For Enterprise Manager, BASIC auditing is enabled by default, thus creating an audit trail of credentials being created, edited, accessed, associated and deleted. Named credentials are first-class security objects on which privileges can be granted or revoked. This means that multiple Enterprise Manager administrators will be able to use and modify the credential objects. Because credentials are sensitive data that can be used to perform various operations on the systems, there is a need to audit the operations on credentials.

Enterprise Manger supports auditing all credential operation, but first needs to be enabled. The auditing information includes, but is not limited to, the current username, credential name, operation performed, operation status success or failure. The audit logs contain information about the credential owner, action initiator, credential name, user name, and target name, job names along with the date time of the operation. Credential fields like password, private keys are never logged.

The following operations are audited:

• Creating a Named Credential: Creating new Enterprise Manager credentials will be audited.

• Editing a Named Credential: Editing a credential may consist of changing the username and/or the sensitive credential attributes. Credential edits may also include changing the authentication scheme for the credential.

• Delete a Named Credential: Deleting a credential from Enterprise Manager will be audited.

• Associating a Named Credential: A named credential can be set as a preferred credential for a credential set at the target level or at target type level. The named credential can also be reference directly from a job. All operations involving the setting of the named credentials as preferred credentials and using it in a job or deployment procedure will be audited.

• Accessing a Named Credential: Enterprise Manager subsystems request credentials from the credential store to perform various system management tasks

By default, whenever a user logs in or out of Enterprise Manager, the action is audited. The following list shows the Enterprise Manager infrastructure operations that are also audited by default.

• Apply Update

• Change MGMT_VIEW User Password

• Change Repository Password

• Configure Authentication

• Copy EM Key to Repository

• Remove EM Key from Repository

• Create Custom CA

• Remove Update

• Secure Console

• Secure Lock

• Secure OMS

You can configure the Enterprise Manager Audit System by using the following EM CLI commands:

• enable_audit: Enables auditing for all user operations.

• disable_audit: Disables auditing for all user operations.

• show_operations_list: Shows a list of the user operations being audited.

• show_audit_settings: Shows the audit status, operation list, externalization service details, and purge period details.

• update_audit_settings: Updates the current audit settings in the repository.

Audit data needs to be protected and maintained for several years. The volume of audit data may become very large and impact the performance of the system. To limit the amount of data stored in the repository, the audit data must be externalized or archived at regular intervals. The archived audit data is stored in an XML file complying with the ODL format. To externalize the audit data, the EM_AUDIT_EXTERNALIZATION API is used. Records of the format <file-prefix>.NNNNN.xml, where NNNN is a number, are generated. The numbers start with 00001 and continue to 99999.

You can set up the audit externalization service for exporting audit data into the file system by using the update_audit_setting -externalization_switch command.

The externalization of audit system data is performed by the EM Audit Externalization Service job. By default, this job is scheduled to run once daily. You can view current status of this job from the Repository Scheduler Jobs Status area in the Enterprise Manager console, as shown in the following graphic.

To access this page, from the Setup menu, select Manage, and then Repository.

The update_audit_settings command updates the current audit settings in the repository and restarts the Management Service.

• -audit_switch: Enables auditing across Enterprise Manager. The possible values are ENABLE/DISABLE. Default value is DISABLE.

• -operations_to_enable: Enables auditing for specified operations. Enter All to enable all operations.

• -operations_to_disable: Disables auditing for specified operations. Enter All to disable all operations.

• -externalization_switch: Enables the audit data export service. The possible values are ENABLE/DISABLE. Default value is DISABLE.

• -directory: The database directory that is mapped to the OS directory where the export service archives the audit data files.

• -file_prefix: The file prefix to be used by the export service to create the file in which audit data is to be stored.

• -file_size: The size of the file on which the audit data is to be stored. The default value is 5000000 bytes.

• data_retention_period: The period for which the audit data is to be retained inside the repository. The default value is 365 days.

emcli update_audit_settings
      -audit_switch="ENABLE/DISABLE"
      -operations_to_enable="name of the operations to enable, for all oprtations
       use ALL"
      -operations_to_disable="name of the operations to disable, for all
       oprtations use ALL"
      -externalization_switch="ENABLE/DISABLE"
      -directory="directory_name (DB Directory)"
      -file_prefix="file_prefix"
      -file_size="file_size (Bytes)"
      -data_retention_period="data_retention_period (Days)"

Basic and Infrastructure auditing is enabled by default for Enterprise Manager. In Enterprise Manager, there are over 150 options for auditing. Audit infrastructure operations are always enabled and cannot be turned off. An enhanced Auditing page makes it easy to quickly view the privilege grants on a regular basis and also keep track of which users exercised what privileges, this improves user accountability. Infrastructure activities are audited out of the box, these include updates, downloads, OMS password changes and emkey copy and removes from the Repository.

Also, the search capability of all Audit actions have been enhanced to improved, via the Enterprise Manager console, you can search for a subset of Audited operations and filter to see operations from specific client hosts and client types(browser or CLI). This provides more efficient ways for audit officers to locate specific operations of interest.

The following table lists all auditable events. Those auditable events shown as enabled are Infrastructure audit events and are turned on out-of-box and cannot be disabled.