Hi Guys,
I have integrated Oracle 11.2.0.4 using Database Auditing but not receiving logs from oracle.
DSN is able to connect to data source but not able publish new events. Also last tracking ID is same and old for all the connections.
Can anyone tell me why last tracking id is old and same for all the connections?
Hello
If you go to the log collector and find out the ODBC file that is responsible for the connection.
Normally this will be saved in the directory:
/etc/netwitness/ng/logcollection/content/collection/odbc/
For each type of datasource you should see an xml file.
Within this xml file is the tracking query that is responsible for generating the tracking ID.
Looking in the Oracle 11g XML file then the Tracking Query is:
SELECT TO_CHAR(MAX(cast((from_tz("SYS"."AUD$"."NTIMESTAMP#" ,'00:00') at local) as d
ate)),'yyyy-mm-dd hh24:mi:ss') FROM "SYS"."AUD$"
If you manually run this query against the oracle database do you get a different value to the one that is being presented?