Accenture MDR Quick Start Guide for Oracle Adaptive Access Manager Event Collector

1 Supported Versions
2 Port Requirements
3 Configuration for Oracle Adaptive Access Manager
4 LCP Configuration Parameters

This quick start guide will help Accenture MDR customers configure Oracle Adaptive Access Manager Event Collector to send logs to the Log collection Platform (LCP).

This document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found at Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source	Destination	Port	Description
LCP	Oracle Adaptive Access Manager	10013 (TCP)	Default port

Configuration for Oracle Adaptive Access Manager

To read log from the Database we are using two Step Configuration

Running a Procedure on the DB

1. Log into the Oracle AAM DB with user who has Admin Access.

Run the Attached Procedure on the DB.

This Procedure will read the DB and Create a file onto the DB Server. This File should be roll over at the customer’s end. In our case Customer is using CFEngine to delete the older files.

Read logs from File via NXLog:

Log Configuration via NxLog Agent

You can select any one of the below options to send logs to the LCP.

To configure the NxLog Agent for Non-TLS TCP Log flow on Linux using port 10013
To configure the NxLog Agent for TLS TCP Log flow on Linux using port 10014

Steps to configure the sever via NxLog Agent for Non-TLS TCP Log flow on Linux (Linux RHEL 7 and CentOS 7) using port - 10013

Download and Install NxLog agent from location https://nxlog.co/products/nxlog-community-edition/download . There are few dependencies that you need to install and then you can install nxlog on machine. Refer https://nxlog.co/documentation/nxlog-user-guide#deploy_rhel )
For Linux Agent, after installation go to installed location “/etc/nxlog.conf”. Rename attached NXLog_OAAM(Linux).conf to nxlog.conf and copy into this folder.
Replace LCP_IP_Address with actual LCP IP address in nxlog.conf.
OAAM LOG location (<Log File Directory>\oaam_hsoc_*.log) needs to be mentioned on line 24 against File. Please see the below screenshot for reference.

Now start the nxlog service using below command.
systemctl start nxlog
NxLog agent logs will be available at location /var/log/nxlog.log

Steps to configure the sever via NxLog Agent for TLS TCP Log flow on Linux (Linux RHEL 7 and CentOS 7) using port - 10014

Stop the nxlog service using below command.

systemctl stop nxlog

For Linux Agent, after installation go to installed location /etc/nxlog.conf. Rename attached NXLog.conf(Linux with TLS) to nxlog.conf and copy into this folder.

Please contact the Accenture MDR onboarding team to obtain the certificate.

Copy the certificate on Linux machine where nxlog agent is installed and mentioned this cert path in nxlog.conf against CAFile.

Please specify the complete path with the file name. Example: /etc/cert.pem

Replace “LCP_IP_Address” with actual LCP IP address in nxlog.conf.
OAAM LOG location (<Log File Directory>\oaam_hsoc_*.log) needs to be mentioned on line 24 against "File". Please see the below screenshot for reference.

Now start the nxlog service using below command.
systemctl start nxlog
NxLog agent logs will be available at location /var/log/nxlog.log

LCP Configuration Parameters

Table 1-2: Oracle Adaptive Access Manager Event Collector (Syslog - 4036) collector properties to be configured by MDR are shown in table.

Property	Default Value	Description

Property	Default Value	Description
port	10014	Default protocol for TCP.
Host Names / IP Addresses	*	Specify the IP addresses or names of -------- IP. Possible values: IP, hostname, comma separated list of hostnames, or 'ANY', 'any', or '*'.
DataEncoding	UTF-8	Data encoding used by client
TLS	False	For Secure TCP Connection
Time Offset	+00:00	Specify a time offset to convert timestamps of all logged events to the time zone of the collector computer