details about how to restart FortiDB MA, see the CLI
Reference Guide.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
59
Audit-Level Filtering Filtering Audit Logs (Oracle, DB2)
Audit-Level Filtering
The following figure explains filtering structure for Oracle target database.
60
Oracle Audit-Log Filtering Architecture
Audit-level filtering allows you to realize one or more of the benefits mentioned above by allowing you to specify which audit-log records are preserved, or filtered out before being stored, in the FortiDB MA internal database.
Records Subjected to Audit-Level Filtering
Only audit-log records associated with the following commands can be subjected to filtering:
• SELECT
• DELETE
• UPDATE
• INSERT
• LOGON
• LOGOFF
1
1.
Including LOGOFF BY CLEANUP
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Filtering Audit Logs (Oracle, DB2) Audit-Level Filtering
All other audit-log records are not filtered. Instead, they are stored directly in the
FortiDB MA internal database. For example, all records associated with these system-privilege commands can be stored directly in the FortiDB MA internal database:
• ALTER SYSTEM
• ALTER DATABASE
• AUDIT
In order for these commands to be inserted into the FortiDB MA internal database, you must execute an AUDIT command for each. For example:
• AUDIT ALTER SYSTEM
• AUDIT ALTER DATABASE
• AUDIT AUDIT
Note: In order for FortiDB MA reports to properly reflect your audit settings, run at least one of these modules to collect audit data: PM, MM, or UBM (If you use PM or MM, make sure you set up your database connection using the Audit Data
Retrieval Method).
Note: Not all audit-setting changes will be logged after the audit settings are set.
After the above commands have been executed, only new sessions with auditsetting changes will be logged. Any audit-setting changes made in sessions that were established before executing the above commands will not be logged.
Setting the Amount of Audit-Level Filtering
The properties discussed in this section are located in dssConfig.properties For
details about how to change properties, see the CLI Reference.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
61
Audit-Level Filtering
Setting the dss.audit.level Property
Filtering Audit Logs (Oracle, DB2)
62
Filtering Effect of Various dss.audit.level Settings (Oracle)
The dss.audit.level property determines the amount of filtering to apply to
the commands listed in Records Subjected to Audit-Level Filtering. This property
is located in dssConfig.properties. For details about how to change properties, see
the CLI Reference Guide.
dss.audit.level can have the values whose effects are described in this table:
0
4
3
1, 2
Value
Audit Records Passed Through to the FortiDB MA Internal
Database
All
Only those records associated with enabled and disabled FortiDB
MA policies
Only those records associated with enabled FortiDB MA policies
Only those records associated with enabled FortiDB MA polices that have violations.
Level 2 provides better performance in exchange for more memory consumption.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Filtering Audit Logs (Oracle, DB2) DB2 Audit Log Filtering
DB2 Audit Log Filtering
For FortiDB MA performance reasons, you may want to filter out from, and only send to, the FortiDB MA internal database, a portion of the audit records that are captured by this feature.
Value
0 (default)
1
2
3
4
Filtering Properties
In order to use filtering, you must add the following parameters, and their appropriate values, into the dssConfig.properties file. For details about how to change properties, see the CLI Reference.
dss.db2sqlstatement.level
enables you to specify the type and amount of audit-record filtering. Its syntax is: dss.db2sqlstatement.level=N
N is a numeric value and defaults to 0, which means no filtering. One of the
following values can be specified for the property.
Filter Level Effect
No filtering
Record level
Session level
All audit records are sent to the FortiDB MA internal database
Only audit records with SQL statements that contain violations are inserted into the FortiDB MA internal database (The number of records that are inserted into the FortiDB MA internal database is the same as for level 2.)
Only the first audit record is checked to find violations. For subsequent records, FortiDB MA checks historic information in order to reduce the processing overload that might be caused by filtering. (The number of records that are inserted into the
FortiDB MA internal database is the same as for level 1.)
Only audit records with SQL statements needed by enabled policies are inserted into the FortiDB MA internal database
Policy level (status
(enabled or disabled) sensitive)
Policy level (status
(enabled or disabled) insensitive)
Only audit records with SQL statements needed by all existing policies (both enabled and disabled) are inserted into the
FortiDB MA internal database
Here is the relative filter rate for audit records with SQL statements, with the amount of filtering decreasing (and pass-through amount increasing) from left to right, by level value.
1,2 < 3 < 4 < no filtering
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
63
DB2 Audit Log Filtering Filtering Audit Logs (Oracle, DB2)
Saving Filtered-Out Audit Records
If you do decide to filter out, and not send to the FortiDB MA internal database, all captured audit records, you can use dss.db2sqlstatement.saveTrails to specify whether you want to save or discard the filtered out records for later analysis
1
. Its syntax is: dss.db2sqlstatement.saveTrails=N
N is a numeric value and defaults to 0. This property accepts one of the following
values.
0 (default)
Value
1
Filter Level
Discard filtered-out records
Save filtered-out records in external files
Effect
SQL statements filtered out are discarded
SQL statements filtered out are saved in external files
If you do decide to save the filtered out records, dss.db2sqlstatement.dir enables you to specify where. Its syntax is: dss.db2sqlstatement.dir=String
String represents the absolute path of the directory where the files should be
saved.
Note: When dss.db2sqlstatement.saveTrails=1, a valid directory path on the FortiDB MA machine must be specified by dss.db2sqlstatement.dir.
64
1.
This analysis is not provided by FortiDB MA however.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Alert Notification via Email Configuring Email Notification to Administrator
Alert Notification via Email
FortiDB MA provides the email notification features to the Administrator user and the alert email feature to your designated receivers. This chapter explains the following items:
• Configuring Email Notification to Administrator
Configuring Email Notification to Administrator
1
2
In order to send the alert notification to FortiDB Administrator, take the following steps:
In the Administrator main page, click Modify to display the Modify page.
Enter the email address to Administrator.
Note: To configure alert email notification to the administrator user, set the value of the
dss.enableSendAdminMail
property in the
dssConfig.properties
file to true (default).
Setting No Audit Change Alert
When you configure the connection as Audit or No Audit, FortiDB MA allows you to generate an email alert so that if the connection was changed from Audit to No
Audit, and the Administrator user will be notified.
Once the alert functionality is configured and a violation occurs, the designated
Receiver will receive an e-mail with a message similar to:
The audit option of Guarded Item 227 has been turned off outside of the FortiDB software. FortiDB will not be able to pick up audit information related to Packages.
Note: No emails are generated when the audit setting is changed from No Audit to Audit.
The following table describes the Guarded Items as well as the AUDIT/NOAUDIT commands.
audit option audit statement noaudit statement
Packages
AUDIT
PROCEDURE;
NOAUDIT PROCEDURE;
Synonyms
AUDIT SYNONYM; NOAUDIT SYNONYM;
NOAUDIT TABLESPACE;
Tablespace s
Tables
Triggers
AUDIT
TABLESPACE;
AUDIT TABLE;
AUDIT TRIGGER
NOAUDIT TABLE;
NOAUDIT TRIGGER
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
65
Configuring Alert Emails Alert Notification via Email
66
Views
AUDIT VIEW NOAUDIT VIEW
Setting Guarded Items Change Alert
When the guarded items are enabled, disabled or deleted, the alert notification email will be sent for the following guarded items:
• User-defined Rules for any module
• Pre-defined Rules for any module
• Schema Objects in Metadata Monitor
• System Views in Privilege Monitor
• User, Object, and Session Policies in User Behavior Monitor
Example
The following is an example for UBM, but other modules are similar.
Examples of email messages appear below. In the first, a user creates a new object policy for
dbo.employees
. The user checks Enable this guard item checkbox. Another user checks the Select checkbox to the left of the guard item name, and clicks Disable Item(s). This guarded item is now disabled. An email with the following format will be sent:
User: dssuser disabled Object Policies guarded item: dbo.Employees of database mssql_192.168.1.177([email protected]:1433) from localhost
Now, if the user repeats the same process and enables the guarded item, another email is sent:
User: dssuser enabled Object Policies guarded item: dbo.Employees of database mssql_192.168.1.177([email protected]:1433) from localhost
Here is an example of an email message that will be triggered when a Rule or
Policy is deleted:
User: dssuser deleted Object Policies guarded item: dbo.Employees of database mssql_192.168.1.177([email protected]:1433) from localhost
In summary, an alert email is generated every time the guarded item is enabled, disabled, or deleted, but no action is taken when the item is created.
Configuring Alert Emails
You can identify which users should receive alerts via email. In order to do this, invoke the Default Email Settings screen by clicking the Set Defaults -> Email
Settings menu.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Alert Notification via Email
Sender Settings
Configuring Alert Emails
2
3
1
Setting the Email Sender Parameters
To configure the settings:
SMTP Host IP address or name. This must be set properly in order to generate emails.
Sender Email address. This is what will be displayed to receivers as the originating address of the alerts.
Click on the Set Sender button in order to save the configuration information.
Receiver Settings
Just below the Sender fields on the Default Email Settings screen is where you configure individual or group email recipients.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Setting the Email Receivers Parameters
67
Configuring Alert Emails
Adding Individual Email Receivers
Alert Notification via Email
68
3
4
1
2
5
Adding Individual Email Receivers
In order to add individual email recipients:
Click the [Add Receiver] button.
Fill in the Name, Email Address, and (optionally) Position fields.
Click the Save button.
Check the Default Receivers checkbox in the row next to the receiver you want to receive alerts
Click the [Set Default Receivers] button in order to activate your choice.
