Juniper SECURITY THREAT RESPONSE MANAGER 2008.2 - CONFIGURING DSMS REV 1 Manual page 162

156 O DB L
RACLE ISTENER
Step 7
Step 8
oracle_dblistener_fwdr.pl –t "tail –F <install_directory>/product/9.2/network/log/
listener.log" –f user.info –H 192.168.12.44 –h 192.168.1.100 –p 514
<14>Apr 14 13:23:37 192.168.12.44 AgentDevice=OracleDBListener
Command=SERVICE_UPDATE
Table 66-1 Command Parameters (continued)
Parameters Description
-t Specifies the command line used to tail the log file (monitors any new
output from the listener). The log file may be different across versions of
the Oracle database; some examples are provided below:
Oracle 9i:
<install_directory>/product/9.2/network/log
/listener.log
Oracle 10g:
<install_directory>/product/10.2.0/db_1/network/log
/listener.log
Oracle 11g:
<install_directory>/diag/tnslsnr/qaoracle11/listener
/trace/listener.log
-f Specify the syslog facility.priority to be include at the beginning of the
log.
If nothing is specified, user.info is used.
-H Specify the host name or IP address for the syslog header. It is
recommended that this be the IP address of the Oracle server on which
the script is running.
-h Specify the receiving syslog host (the Event Collector host name or IP
address being used to receive the logs).
-p Specify the receiving TCP syslog port.
If a port is not specified, 514 is used.
-r Specify the directory name where you wish to create the .pid file. The
default is /var/run. This parameter is ignored if -D is specified.
-l Specify the directory name where you wish to create the lock file. The
default is /var/lock. This parameter is ignored if -D is specified.
Start the script. For example:
oracle_dblistener_fwdr.pl -h qradar_host -t "pblog -l -t"
Terminate the script:
kill -QUIT `cat /var/run/oracle_dblistener_fwdr.pl.pid`
For example, if you wish to monitor the listener log on an Oracle 9i server and send
the logs to STRM with the IP address of 192.168.1.100, you must enter:
A sample log from this setup would appear as follows:
DeviceTime=18-AUG-2006 16:51:43
Configuring DSMs Guide
Status=0 SID=qora9