I just found a free Log analysis tool written in Perl and distributed under a BSD style license. The tool is called LMon and is at version 1.0 and written by Anders Nordby and LMon V1.0 is available from BSD Consulting
. This tool allows near real time monitoring of logs and alerts can be sent by email when rules are matched or unknown data is encountered. Multiple rule hits can be buffered over a given time interval. The tool can also notice
log rotates. The scripts structure is simple and is run from the command line controlled by a configuration file. Multiple instances can be run against different log files.
This looks like a very useful tool that can be used to monitor Oracle log files, such as the alert log, listener.log and many more. Trace files could also be monitored, database as well as Oracle Networking logs. Even packet capture logs could be monitored. The key in the Oracle arena is setting up the correct rules to look for the security events that are important.
The configuration task could be big but the tool looks like a very useful one for Oracle security practitioners. I have updated my Oracle security tools
page to include this free tool.