Enabling Default Receivers
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Alert Notification via Email
Modifying Email Receivers
Configuring Alert Emails
1
2
Modifying Receivers
In order to modify an existing email receiver:
Click on the Name (Email Address) in the row of interest.
Click the [Modify Selected] button.
3
Modify Email Receiver Dialog
Make any changes you want in the dialog and click Save.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
69
Configuring Alert Emails
Deleting Email Receivers
Alert Notification via Email
70
1
2
Deleting Receivers
In order to modify an existing email receiver:
Click on the Name (Email Address) in the row of interest.
Click the [Delete Selected] button.
Adding Groups of Receivers
1
2
3
You may want to define different groups of recipients for assessing different databases. In order to add a group of email recipients:
Click on the Add Group button
Give the group a name
Click the Add Email Group button
Email Group Dropdown
The group will appear after that in the Email Group dropdown.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Alert Notification via Email Configuring Alert Emails
1
2
3
Adding a New Recipient to a Group
Next, when you next add an individual, you will also get the opportunity to add that individual to one or more of your groups. After you have defined your group(s), the steps are:
Click on the [Add Receiver] button to add a new receiver and to add that receiver to a group or
Click on the row of an existing receiver you want to add to a group and click the
[Modify Selected] button.
Once the Add Email Receiver or Modify Email Receiver popup screen displays, check the checkbox next to the appropriate group and click the Save button.
You may also delete and rename email groups via the [Delete Group] and
[Rename Group] buttons, respectively.
Deleting or Renaming a Group
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
71
Configuring Alert Emails Alert Notification via Email
72
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Administration Utilities User Administration
Administration Utilities
This chapter explains FortiDB MA Administration utilities.
There are the following administration utilities available in FortiDB MA administration main screen.
• User Administration: adding new users, deleting users, and modifying users
(their roles or permissions)
• Alert Archive/Restore: archive/restore alert messages
• Auto Archive: archive/restore alert
• Monitor Resources: allows for updating PDR information
The Administrator user, typically, does not have access to the FortiDB MA modules and module users do not have access to administration utilities, but just to the modules assigned to them by the administrator. The reason for this is so that an administrator does not, accidentally or otherwise, change module data, and that a user does not change application settings.
A default administrator user, admin, is created with the installed FortiDB MA system. (The default password is fortidb1!$)
User Administration
User Administration allows you to add users, delete users and modify users information.
Archiving and Restoring Alerts
You might want to periodically purge your system of old alerts to streamline your reports and for performance. Alert archiving removes alerts from your FortiDB MA internal database. Once archived, they can be restored later, but usually, you will only archive old alerts.
Most of the following applies to both Alert Archive/Restore and Auto Archive.
These are utilities accessible to the FortiDB MA Administrative user.
Alert Archive/Restore
FortiDB MA provides the feature to archive and restore alerts.
In order to start the process, click the Go button on the Alert Archive/Restore line.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
73
Archiving and Restoring Alerts Administration Utilities
74
Configuring Alert Archive/Restore
Note: Archiving removes both alert- and audit-related records.
Incremental Smart Archiving
FortiDB MA offers incremental smart archiving. Incremental smart archiving offers:
• Archiving only changes that have occurred since the last archive
Once an archive is completed, its timeframe is remembered so that subsequent archives that include that same timeframe will not include duplicate records. This will increase the performance of the subsequent archives as well as conserve system resources used by FortiDB MA.
• You only need to archive since the last-record date of a previous archive
Caution: If you archive the same alerts in multiple times, you cannot restore the archive file that you archived later time. This is because the same alerts with same timestamps are not archived twice. If you want to restore alerts that you archived multiple times, you need to restore the archive file with the alerts that you archived at the first time.
Archiving from command line (Standalone only)
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Administration Utilities Archiving and Restoring Alerts
FortiDB MA provides a consolidated script, autoarch.sh, for command-line archiving of PostgreSQL-internal-database data. This script takes the parameters shown below.
Note: The dates you use for the date and startdate parameters should be in
YYYY-MM-DD format.
1
2
3
4
Example Archive Scenario
You started using FortiDB MA and getting alerts on August 1, 2006
So far, you have not archived at all.
On August 16, in Alert Archive/Restore, you
a
Request that an archive be done for 1-day-and-older alerts b Name the archive '8-15_1'. c A file named 8-15_1 will be created that contains the alerts from August 1 to August 15 and these alerts will no longer show up in Alert Messages.
On August 17, in Alert Archive/Restore, you request that an archive be done for 1day-and-older alerts
a
Request that an archive be done for 1-day-and-older alerts b Name the archive '8-16_1'.
c A file named 8-16_1 will be created that contains only the alerts from
August 15 to August 16 and these alerts will no longer show up in Alert
Messages.
Note: Since FortiDB MA does incremental archiving, you should save ALL your archive files. For example, if you archived as in the example above, then on Aug
17 you do a Restore of 8-15_1, notice that in the Alert Messages page all alerts from Aug 1 to Aug 15 appear. Then on Aug 20 you do another (1-day-and-older) archive, called 8-19_1. Do not expect 8-19_1 to contain all the alerts you noticed.
Because of the incremental method, only alerts since the previous archive will be contained in this 8-19_1 (Aug 17 thru Aug 19).
Example Restore Scenario
Assume that it is Aug 20 and you want to restore the alerts for the Aug 3 thru Aug
7 in order to confirm some suspicious activity in UBM.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
75
Auto-Archive Administration Utilities
So simply restore the 8-15_1 file from the above Archive scenario. It contains alerts (and audit records) that include those dates.
Limitations and Prerequisites
• Due to the incremental method FortiDB MA uses, archiving data prior to last archive's ToTime
1
is not possible.
• The Custom Reports Database is not archived
• Restoring archived files that originated in FortiDB MA versions prior to 6.0.01 will result in timestamps without millisecond precision; namely: yyyy-MM-DD HH:mm:ss
where ss represents seconds. Restoring data that originated in FortiDB
MA versions 6.0.01 or
higher will produce timestamps with millisecond precision; namely: yyyy-MM-DD HH:mm:ss.SSS
where SSS represents milliseconds.
Auto-Archive
This topic describes Auto archive feature.
In order to start the process, click the Go button on the Auto Archive line.
76
1.
the latest ToTime in the archivehistory table
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Administration Utilities Auto-Archive
Configuring Auto Archive
The Auto Archive feature will:
• Enable automatic alert backups whose frequency you can specify and
• Produce immediate alert backups
Using Auto Archive:
• If you click the Save button with the Enable Archive checkbox enabled, you will configure subsequent archives whose frequency is determined by the setting you choose in the Select Archive Period dropdown list box.
• If you click the Save button with the Enable Archive checkbox disabled, nothing will happen.
• If you click the Save&Run button with the Enable Archive checkbox enabled, you will both configure subsequent archives whose frequency is determined by the setting you choose in the Select Archive Period dropdown and initiate an immediate archive.
• If you click the Save&Run button with the Enable Archive checkbox disabled, nothing will happen.
• Enable Archive checkbox: enables or disables the archive
• Save button: saves the setting of the Enable Archive checkbox and of the archive period in the internal database
• Save&Run button: same as for the Save button and executes the archive immediately
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
77
Auto-Archive Administration Utilities
Archive Period Dropdown
Auto Archive can be scheduled to perform the backup with these intervals:
• 1, 2, or 10 days
• 1, 2, 3, 6, or 12 months
Note: If the Auto Archive frequency is shorter than the UBM Learn cycle, the audit entries could be archived before the UBM has a chance to learn from it, therefore the access frequency pattern may no longer be correct.
Restoring Auto-Archived Alerts
78
Configuring Archive/Restore Alerts
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Administration Utilities Entitlement Report
In order to restore an alert backup, Select radio button in the row containing the file of interest and click on the [Restore] button.
Note: If your Auto Archive frequency is more than the UBM Learn cycle, audit entries could be archived before UBM has a chance to learn from them; therefore, the Access Frequency pattern may no longer be correct.
Entitlement Report
This topics describes Entitlement Report feature.
Entitlement Report
FortiDB MA administrators can run an Entitlement Report that shows the roles assigned to each user.
The output format for an Entitlement Report can be any of these:
• Excel
• Tab-delimited
• Comma-delimited
• Printable (HTML)
The report abbreviations have the following meanings
Role Capability Role
Abbreviation
CM
MM
PM
UBM
ARM
CR
SR
Content Monitor module operations
Metadata monitor module operations
Privilege Monitor module operations
User Behavior Monitor module operations
Alerts Report Manager reports-generation capability
Custom Reports report-generation capability
SOX
1
Reports report-generation capability
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
79
Monitor Resources Administration Utilities
AD
Auto Discovery capability
1.
Sarbanes-Oxley Act (Public Company Accounting Reform and Investor
Protection Act of 2002)
Monitor Resources
This topic describes Monitor resources feature.
80
Monitor-Resources Architecture
The Monitor Resources module collects information about the health of various
FortiDB MA components such as the internal database, Java Virtual Machine
(JVM) memory, and agents
1
. The module is configurable via a configuration file.
For example, if JVM memory falls below a specified threshold level as specified in
dssConfig.properties
in: dss.minHealthFreeMemory=1024000
1.
The Oracle OS-Audit Agent, the DB2 Agent.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Administration Utilities
an alert can be generated.
Download DB Agents
Monitor Resources Settings
PostgreSQL Maintemance: vacuum (for Standalone users only)
For the PostgreSQL internal databases, the SQL vacuumdb command should be run periodically like this: vacuumdb -af in order to:
• Recover disk space occupied by updated or deleted rows.
