EM12c, EM13c: Enterprise Manager Cloud Control does not Recognize Files Created by the cp Command for RealTime Compliance Auditing
Last updated on MAY 31, 2017
Applies to:Enterprise Manager Base Platform - Version 220.127.116.11.0 to 18.104.22.168.0 [Release 12.1 to 13.2]
Information in this document applies to any platform.
In Enterprise Manager (EM) Cloud Control, as part of the Compliance feature, we have a RealTime monitoring feature, that can be used to monitor targets in RealTime, check for configuration changes and report them as violations. This leverages kernel module, to audit file changes and report them as violations.
When files are created using vi or commands, the Linux kernel module recognized these fine grained changes and EM had in turn had flagged them as violations.
The RealTime file monitoring feature is part of Enterprise Manager (EM) 12c and 13c Cloud Control compliance monitoring.
RealTime file monitoring is useful to catch immediate undesirable changes in targets by auditing configuration changes and other file changes in order to report them as violations.
When files are created using vi or mv commands, EM recognizes these changes and flags them as violations.
Files created through the copy (cp) command are not recognized by the kernel module in the same way, so auditing is not effective.
Sign In with your My Oracle Support account
Don't have a My Oracle Support account? Click to get started
My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms