Call: +44 (0)1904 557620 Call
Blog

Pete Finnigan's Oracle Security Weblog

This is the weblog for Pete Finnigan. Pete works in the area of Oracle security and he specialises in auditing Oracle databases for security issues. This weblog is aimed squarely at those interested in the security of their Oracle databases.

[Previous entry: "Role based security management in Oracle designer"] [Next entry: "Happy new year for 2005"]

A free Perl based Log Analysis tool



I just found a free Log analysis tool written in Perl and distributed under a BSD style license. The tool is called LMon and is at version 1.0 and written by Anders Nordby and LMon V1.0 is available from BSD Consulting. This tool allows near real time monitoring of logs and alerts can be sent by email when rules are matched or unknown data is encountered. Multiple rule hits can be buffered over a given time interval. The tool can also notice log rotates. The scripts structure is simple and is run from the command line controlled by a configuration file. Multiple instances can be run against different log files.

This looks like a very useful tool that can be used to monitor Oracle log files, such as the alert log, listener.log and many more. Trace files could also be monitored, database as well as Oracle Networking logs. Even packet capture logs could be monitored. The key in the Oracle arena is setting up the correct rules to look for the security events that are important.

The configuration task could be big but the tool looks like a very useful one for Oracle security practitioners. I have updated my Oracle security tools page to include this free tool.