• Keep the transaction count from reaching its maximum value if FortiDB MA runs in an environment which has a lot of access.
• Update data statistics used by the PostgreSQL query planner.
• Protect against loss of very old data due to Transaction ID wraparound
1
.
Download DB Agents
This feature allows users download FortiDB MA agents for Oracle target database and DB2 target database.
For details about using Oracle or DB2 agents, see
Using the OS-File Agent
section and
Creating a Database Connection
1.
The Transaction ID is the identifier that the system uses for each transaction. It will 'wraparound' or be reset when the transaction count gets close to 2^29( =
536,870,912).
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
81
Download DB Agents Administration Utilities
82
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Appendix A: FortiDB MA Properties Setting Changing FortiDB Properties Settings
Appendix A: FortiDB MA Properties Setting
You can change FortiDB MA properties default settings, using FortiDB CLI
(Command Line Interface).
Changing FortiDB Properties Settings
1
2
3
For a listing of most of the configurable properties within FortiDB MA, along with their explanation and default values, see the Property Files section in the next topic.
In order to change a FortiDB property:
Select a configurable property from properties files in the next section.
Using Command Line Interface, append the configurable property's name and your new value for it to properties files. For details about how to change properties, see the CLI Reference Guide.
Using CLI, restart Tomcat. For details about how to restart Tomcat, see the CLI
Reference.
dssConfig.properties
Here is a list of the properties within
dssConfig.properties,
the principal configuration file for FortiDB MA. Call FortiDB support if you need more detailed information.
Property Purpose
Possible
Values
dss.alertInTextFormat
Controls whether to use plain text (true) or HTML (false) for the alert message true or false
Default
true
dss.archiveBatchRows
Determines the batch size of the archive processing.
any positive integer
20000
Comments
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
83
Changing FortiDB Properties Settings Appendix A: FortiDB MA Properties Setting
Property
dss.audit.level
dss.auditretrievaldelay
Purpose
Possible
Values Default
Determines the amount and type of SQL statements in the audit log that you want to keep for later analysis.
•
A level of '0' means that all statements are kept and none are filtered out;
•
A level of '1' or '2' means that only FortiDB MA-gathered violation records that do not duplicate other records from the same session for enabled policies are kept
•
A level of '3'' means that only
FortiDB MA-related audit-log records for enabled policies are kept
•
A level of '4' means that only
FortiDB MA-related audit-log records for enabled and disabled policies are kept.
Determines the delay in seconds, following a timeout that FortiDB
MA will wait to retrieve auditrelated OS files. (This should be set to a value greater than or equal to the values set for dss.ubm.oracle.osOptTimeout and timeout, which should both be the same)
0,1,2,3,4 any positive integer
0
60
Comments
Compared to a level of '1', a level of '2' provides better performance in exchange for more memory consumption.
Used for PM,MM,UBM
84
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Appendix A: FortiDB MA Properties Setting Changing FortiDB Properties Settings
Property
dss.auditretrievaltimeb
uffer dss.charset
dss.cm.groupbyviolati
onlimit
Purpose
Determines the time buffer for audit log retrieval
Possible
Values Default Comments
any positive integer
)
60
(seconds
When an audit-retrieval cycle finishes retrieving a portion of audit logs from the target database, it stores the timestamp of the latest record retrieved in the internal database.
In the past, the next retrieval process would gather records subsequent to that latest timestamp.
Assume the timestamp column contains these values:
timestamp column
11:59:00
12:01:00
12:02:00
11:58:00
Since 12:02:00 is the latest timestamp, that value would be stored in the internal database and the next retrieval process would gather records whose timestamp was later than 12:02:00.
dss.auditretrievaltimebuf
fer allows that behavior to change. Assume it is set to the default of 60 seconds and that the timestamp-column values are as above.
(Again, the latest timestamp value is 12:02:00 and it would be stored in the internal database.)
But now, the next retrieval process would gather records whose timestamp was later than 12:02:00 minus 60 seconds (or 12:01:00).
Determines the character set used by the FortiDB MA application
In order to conserve memory for other policy usage, determines the maximum number of violations allowed before the
Group-By Min/Max/Avg policy is disabled and an alert is sent.
UTF-8 any positive integer
100 See the Content Monitor User
Guide
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
85
Changing FortiDB Properties Settings Appendix A: FortiDB MA Properties Setting
86
Property Purpose
Possible
Values Default
dss.cm.minmaxavgviol
ationlimit dss.cm.oraclesqlfetch
delay dss.cm.oraclesqlfetchs
ize dss.cm.udrdiffmodelro
wlimit dss.cm.udrviolationlim
it dss.country
dss.db28AuditBatchSi
ze
In order to conserve memory for other policy usage, determines the maximum number of violations allowed before the
Min/Max/Avg policy is disabled and an alert is sent.
For the Min/Max/Avg and
Distribution policy types, you can enable the fetch engine by changing the dss.cm.oraclesqlfetchsiz
e and dss.cm.oraclesqlfetchdel
ay. Typical values are 1000 and
30000, respectively
For the Min/Max/Avg and
Distribution policy types, you can enable the fetch engine by changing the dss.cm.oraclesqlfetchsiz
e and dss.cm.oraclesqlfetchdel
ay. Typical values are 1000 and
30000, respectively.
In order to conserve memory for other policy usage, determines the maximum number of violations allowed before the
UDR Diff policy is disabled and an alert is sent.
In order to conserve memory for other policy usage, determines the maximum number of violations allowed before the
UDR is disabled and an alert is sent.
Determines the country part of locale
Determines the batch size when the insertion to internal database.
any positive integer any positive integer any positive integer any positive integer any positive integer values defined by
ISO-3166 any positive integer
100
0
0
1000
1000
US
20
Comments
See the Content Monitor User
Guide
See the Content Monitor User
Guide
See the Content Monitor User
Guide
See the Content Monitor User
Guide
See the Content Monitor User
Guide
dss.db28auditPort
Determines the port number to connect DB2 agent.
any positive integer
51236
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Appendix A: FortiDB MA Properties Setting Changing FortiDB Properties Settings
Property
dss.db28Timeout
Purpose
Possible
Values Default
Determines the time-out value for processing.
any positive integer
60
dss.db2udr.sqlstate
dss.db2udr.terminatec
har
Determines the default string constant used for SQLSTATE return codes
Determines the termination character for scripts used within
UDRs for DB2 target databases any valid character
1
IPERR
@
dss.dbconnectionpool
size
Determines the connection pool size for a PostgreSQL internal database.
any positive integer
100
Comments
When dbconnectionpoolsize is changed, the PostgreSQL configuration has to be modified accordingly. max_connections and shared_buffers are defined in
postgresql.conf. One guarded object uses two connections, at most, to the internal database. So, set max_connections to 100 for every 50 objects that are being monitored, and scale shared_buffers to at least twice the number of connections.
dss.eala.isdb2list
dss.enableSendAdmin
Mail dss.encription.algorith
m
Determines whether (true) or not (false) a drop down list of
DB2 event monitors should be displayed on the EALA page.
Determines whether (true) or not (false) to send mail to administrators when a policy setting is changed
Determines the algorithm used to encrypt true or false false true or false true
DES or
DES-EDE
DES
dss.exportCharset
dss.failedloginattempt
s
Determines the character set used when exporting reports
Specifies how many login attempts the user is entitled to before the user's account Status will be set to Locked.
Character set name supported by Java
Any positive integer; if
<=0, then this property is not considered
UTF-8
3
Do not change. This property is configured by the installer
Does not apply to the Admin user.
The number of attempts is stored in memory only. Therefore, when the FortiDB MA service is restarted, this information is lost.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
87
Changing FortiDB Properties Settings Appendix A: FortiDB MA Properties Setting
Property
dss.fullAppName
dss.fullDBName
dss.guardstart
dss.isrecovery
dss.language
Purpose
Possible
Values Default
false Determines whether (true) or not (false) to display
Application name with IP address of FortiDB MA server in the alert message
Determines whether (true) or not (false) to display database name with IP address and port of the target database in the alert message
Determines the number of days ago for which monitoring should start for any enabled guarded items. If this property is set to 0, only extracted data having timestamp greater than 12.00 AM today will be considered for guarding. If this property is set to
1, only extracted data having timestamp greater than 12.00 AM yesterday will be considered for guarding. If the value is -1, the default, all audit records will be considered.
For example, suppose you have a user SCOTT whose activity has resulted in audit records for the past year. Today you create a
User Policy to monitor SCOTT but are only interested in his violations starting from today.
Just set this property to 0.
Should automatic recovery take place if the FortiDB MA server is shutdown? If true and the
FortiDB MA server goes down, when the server is restarted, all databases which were open will be restored to their prior state.
Determines the language part of locale true or false true or false true or false values defined by
ISO-639 false
-1 true en
Comments
Applies only to Oracle, MS-SQL
2
, and Sybase
This property value will be considered only once: when audit retrieval is started for the database connection for the very first time.
Applies only to UBM.
88
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Appendix A: FortiDB MA Properties Setting Changing FortiDB Properties Settings
Property Purpose
Possible
Values Default
dss.lockaccountdays
dss.maxThreadCount
dss.minFreeMemory
dss.minHealthFreeMe
mory dss.minpasswordlengt
h dss.mm.datacache
Specifies, in days, how long an account can be inactive before the user's account Status will be set to Locked.
Determines whether (true) or not (false) to cache snapshots for the MM module.
