EM12c, EM13c: Enterprise Manager Cloud Control does not Recognize Files Created by the cp Command for RealTime Compliance Auditing (Doc ID 2269632.1)

Last updated on MAY 31, 2017

Applies to:

Enterprise Manager Base Platform - Version 12.1.0.4.0 to 13.2.0.0.0 [Release 12.1 to 13.2]
Information in this document applies to any platform.

Symptoms

In Enterprise Manager (EM) Cloud Control, as part of the Compliance feature, we have a RealTime monitoring feature, that can be used to monitor targets in RealTime, check for configuration changes and report them as violations. This leverages kernel module, to audit file changes and report them as violations.
When files are created using vi or commands, the Linux kernel module recognized these fine grained changes and EM had in turn had flagged them as violations.

The RealTime file monitoring feature is part of Enterprise Manager (EM) 12c and 13c Cloud Control compliance monitoring.
RealTime file monitoring is useful to catch immediate undesirable changes in targets by auditing configuration changes and other file changes in order to report them as violations.

When files are created using vi or mv commands, EM recognizes these changes and flags them as violations.

Files created through the copy (cp) command are not recognized by the kernel module in the same way, so auditing is not effective.

 

Cause

Sign In with your My Oracle Support account

Don't have a My Oracle Support account? Click to get started

My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms