Have you tried switching Oracle's auditing to write to SYSLOG? Those should
be easy to parse.
Stefan
On Thu, Nov 19, 2015 at 3:51 AM, John Jones <john.jones@xxxxxxxx> wrote:
Is there any one out there using Splunk to look at your Oracle Audit logs.
We are trying to set this up and running into problems with the way that
Oracle writes the audit files in different formats. We are mostly looking
at tracking Oracle Logins and notice that the format of the audit record
can change depending on the error encountered.
Any pointers or suggestions are welcome.
John Jones