Any positive integer; if
<=0, then this property is not considered any positive integer
30
20 In order to conserve system resources, when the number of timer threads gets bigger than this value, a new created timer thread is blocked until the number of timer threads gets smaller than this value.
In order to conserve system resources, when the remaining heap memory gets smaller this value, a new created thread is blocked until the heap memory get bigger then this value.
Determines the threshold of available JVM memory. If available memory falls below the specified level, an alert email message is sent.
Specifies the minimum length of a user password.
any positive integer
1024000
00 any positive integer
1024000
00
Any positive integer; if
<=0, then this property is not considered true or false
8 false
dss.mm.monitorsyste
mobjects
Determines whether (true) or not (false) MM should monitor changes in system tables and objects.
dss.mssql.disabletrace
Determines whether (true) or not (false), when a guarded item is disabled, the trace for it should also be disabled. true or false true or false false false
Comments
Does not apply to the FortiDB MA
Administrative user
This works when dss.runningThreadContro
l
is set to true. Threads will be queued if the resources are not immediately available.
This works when dss.runningThreadContro
l is set to true. Threads will be queued if the resources are not immediately available
This value is in bytes. When dss.runningThreadContro
l is set to true, this value should not exceed 1 MB.
Only applicable to a SQL Server
2000 target database. If this parameter is true, when guarded item is disabled, trace collection for it will be stopped.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
89
Changing FortiDB Properties Settings Appendix A: FortiDB MA Properties Setting
Property Purpose
Possible
Values Default
false
dss.mssql.disabletrace
If this property is true, trace collection will be stopped when guarded item is disabled. By default, trace collection will continue for a guarded item even if it is disabled.
dss.mssql.tracestopti
me
You can set the value in hours to specify the stop time of the traces created by FortiDB MA. For example, if the current time is
4.30p on the target SQL server, if you set dss.mssql.tracestoptime=2, the trace will stop at 6.30p. For every audit retrieval cycle, when a new trace is created, the trace stop time will be calculated as current time + dss.mssql.tracestoptime.
By default dss.mssql.tracestoptime= -1 which implies that the trace will not be stopped until the guarded item is deleted.
dss.needUpdateLink
Determines whether to display the Update link in the alert message.
true or false true or false
-1 false
Comments
During normal operation, this value should not matter as every time a trace file is read, a new trace is started.
dss.OneThreadPerDB
Determines whether (true) or not (false) to do processes on just one thread for every target database by each module.
true or false false If you are monitoring more than ten databases, set: dss.runningThreadControl= true dss.OneThreadPerDB=true
dss.oracle.dynamicAu
ditSetup
Determines if Oracle guardeditem auditing is automatically configured by FortiDB MA (false) or by the user (true).
true or false false
90
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Appendix A: FortiDB MA Properties Setting Changing FortiDB Properties Settings
Property
dss.passwordlifetime
dss.pm.datacache
dss.recordbatchsize
Purpose
dss.oracle.monitorSys
Op
Helps determine whether SYS user activities will be gathered while monitoring Oracle targets.
Possible
Values
true or false
Specifies, in days how long a password can be used before it has to be changed. If a password has expired when the user logs on, the user will be taken directly to the Change Password page where the user will have to change the password before being allowed to logon to the system.
Determines whether (true) or not (false) to cache snapshots for the PM module.
Any positive integer; if
<=0, then this property is not considered true or false
90 false
Determines the number of auditlog records that should be retrieved at one time, in order to incrementally process large audit logs and to conserve Java heap memory.
0 (which means no incremental processing) or a positive integer
20
Default
false
Comments
The target Oracle database must be configured as audit_sys_operation=true and, if it is configured with audit_trail=OS, then dss.oracle.monitorSysOp must be set to false. Otherwise, if audit_trail=DB, then dss.oracle.monitorSysOp must be set to true.
Also applies to the Admin user
This applies to environments consisting of an internal
PostgreSQL database and a target
Oracle database, is used to tune
Java heap-memory consumption
(and performance), and does not affect functionality at all.
dss.rm.fullDBdescripti
on dss.runningThreadCon
trol
Determines whether (true) or not (false) to display the database name with IP address in the GUI.
Determines whether (true) or not (false) to limit the number of concurrent running threads.
true or false true or false true false When set to true, the value for dss.minFreeMemory
should not exceed 1 MB. If you are monitoring more than ten databases, set: dss.runningThreadControl= true dss.OneThreadPerDB=true
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
91
Changing FortiDB Properties Settings Appendix A: FortiDB MA Properties Setting
92
Property
dss.serverlevel.exclud
ed.mssql
Purpose
Determines the names of the
MS-SQL databases to exclude from monitoring when a Server
Level connection has been established.
dss.serverlevel.exclud
ed.sybase
Determines the names of the
Sybase databases to exclude from monitoring when a Server
Level connection has been established.
dss.sessionTimeout
dss.SNMP.Community
Name dss.SNMP.ShowDetail
s dss.SNMP.TrapEnable
d dss.SNMP.TrapReceiv
er
Determines the number of minutes of inactivity that can elapse before you must login to
FortiDB MA again.
Determines the password for sending trap notifications to the target SNMP receiver any userdefined string
Determines whether (true) or not (false) the SNMP trap contains the detail-providing
.1.3.6.1.4.1.16887.100.117 object
Determines whether (true) or not (false) to send SNMP traps to the receiver true or false true or false
Comma-delimited list of IP
Addresses or host names of
SNMP receivers.
Possible
Values Default
any valid database name any valid database name any positive integer model, tempdb, pubs, msdb, northwin d model,te mpdb,pu bs2,pubs
3,jpubs,s ybsyntax, sybsecuri ty,sybsys temdb,sy bsystemp rocs
30 public false false pwc305j
Comments
dss.SNMP.TrapReceiv
er.charset
Determines the character set for the SNMP trap receiver.
dss.SNMP.TrapStructu
re
Determines the SNMP trap format
dss.SNMP.Version
Determines the SNMP version
UTF-8 fixed or conventio nal convent ional
Fixed only works with UBM
1, 2 2 A setting of "2" means Communitybased SNMPv2 or SNMPv2C
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Appendix A: FortiDB MA Properties Setting Changing FortiDB Properties Settings
Property
dss.syb.checkAuditTa
bleInt
Purpose
Determines the interval, in seconds, at which to check the
Sybase audit table
Possible
Values Default
any positive integer
20
dss.ubm.db27.evmPort
Determines the port on which
FortiDB MA will receive files from the DB2 agent.
any valid port
51235
dss.ubm.db27.evmThr
eadPoolSize dss.ubm.db27.evmTim
eout dss.ubm.guarddays
Determines the number of threads per database connection can simultaneously communicate with the DB2 agent at the same time.
Determines how long FortiDB MA will wait for the DB2 agent to respond before deciding that the agent is not running. (Measured in seconds)
Access Frequency rules use guarded-UBM-item data from audit-related tables. This property determines the how far back in time (in days) that the data should be considered for the
Access Frequency rules.
1
60
The maximum is
365 days.
10
dss.ubm.limitLogRows
Determines the result row limit in the audit log navigation when the target RDBMS type is Oracle or
MSSQL. If the number of the rows is more than allowed then a warning message will be given.
dss.ubm.maxaccessvi
olations dss.ubm.minimumrequ
ireddata
Determines the maximum number of displayed access violations in a single alert.
Determines the minimum number of learned records before starting guard by percentile.
any positive integer
1000 any positive integer any positive integer
1000
100
Comments
For example, if the value is specified as 6, the Access
Frequency rules will consider all records in the guarded-UBM-item data having timestamps 6 days old or newer.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
93
Changing FortiDB Properties Settings Appendix A: FortiDB MA Properties Setting
Property
dss.ubm.msql7.max_it
ems dss.ubm.mssql.default
TraceFolder dss.ubm.oracle.osOpt
DoTruncate dss.ubm.oracle.osOpt
MaxFileSize dss.ubm.oracle.osOpt
Port dss.ubm.oracle.osOpt
RecordBatchSize dss.ubm.oracle.osOpt
ThreadPoolSize dss.ubm.oracle.osOpt
Timeout
Purpose
Possible
Values Default
This property value is passed to
xp_trace_addnewqueue(), the
MS SQL 7.0 trace API. From the
MSSQL7 manual: max_items is an integer representing the maximum number of items buffered or stored in the trace queue. The recommended value is 1000, the minimum is 1, and the maximum is 20,000. When using FortiDB MA, 1000 may be too small in some environments with heavy loads. 20000 is safer although the amount of memory consumption gets a little larger.
Determines where the trace files will be stored for MS SQL server
2000/2005 databases trace files for UBM, MM, and PM (with Data
Retrieval Method = Audit)
Determines whether (true) or not (false) Oracle audit files should be truncated.
Determines the maximum size (in
MB) that the audit file can reach before it is truncated.
Determines the port number that the FortiDB MA should use in order to connect to the agent.
Determines the number of audit records which are batched together before processing
The maximum number of worker threads which are spawned in order to transfer audit-related files, in parallel, to the FortiDB
MA machine.
Determines the maximum time, in seconds, FortiDB MA will wait for agent response before it times out.
any positive integer any valid path true false or any positive integer any valid port number any positive integer any positive integer any positive integer
1000 c\:\\ false
100
51234
20
10
60
Comments
Only applies to MS SQL 7.0
See
94
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Appendix A: FortiDB MA Properties Setting Changing FortiDB Properties Settings
Property Purpose
Possible
Values Default Comments
dss.ubm.OracleUseIPa
sTerminal
3 dss.udpport
dss.watchperiod
Used with the "Suspicious
Location" Access Violation setting for a UBM session policy.
