# Collecting Oracle Audit Log

**URL:** <https://community.graylog.org/t/collecting-oracle-audit-log/1499>\
**Category:** Graylog Central (peer support)\
**Created:** [June 19, 2017, 3:17pm UTC](https://community.graylog.org/t/collecting-oracle-audit-log/1499 "2017-06-19T15:17:41Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![GambitK](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/gambitk/32/1097_2.png) [@GambitK](https://community.graylog.org/u/GambitK)\
**Post date:** [June 19, 2017, 3:17pm UTC](https://community.graylog.org/t/collecting-oracle-audit-log/1499/1 "2017-06-19T15:17:41Z")

</div>

Hello, I want to try and get the Oracle Audit Log into Graylog, either from the audit\_trail table or the XML log files.  
Has anyone had any experience getting the audit from Oracle into graylog?

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [June 20, 2017, 6:25am UTC](https://community.graylog.org/t/collecting-oracle-audit-log/1499/2 "2017-06-20T06:25:54Z")

</div>

You could query the audit log table using the [Logstash JDBC input plugin](https://www.elastic.co/guide/en/logstash/current/plugins-inputs-jdbc.html) and push the results to Graylog (e. g. using the Logstash GELF output).

See [https://www.elastic.co/blog/visualising-oracle-performance-data-with-the-elastic-stack](https://www.elastic.co/blog/visualising-oracle-performance-data-with-the-elastic-stack) for some remotely similar ideas.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [July 4, 2017, 6:26am UTC](https://community.graylog.org/t/collecting-oracle-audit-log/1499/3 "2017-07-04T06:26:03Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.
