eG Monitoring
 

Measures reported by OraRacUseAudTest

Often, administrators may want to periodically audit user logins to the Oracle cluster server to capture login failures and troubleshoot them. To enable such audits, eG Enterprise offers the OraRacUseAudTest!

This test periodically reports the count of logged in, logged out and failed user sessions on each node of the target cluster.

Pre-Requisites for the test to report metrics

For the eG Enterprise to report metrics for this test, administrators should follow the below-mentioned steps:

  • Execute the following commands from the SQL prompt of the target Oracle cluster server:

    audit create session whenever not successful;

    audit create session whenever successful;

  • Ensure that DB is set as the value against the Audit_trail parameter. This ensures that the data captured is logged into the DBA_AUDIT_SESSION or DBA_AUDIT_TRAIL tables of the target Oracle cluster server. The eG agent retrieves the data from these tables and reports the metrics for this test.

Outputs of the test : One set of results for each node in the target Oracle cluster being monitored.

The measures made by this test are as follows:

Measurement Description Measurement Unit Interpretation
Login_sessions Indicates the number of logged in user sessions on this node during the last measurement period. Number This measure is a good indicator of load on the target node.
LockedUsers Indicates the number of user accounts that were locked due to entering incorrect password or username on this node during the last measurement period. Number If a user unsuccessfully attempts to log into the target database cluster more than the configured number of retry attempts, they are locked out of further access.

If a user lockout security event occurs on one node of a cluster, the other nodes in the cluster are notified of the event and the user account is locked on all nodes in the cluster. This feature prevents a hacker from systematically breaking into all the nodes in a cluster.
Logoff_sessions Indicates the number of user sessions that were logged out from this node during the last measurement period. Number A high value for this measure is a cause of concern.
Login_failed_sessions Indicates the number of user sessions that failed to login to this node during the last measurement period. Number A sudden/gradual increase in the value of this measure is a cause of concern. Administrators should investigate the login failures before end users start complaining about the failures too frequently.