When set to true, UBM always tries to use the IP address instead of the terminal name as the client location.
Determines the port FortiDB MA will use while using UDP to discover SQL Server servers during Auto Discovery
FortiDB MA caches holiday definitions and will retrieve them from the internal database when the holiday info exceeds the age of this value (in minutes).
true false or false
61234
60
Applies only to Oracle target databases and for either audit_trail=DB or OS.
1.
2.
dss.workerauditretriev
alstart
Determines the number of days ago from which audit-record retrieval should start. If left at the default of 0, only audit records having timestamp greater than
12.00 AM today will be retrieved.
If set to 1, only audit records having timestamp greater than
12.00 AM yesterday will be retrieved. If set to -1, all audit records will be retrieved.
0 Applies only to Oracle, MS SQL
Server
4
, and Sybase.
This property value will be considered only once: when guarding is started for the very first time for a guarded item.
Applies to audit-based MM and
PM as well as to UBM.
Your DB2 script should avoid using statements that have, within them, characters used for statement termination.
SQL Server 2000 and 2005 only.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
95
Changing FortiDB Properties Settings Appendix A: FortiDB MA Properties Setting
3.
See the following result on SQL*Plus.
SQL> SELECT action_name, timestamp, terminal,comment_text FROM dba_audit_trail WHERE action in (100,101,102);
ACTION_NAME TIMESTAMP TERMINAL
-------------------- ----------------- ----------
COMMENT_TEXT
-------------------------------------------------------------------------------------------------------
LOGOFF 08-22 10:30:02 pts/2
Authenticated by: DATABASE
LOGOFF 08-22 10:33:06 EBIHARA
Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=192.168.10.57)(PORT=4588))
LOGOFF 08-22 10:36:30 unknown
Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=192.168.10.143)(PORT=2997))
DBA_AUDIT_TRAILS view stores client location information both in TERMINAL and COMMENT_TEXT. Each audit record was generated by accesses as follows.
1st rec: access from local host
2nd rec: access via Oracle NET on TCP
3rd rec: access via JDBC on TCP
When dss.ubm.OracleUseIPasTerminal is set to false, session policy always adopts TERMINAL value as client location. When it's true or
TERMINAL has null value, session policy tries to retrieve IP address from COMMENT_TEXT at first. If IP address cannot be found, session policy recognizes TERMINAL as client location. Thus, according to the example above, client location becomes as follows.
[dss.ubm.OracleUseIPasTerminal=false]
1st rec: pts/2
2nd rec: EBIHARA
3rd rec: 192.168.10.143
[dss.ubm.OracleUseIPasTerminal=true]
1st rec: pts/2
2nd rec: 192.168.10.57
3rd rec: 192.168.10.143
4.
SQL Server 2000 and 2005 only.
debug properties
This debug properties contains flags to enable or disable debugging information.
To obtain debugging information, the following properties values should be true. dbpool=true threadinfo=true auditfilter=true
In a production environment, they should be set to false
(default) dbpool=false threadinfo=false auditfilter=false
96
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Appendix A: FortiDB MA Properties Setting Changing FortiDB Properties Settings
serverConfig.properties
The properties for the Oracle OS agent are contained and defined in this file. For more specifics about setting the properties in this file, see
.
serverConfigDB28.properties
The properties for the DB2 UDB V8 agent are contained and defined in this file.
For more specifics about setting the properties in this file, see
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
97
Changing FortiDB Properties Settings Appendix A: FortiDB MA Properties Setting
98
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Appendix B: Using SNMP with FortiDB MA
Appendix B: Using SNMP with FortiDB MA
Introduction
• For all versions of FortiDB MA, SNMP-alert traps are supported.
• FortiDB MA supports SNMP v1 and v2c.
• Customers should use the currently shipped FortiDB MA-MIB (Management
Information Base) file in order to interpret FortiDB MA-specific OIDs (object identifiers).
• In order to view FortiDB MA alert messages, customers can use the
snmptrapd Network Management Station (NWS) daemon contained in the
open-source NET-SNMP toolkit obtainable from http://netsnmp.sourceforge.net/ .
• Enhanced viewing may be accomplished by using a commercial product, such as IBM's Tivoli, BMC's Patrol, or HP's OpenView, that contains snmptrapd or a facsimile.
Introduction
SNMP Overview
Capabilities
FortiDB MA offers these SNMP features:
• Multiple trap receiver capability
• Configurable Community Name
• Fixed as well as Conventional trap format
• Traps for:
• Adding, Modifying, Enabling, Disabling, and Deleting Policies, including
UDRs.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
99
Using This Feature Appendix B: Using SNMP with FortiDB MA
• Disabling the Oracle Audit Setting
• Detailed Traps for these Administrative events:
• Loss of connection to target databases
• Tomcat starting up and shutting down
• Internal database starting up and shutting down
Using This Feature
1
2
3
In general, the steps to use the SNMP Enhancements are:
Decide upon, and configure, one or more SNMP trap receivers (which FortiDB MA does not supply) and which of the FortiDB MA sent traps you want to filter out or to expose using the receivers.
Set up the appropriate properties in dssConfig.properties: a dss.SNMP.TrapEnabled=true b dss.SNMP.Version=2 <use '2' if the Trap Receiver uses
SNMP v2c; if the Receiver uses SNMP v1, set this to
'1')> c dss.SNMP.CommunityName=<set this to the same value used by the Trap Receiver)> d dss.SNMP.TrapStructure=<conventional | fixed>
Run FortiDB MA and wait for traps.
Traps for Adding, Modifying, Deleting, Enabling or Disabling
Rules
Traps are sent when rules are added, modified, deleted enabled or disabled. They contain the components shown here.
OID
enterprises.16887.100.21
enterprises.16887.100.103
enterprises.16887.100.104
enterprises.16887.100.105
enterprises.16887.100.106
enterprises.16887.100.107
enterprises.16887.100.110
enterprises.16887.100.115
enterprises.16887.100.121
enterprises.16887.100.50
Example:
Meaning
Sent when policy status change is detected
Policy type
Policy name
Alarm timestamp
Module name
Database name
Action name
Host name or IP address of the machine from which the FortiDB MA user made the change
FortiDB MA user name
Alert email message
100
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Appendix B: Using SNMP with FortiDB MA Disabling Oracle's Audit Setting
Here is an example of the trap resulting from adding a UBM Object Policy with an Oracle target database.
SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.16887.100.21
SNMPv2-SMI::enterprises.16887.100.103 = STRING: "Object Policies"
SNMPv2-SMI::enterprises.16887.100.104 = STRING: "SCOTT.DEPT(TABLE_ONLY)"
SNMPv2-SMI::enterprises.16887.100.105 = STRING: "2006-04-28 16:41:53"
SNMPv2-SMI::enterprises.16887.100.106 = STRING: "UBM"
SNMPv2-SMI::enterprises.16887.100.107 = STRING: "ora92"
SNMPv2-SMI::enterprises.16887.100.110 = STRING: "add"
SNMPv2-SMI::enterprises.16887.100.115 = STRING: "qapc8.FortiDB.com"
SNMPv2-SMI::enterprises.16887.100.121 = STRING: "testuser1"
SNMPv2-SMI::enterprises.16887.100.50 = STRING: "User: testuser1 added Object Policies guarded item:
SCOTT.DEPT(TABLE_ONLY) of database ora92 from qapc8.FortiDB.com"
Disabling Oracle's Audit Setting
Traps are sent when the Audit setting is disabled manually on Oracle target databases.
OID
enterprises.16887.100.22
enterprises.16887.100.103
enterprises.16887.100.104
enterprises.16887.100.105
enterprises.16887.100.106
enterprises.16887.100.107
enterprises.16887.100.50
Meaning
Sent when Oracle Audit Setting change is detected
Policy type
Policy name
Alarm timestamp
FortiDB MA module name
Database name
Alert email message
Example:
Here is an example of the trap disabling, from outside FortiDB MA, an audit setting created with an Object Policy.
SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.16887.100.22
SNMPv2-SMI::enterprises.16887.100.103 = STRING: "Object Policies"
SNMPv2-SMI::enterprises.16887.100.104 = STRING: "SCOTT.EMP(TABLE_ONLY)"
SNMPv2-SMI::enterprises.16887.100.105 = STRING: "2006-05-02 15:29:59"
SNMPv2-SMI::enterprises.16887.100.106 = STRING: "UBM"
SNMPv2-SMI::enterprises.16887.100.107 = STRING: "ora92"
SNMPv2-SMI::enterprises.16887.100.50 = STRING: "The audit option of Guarded Item 100 -
SCOTT.EMP(TABLE_ONLY) has been turned off outside of the FortiDB MA software. FortiDB MA will not be able to report violations for this guarded item."
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
101
Disabling Oracle's Audit Setting Appendix B: Using SNMP with FortiDB MA
Fixed Format
FortiDB MA offers both fixed and “conventional” trap-format options. The “fixed” option is only available for traps relating to UBM. When violations occur in UBM, traps are sent using the “fixed” format of SNMP. Examples of both format types are shown below.
OID
enterprises.16887.100.5 (UBM) enterprises.16887.100.101
enterprises.16887.100.102
enterprises.16887.100.103
enterprises.16887.100.104
enterprises.16887.100.105
enterprises.16887.100.106
enterprises.16887.100.107
enterprises.16887.100.108
enterprises.16887.100.109
enterprises.16887.100.110
enterprises.16887.100.111
enterprises.16887.100.112
enterprises.16887.100.113
enterprises.16887.100.114
enterprises.16887.100.115
enterprises.16887.100.116
enterprises.16887.100.117
enterprises.16887.100.118
Meaning
Sent when policy violations are detected
Policy type (policies.policyname)
Policy name
Alarm timestamp
FortiDB MA Module name
Database name
Action name
FortiDB MA user name
Additional information
Event timestamp
Action
DB user name
OS user name
Login user name (MSSQL or Sybase)
Object name
Host name or IP address of the machine from which the FortiDB
MA user made the change
Client application name
Alarm detail
Client ID (Oracle)
Example of Fixed Format
Here is an example of the trap resulting from a violation associate with a UBM
User Policy with a Sybase target database. Even though the values are null, notice that OIDs 112, 113 and 116 are present.
102
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Appendix B: Using SNMP with FortiDB MA Disabling Oracle's Audit Setting
SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.16887.100.5
SNMPv2-SMI::enterprises.16887.100.101 = INTEGER: 144
SNMPv2-SMI::enterprises.16887.100.102 = STRING: "cautionary"
SNMPv2-SMI::enterprises.16887.100.103 = STRING: "User Policies"
SNMPv2-SMI::enterprises.16887.100.104 = STRING: "user1"
SNMPv2-SMI::enterprises.16887.100.105 = STRING: "2006-05-02 19:14:54"
SNMPv2-SMI::enterprises.16887.100.106 = STRING: "[email protected]:80"
SNMPv2-SMI::enterprises.16887.100.107 = STRING: "syb12"
SNMPv2-SMI::enterprises.16887.100.108 = STRING: "Suspicious DB Object"
SNMPv2-SMI::enterprises.16887.100.109 = STRING: "200652 19:11"
SNMPv2-SMI::enterprises.16887.100.110 = STRING: "select"
SNMPv2-SMI::enterprises.16887.100.111 = STRING: "user1"
SNMPv2-SMI::enterprises.16887.100.112 = ""
SNMPv2-SMI::enterprises.16887.100.113 = ""
SNMPv2-SMI::enterprises.16887.100.114 = STRING: "testdb1.dbo.testtbl1"
SNMPv2-SMI::enterprises.16887.100.115 = STRING: "QAPC1"
SNMPv2-SMI::enterprises.16887.100.116 = ""
SNMPv2-SMI::enterprises.16887.100.117 = STRING: "Violated Rule: Suspicious DB Object
Timestamp: 2006-05-02 19:11:50.646666
Audit Action: select
Login Name: user1
Database Object: testdb1.dbo.testtbl1
Location: QAPC1"
SNMPv2-SMI::enterprises.16887.100.118 = ""
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
103
Disabling Oracle's Audit Setting Appendix B: Using SNMP with FortiDB MA
Trap with Conventional Option
OID
enterprises.16887.100.101
enterprises.16887.100.102
enterprises.16887.100.103
enterprises.16887.100.104
enterprises.16887.100.105
enterprises.16887.100.106
enterprises.16887.100.107
enterprises.16887.100.108
enterprises.16887.100.109
enterprises.16887.100.110
enterprises.16887.100.111
enterprises.16887.100.112
enterprises.16887.100.113
enterprises.16887.100.114
enterprises.16887.100.115
enterprises.16887.100.116
enterprises.16887.100.117
enterprises.16887.100.118
Example of Conventional Format:
Meaning
alarmID alarmSeverity violatedPolicy guardedItem alarmTimeStamp applicationName dbName violatedRule eventTime actionName dbuserName osuserName loginName objectName clientLocation clientApplicationName singleTrapMsg alarmID
Here is an example of the trap resulting from a violation against UBM User Policy with a Sybase target database. In this case, the OIDs 112, 113 and 116 are not present.
SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.16887.100.5
SNMPv2-SMI::enterprises.16887.100.101 = INTEGER: 126
SNMPv2-SMI::enterprises.16887.100.102 = STRING: "cautionary"
SNMPv2-SMI::enterprises.16887.100.103 = STRING: "User Policies"
SNMPv2-SMI::enterprises.16887.100.104 = STRING: "user1"
SNMPv2-SMI::enterprises.16887.100.105 = STRING: "2006-05-02 18:41:08"
SNMPv2-SMI::enterprises.16887.100.106 = STRING: "[email protected]:80"
SNMPv2-SMI::enterprises.16887.100.107 = STRING: "syb12"
SNMPv2-SMI::enterprises.16887.100.108 = STRING: "Suspicious DB Object"
SNMPv2-SMI::enterprises.16887.100.109 = STRING: "200652 18:38"
SNMPv2-SMI::enterprises.16887.100.110 = STRING: "select"
SNMPv2-SMI::enterprises.16887.100.111 = STRING: "user1"
SNMPv2-SMI::enterprises.16887.100.114 = STRING: "testdb1.dbo.testtbl1"
SNMPv2-SMI::enterprises.16887.100.115 = STRING: "QAPC1"
SNMPv2-SMI::enterprises.16887.100.117 = STRING: "Violated Rule: Suspicious DB Object
Timestamp: 2006-05-02 18:38:02.06
Audit Action: select
Login Name: user1
Database Object: testdb1.dbo.testtbl1
Location: QAPC1"
104
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Appendix B: Using SNMP with FortiDB MA Multiple Receivers
Multiple Receivers
FortiDB MA allows you to specify multiple trap receivers.
Configurable Community Name
FortiDB MA users can set their own community name other than the default value
“public”.
Fine-grained SNMP Trap for Admin Alerts
User Actions That Should Generate Traps
SNMP traps are sent for:
• Lost connection to target databases
• Tomcat starting up and shutting down
• Internal database starting up and shutting down
Trap Format for Loss of Connection to Target Databases
OID
enterprises.16887.100.1
enterprises.16887.100.105
enterprises.16887.100.107
enterprises.16887.100.50
Example
Meaning
Sent when connection to target database is lost
Alarm timestamp
Database name
The same message as alert email
Here is an example of the trap resulting from losing a connection to a Microsoft
SQL Server target database.
SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.16887.100.1
SNMPv2-SMI::enterprises.16887.100.105 = STRING: "2006-05-02 19:28:39"
SNMPv2-SMI::enterprises.16887.100.107 = STRING: "s2k"
SNMPv2-SMI::enterprises.16887.100.50 = STRING: "Lost connection to database! DB URL: jdbc:jtds:sqlserver:/92.168.1.230:1433/qadb8, DB Name:s2k, DB ID:108 ."
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
105
SNMP Messaging and Alerts Appendix B: Using SNMP with FortiDB MA
Trap Format for Tomcat Up and Down
OID
enterprises.16887.100.11
enterprises.16887.100.105
enterprises.16887.100.122
enterprises.16887.100.50
Example
Meaning
Sent when Tomcat is shutdown or is started
Alarm timestamp
Status (UP, DOWN)
The same message as alert mail
Here is an example of the trap resulting from shutting down Tomcat.
2006-05-19 03:46:31 192.168.3.95 [UDP: [192.168.3.95]:32793]:
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (23) 0:00:00.23
SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.16887.100.11
SNMPv2-SMI::enterprises.16887.100.105 = STRING: "2006-05-18 11:57:01"
SNMPv2-SMI::enterprises.16887.100.122 = STRING: "DOWN"
SNMPv2-SMI::enterprises.16887.100.50 = STRING: "Warning: Tomcat on localhost.localdomain is DOWN
May 18, 2006 11:57 AM."
Trap Format for Internal Database Up and Down
OID
enterprises.16887.100.12
enterprises.16887.100.105
enterprises.16887.100.122
enterprises.16887.100.50
Meaning
Sent when local database server is shutdown or is started
Alarm timestamp
Database name
The same message as alert mail
Example
Here is an example of the trap resulting from shutting down PostgreSQL.
2006-05-19 03:46:36 192.168.3.95 [UDP: [192.168.3.95]:32793]:
DISMAN-EVENT-MIB::sysUpTimeInstance = Timeticks: (23) 0:00:00.23
SNMPv2-MIB::snmpTrapOID.0 = OID: SNMPv2-SMI::enterprises.16887.100.12
SNMPv2-SMI::enterprises.16887.100.105 = STRING: "2006-05-18 11:57:06"
SNMPv2-SMI::enterprises.16887.100.122 = STRING: "DOWN"
SNMPv2-SMI::enterprises.16887.100.50 = STRING: "Warning: PostgreSQL on localhost.localdomain is DOWN
May 18, 2006 11:57 AM."
106
SNMP Messaging and Alerts
1
2
The following steps are needed for setting up SNMP. The SNMP service used for sending alerts, and while not critical to the function of FortiDB MA, should be enabled to allow near real time notification of problems and events.
Login as the FortiDB user.
Change the appropriate SNMP properties in
dssConfig.properties
:
Appendix A: FortiDB MA Properties Setting
.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Appendix B: Using SNMP with FortiDB MA FortiDB MA Object Identifiers (OIDs) and Descriptions
3
Restart Tomcat. For details about how to restart Tomcat, see the CLI Reference
Guide.
To configure a SNMP trap receiver, you may use the same system or create another one.
To create a background process that will receive all SNMP traps and store them in the file
snmplog
, issue the command:
/usr/sbin/snmptrapd -P > snmplog 2>&1 &
Limiting the Number of Traps
If you experience a large number of violations, you may want to limit the number of traps that are sent as a result. You can achieve this in the User Behavior
Monitor (UBM) module by using the dss.ubm.maxaccessviolations property in the dssConfig.properties file. For example, this setting: dss.ubm.maxaccessviolations=10 limits the number of traps to 10, regardless of the number of violations.
FortiDB MA Object Identifiers (OIDs) and Descriptions
OID
1.3.6.1.4.1.16887
1.3.6.1.4.1.16887.1
The following table presents the FortiDB MA-specific Object Identifiers and their descriptions.
Status Description
This file defines the private FortiDB MA
SNMP MIB extensions.
1.3.6.1.4.1.16887.1.1
The release version of DSAS
1.3.6.1.4.1.16887.1.2
Current status of RM module
Node
iso.org.dod.inter
net.mgmt.private
.enterprises.Forti
DB MAMIB
SysObjects sysVersion rmStatus current current
Other Details
FortiDBMIB MODULE-IDENTITY
LAST-UPDATED "200305080000Z"
ORGANIZATION "FortiDB Inc."
CONTACT-INFO
::= { enterprises
16887 }
-- FortiDB core mib table entries:
- SysObjects includes all system (Admin & RM) information
- SysTraps includes all traps generated by DSC
-
SysObjects OBJECT IDENTIFIER
::= { FortiDBMIB 1 } sysVersion OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysObjects 1 } rmStatus OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysObjects 2 }
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
107
FortiDB MA Object Identifiers (OIDs) and Descriptions Appendix B: Using SNMP with FortiDB MA
1.3.6.1.4.1.16887.2
CMObjects
1.3.6.1.4.1.16887.2.1
Current status of CM module. List all opened databases and their corresponding status
(stopped/running)
1.3.6.1.4.1.16887.3
cmStatus
MMObjects current
1.3.6.1.4.1.16887.3.1
Current status of MM module. List all opened databases and their corresponding status
(stopped/running)
1.3.6.1.4.1.16887.4
mmStatus
PMObjects
1.3.6.1.4.1.16887.4.1
Current status of PM module. List all opened databases and their corresponding status
(stopped/running)
1.3.6.1.4.1.16887.5
pmStatus
UBMObjects
1.3.6.1.4.1.16887.5.1
Current status of
UBM module. List all opened databases and their corresponding status
(stopped/running)
1.3.6.1.4.1.16887.100
ubmStatus
SysTraps
1.3.6.1.4.1.16887.100
.1
1.3.6.1.4.1.16887.100
.2
1.3.6.1.4.1.16887.100
.3
1.3.6.1.4.1.16887.100
.4
1.3.6.1.4.1.16887.100
.5
1.3.6.1.4.1.16887.100
.11
This trap is sent whenever connection to target database is lost
This trap is sent whenever an alarm is raised from CM
This trap is sent whenever an alarm is raised from MM
This trap is sent whenever an alarm is raised from PM
This trap is sent whenever an alarm is raised from UBM
This trap is sent whenever Tomcat is shutdown or is started dbConnectionLo ss cmAlert mmAlert pmAlert ubmAlert tcUpDown current current current current current current current current current
CMObjects OBJECT IDENTIFIER
::= { FortiDBMIB 2 } cmStatus OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { CMObjects 1 }
MMObjects OBJECT IDENTIFIER
::= { FortiDBMIB 3 } mmStatus OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { MMObjects 1 }
PMObjects OBJECT IDENTIFIER
::= { FortiDBMIB 4 } pmStatus OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { PMObjects 1 }
UBMObjects OBJECT IDENTIFIER
::= { FortiDBMIB 5 } ubmStatus OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { UBMObjects 1 }
SysTraps OBJECT IDENTIFIER
::= { FortiDBMIB 100 } dbConnectionLoss
NOTIFICATION-TYPE
::= { SysTraps 1 } cmAlert NOTIFICATION-TYPE
::= { SysTraps 2 } mmAlert NOTIFICATION-TYPE
::= { SysTraps 3 } pmAlert NOTIFICATION-TYPE
::= { SysTraps 4 } ubmAlert NOTIFICATION-TYPE
::= { SysTraps 5 } tcUpDown NOTIFICATION-TYPE
::= { SysTraps 11 }
108
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Appendix B: Using SNMP with FortiDB MA FortiDB MA Object Identifiers (OIDs) and Descriptions
1.3.6.1.4.1.16887.100
.12
1.3.6.1.4.1.16887.100
.21
1.3.6.1.4.1.16887.100
.22
1.3.6.1.4.1.16887.100
.50
1.3.6.1.4.1.16887.100
.101
This trap is sent whenever
PostgreSQL Server is shutdown or is started
This trap is sent whenever a policy is added, modified, deleted, enabled or disabled
This trap is sent whenever audit option setting on the target database is turned off from the outside of FortiDB
Detailed trap message about raised alarm pgrsUpDown policySetting auditOptionSetti ng trapMessage
ID of raised alarm alarmID current current current current current
1.3.6.1.4.1.16887.100
.102
1.3.6.1.4.1.16887.100
.103
1.3.6.1.4.1.16887.100
.104
1.3.6.1.4.1.16887.100
.105
1.3.6.1.4.1.16887.100
.106
1.3.6.1.4.1.16887.100
.107
1.3.6.1.4.1.16887.100
.108
Severity string of raised alarm
Policy name violated by raised alarm
Guarded item name of raised alarm
Timestamp of raised alarm
Application name of raised alarm
Database name of raised alarm
UBM rule name violated by raised alarm alarmSeverity violatedPolicy guardedItem alarmTimeStam p applicationName dbName violatedRule current current current current current current current pgrsUpDown NOTIFICATION-TYPE
::= { SysTraps 12 } policySetting NOTIFICATION-
TYPE
::= { SysTraps 21 } auditOptionSetting
NOTIFICATION-TYPE
::= { SysTraps 22 } trapMessage OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 50 } alarmID OBJECT-TYPE
SYNTAX INTEGER
MAX-ACCESS read-only
::= { SysTraps 101 } alarmSeverity OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 102 } violatedPolicy OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 103 } guardedItem OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 104 } alarmTimeStamp OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 105 } applicationName OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 106 } dbName OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 107 } violatedRule OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 108 }
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
109
FortiDB MA Object Identifiers (OIDs) and Descriptions Appendix B: Using SNMP with FortiDB MA
1.3.6.1.4.1.16887.100
.109
1.3.6.1.4.1.16887.100
.110
1.3.6.1.4.1.16887.100
.111
1.3.6.1.4.1.16887.100
.112
1.3.6.1.4.1.16887.100
.113
1.3.6.1.4.1.16887.100
.114
1.3.6.1.4.1.16887.100
.115
1.3.6.1.4.1.16887.100
.116
1.3.6.1.4.1.16887.100
.117
Audit event timestamp of an audit event triggered the raised alarm
Audit action name of an audit event triggered the raised alarm eventTime actionName
Name of the DB user who triggered the raised alarm dbuserName
Name of the client
OS user who triggered the raised alarm
Name of the DB server login who triggered the raised alarm
Name of the DB object that triggered the raised alarm
Name of the client machine/location from where the raised alarm was triggered
Name of the client application from which the raised alarm was triggered osuserName loginName objectName clientLocation clientApplication
Name
Detailed message for single SNMP trap singleTrapMsg current current current current current current current current current
1.3.6.1.4.1.16887.100
.118
1.3.6.1.4.1.16887.100
.121
1.3.6.1.4.1.16887.100
.122
Client ID from which the raised alarm was triggered
Name of FortiDB MA user who changed
FortiDB MA setting
Status code that indicates whether the administrated object is running or not clientId
FortiDB
MAUserName upDownStatus current current current eventTime OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 109 } actionName OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
STATUS current
::= { SysTraps 110 } dbuserName OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 111 } osuserName OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 112 } loginName OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 113 } objectName OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 114 } clientLocation OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 115 } clientApplicationName OBJECT-
TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 116 } singleTrapMsg OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 117 } clientId OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 118 }
FortiDBUserName OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 121 } upDownStatus OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 122 }
110
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Appendix B: Using SNMP with FortiDB MA FortiDB MA Object Identifiers (OIDs) and Descriptions
OID
1.3.6.1.4.1.16887
1.3.6.1.4.1.16887.1
1.3.6.1.4.1.16887.1.1
1.3.6.1.4.1.16887.1.2
1.3.6.1.4.1.16887.2
1.3.6.1.4.1.16887.2.1
1.3.6.1.4.1.16887.3
1.3.6.1.4.1.16887.3.1
1.3.6.1.4.1.16887.4
The following table presents the FortiDB-specific Object Identifiers and their descriptions.
Status Description
This file defines the private
FortiDB MA
SNMP MIB extensions.
Node
iso.org.dod.inter
net.mgmt.privat
e.enterprises.Fo
rtiDBMIB
SysObjects
Other Details
FortiDBMIB MODULE-IDENTITY
LAST-UPDATED
"200605190000Z"
ORGANIZATION "FortiDB Inc."
CONTACT-INFO
::= { enterprises 16887 }
-- FortiDB core MIB table entries:
- SysObjects includes all system (Admin & RM) information
- SysTraps includes all traps generated by DSC
-
The release version of DSAS sysVersion
Current status of
RM module rmStatus current current current
SysObjects OBJECT
IDENTIFIER ::= { FortiDBMIB
1 } sysVersion OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysObjects 1 } rmStatus OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysObjects 2 }
CMObjects OBJECT IDENTIFIER
::= { FortiDBMIB 2 } cmStatus OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { CMObjects 1 }
CMObjects
Current status of
CM module. List all opened databases and their corresponding status
(stopped/runnin g) cmStatus
MMObjects
Current status of
MM module. List all opened databases and their corresponding status
(stopped/runnin g) mmStatus
PMObjects current
MMObjects OBJECT IDENTIFIER
::= { FortiDBMIB 3 } mmStatus OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { MMObjects 1 }
PMObjects OBJECT IDENTIFIER
::= { FortiDBMIB 4 }
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
111
FortiDB MA Object Identifiers (OIDs) and Descriptions Appendix B: Using SNMP with FortiDB MA
112
1.3.6.1.4.1.16887.4.1
Current status of
PM module. List all opened databases and their corresponding status
(stopped/runnin g) pmStatus
UBMObjects current pmStatus OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { PMObjects 1 }
1.3.6.1.4.1.16887.5
1.3.6.1.4.1.16887.5.1
1.3.6.1.4.1.16887.100
1.3.6.1.4.1.16887.100.1
1.3.6.1.4.1.16887.100.2
1.3.6.1.4.1.16887.100.3
1.3.6.1.4.1.16887.100.4
1.3.6.1.4.1.16887.100.5
1.3.6.1.4.1.16887.100.11
1.3.6.1.4.1.16887.100.12
Current status of
UBM module.
List all opened databases and their corresponding status
(stopped/runnin g) ubmStatus
SysTraps current
This trap is sent whenever connection to target database is lost
This trap is sent whenever an alarm is raised from CM
This trap is sent whenever an alarm is raised from MM
This trap is sent whenever an alarm is raised from PM
This trap is sent whenever an alarm is raised from UBM
This trap is sent whenever
Tomcat is shutdown or is started
This trap is sent whenever
PostgreSQL is shutdown or is started dbConnectionLo ss cmAlert mmAlert pmAlert ubmAlert tcUpDown pgrsUpDown current current current current current current current
UBMObjects OBJECT
IDENTIFIER ::= { FortiDBMIB
5 } ubmStatus OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { UBMObjects 1 }
SysTraps OBJECT IDENTIFIER
::= { FortiDBMIB 100 } dbConnectionLoss
NOTIFICATION-TYPE
::= { SysTraps 1 } cmAlert NOTIFICATION-TYPE
::= { SysTraps 2 } mmAlert NOTIFICATION-TYPE
::= { SysTraps 3 } pmAlert NOTIFICATION-TYPE
::= { SysTraps 4 } ubmAlert NOTIFICATION-TYPE
::= { SysTraps 5 } tcUpDown NOTIFICATION-TYPE
::= { SysTraps 11 } pgrsUpDown NOTIFICATION-TYPE
::= { SysTraps 12 }
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Appendix B: Using SNMP with FortiDB MA FortiDB MA Object Identifiers (OIDs) and Descriptions
1.3.6.1.4.1.16887.100.21
1.3.6.1.4.1.16887.100.22
1.3.6.1.4.1.16887.100.50
This trap is sent whenever a policy is added, modified, deleted, enabled or disabled
This trap is sent whenever audit option setting on the target database is turned off from the outside of
FortiDB MA
Detailed trap message about raised alarm policySetting auditOptionSetti ng trapMessage
1.3.6.1.4.1.16887.100.101
ID of raised alarm alarmID current current current current
1.3.6.1.4.1.16887.100.102
Severity string of raised alarm alarmSeverity
1.3.6.1.4.1.16887.100.103
Policy name violated by raised alarm
1.3.6.1.4.1.16887.100.104
Guarded item name of raised alarm
1.3.6.1.4.1.16887.100.105
Timestamp of raised alarm violatedPolicy guardedItem alarmTimeStam p current current current
1.3.6.1.4.1.16887.100.106
Application name of raised alarm applicationNam e
1.3.6.1.4.1.16887.100.107
Database name of raised alarm dbName
1.3.6.1.4.1.16887.100.108
UBM rule name violated by raised alarm violatedRule current current current current policySetting NOTIFICATION-
TYPE
::= { SysTraps 21 } auditOptionSetting
NOTIFICATION-TYPE
::= { SysTraps 22 } trapMessage OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 50 } alarmID OBJECT-TYPE
SYNTAX INTEGER
MAX-ACCESS read-only
::= { SysTraps 101 } alarmSeverity OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 102 } violatedPolicy OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 103 } guardedItem OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 104 } alarmTimeStamp OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 105 } applicationName OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 106 } dbName OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 107 } violatedRule OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 108 }
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
113
FortiDB MA Object Identifiers (OIDs) and Descriptions Appendix B: Using SNMP with FortiDB MA
1.3.6.1.4.1.16887.100.109
Audit event timestamp of an audit event triggered the raised alarm
1.3.6.1.4.1.16887.100.110
Audit action name of an audit event triggered the raised alarm
1.3.6.1.4.1.16887.100.111
Name of the DB user who triggered the raised alarm
1.3.6.1.4.1.16887.100.112
Name of the client OS user who triggered the raised alarm
1.3.6.1.4.1.16887.100.113
Name of the DB server login who triggered the raised alarm
1.3.6.1.4.1.16887.100.114
Name of the DB object that triggered the raised alarm
1.3.6.1.4.1.16887.100.115
Name of the client machine/locatio n from where the raised alarm was triggered
1.3.6.1.4.1.16887.100.116
Name of the client application from which the raised alarm was triggered
1.3.6.1.4.1.16887.100.117
Detailed message for single SNMP trap
1.3.6.1.4.1.16887.100.118
Client ID from which the raised alarm was triggered
1.3.6.1.4.1.16887.100.121
Name of
FortiDB MA user who changed
FortiDB MA setting eventTime actionName dbuserName osuserName loginName objectName clientLocation clientApplication
Name singleTrapMsg clientId
FortiDBUserNa me current current current current current current current current current current current eventTime OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 109 } actionName OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
STATUS current
::= { SysTraps 110 } dbuserName OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 111 } osuserName OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 112 } loginName OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 113 } objectName OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 114 } clientLocation OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 115 } clientApplicationName
OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 116 } singleTrapMsg OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 117 } clientId OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 118 }
FortiDBUserName OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 121 }
114
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Appendix B: Using SNMP with FortiDB MA FortiDB MA Object Identifiers (OIDs) and Descriptions
1.3.6.1.4.1.16887.100.122
Status code that indicates whether the administrated object is running or not upDownStatus current upDownStatus OBJECT-TYPE
SYNTAX OCTET STRING
MAX-ACCESS read-only
::= { SysTraps 122 }
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
115
FortiDB MA Object Identifiers (OIDs) and Descriptions Appendix B: Using SNMP with FortiDB MA
116
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Appendix C: FortiDB MA Glossary
Appendix C: FortiDB MA Glossary
• Alarm: an internal notification of a potential security violation; customers experience alarms indirectly through Alert Messages.
• Alert: an external notification of a potential security violation; alerts contain, and are triggered by, one or more alarms.
• Assess: periodic examination of database-security level.
• Audit: examination, or forensic analysis of, historic security-related data.
• Internal Database (or Repository): The database that stores securityanalysis results data for FortiDB MA.
• Monitor: near real-time examination of database-security level.
• Policy: a Best Business Practice involving security.
• Rule: FortiDB MA or customer implementation of a policy. (Rules also refer to
Access Violation Settings in UBM Object and User Policies and to Policy
Settings within UBM Session Policies.)
• A *Pre-Defined Policy or Rule (PDP or PDR) is FortiDB MA adaptation of a Best Practice policy in database security.
• A *User-Defined Policy (UDP or UDR) is a customer- or third-party- adaptation of an industry- or company-specific security policy. UDRs are constructed with SQL or a procedural version thereof.
• Target Database: A database that you want to assess, monitor, or audit with the FortiDB MA software.
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
117
Appendix C: FortiDB MA Glossary
118
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
Index
Index
A
Account properties
dss.failedloginattempts 9 dss.lockaccountdays 9 dss.minpasswordlength 9 dss.passwordlifetime 9
Administrative user 7 delete 7
Alert Emails
Archiving and Restoring Alerts 73
auditing 25, 35, 42, 48, 49, 52, 57, 90
C
connect 20, 28, 29, 33, 36, 41, 86, 94
Connections
D
DB Agents
DB2 V8 Audit Log Agent
DB2-Audit-Based
dssConfig.properties 27, 28, 29, 31, 41, 42, 43, 54, 55,
59, 61, 62, 63, 65, 80, 83, 100, 107
E
F
Filtering
FortiDB MA properties
I
Incremental Smart Archiving 74
L
M
Monitoring
Target Database Environment Settings 26
monitoring 5, 17, 18, 30, 37, 38, 48, 51, 52, 88, 90, 91,
MS SQL
N
O
Oracle
P
password
policy 5, 30, 32, 37, 44, 45, 46, 51, 54, 59, 66, 85, 86,
87, 95, 96, 100, 102, 109, 113, 117
Privilege
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
119
property 9, 42, 55, 59, 62, 63, 64, 65, 83, 87, 88, 89, 90,
S
serverConfig.properties 97 serverConfigDB28.properties 97
T
Target Databases
U
V
vacuum (for Standalone users only) 81
violation 5, 43, 59, 65, 84, 102, 104, 117
Index
120
FortiDB Version 3.2 Administration Guide
15-32000-81360-20081219
다운로드
공개 링크 업데이트됨
문서 공개 링크
광고