IBM Support

QRadar: Automatically starting the perl script to forward events from Oracle DB

Question & Answer


Does the Perl Oracle DB listener forwarding script automatically start when the Oracle server boots?


The script is used with the Oracle DB listener to forward Oracle events from the Oracle Listener log. This script creates a daemon that will continue to run unless manually stopped. It does not have a way to restart automatically if the Oracle server is rebooted.


To start the Perl Oracle DB listener forwarding script automatically add the string with the complete path in /etc/rc.local on the Oracle server. This file is one of the last files to be run when a Linux server is started.
Below is an example /etc/rc.local file with the Oracle DB listener script included.

In this example the has been placed in the Oracle Users home directory and is run from /etc/rc.local to monitor the listener log on an Oracle 9i server with an IP address of and forward events to QRadar with the IP address of, using the following code: -t tail -f <install_directory>/product/9.2/network/log/listener.log -f -H -h -p 514

A sample log from this setup would appear as follows:

<14>Apr 14 13:23:37 AgentDevice=OracleDBListener Command=SERVICE_UPDATE DeviceTime=18-AUG-2006 16:51:43 Status=0 SID=qora9

The kill command can be used to stop the script: kill -QUIT `cat /var/run/`

Note: If you stop by killing the pid that is associated with it, you need to manually restart it. If you make changes to the script configuration, the entry in /etc/rc.local must also be updated.

Please See Collecting Oracle database events by using Perl for further information on configuring the including options .

Where do you find more information?

[{"Product":{"code":"SSBQAC","label":"IBM Security QRadar SIEM"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Component":"Documentation","Platform":[{"code":"PF016","label":"Linux"}],"Version":"7.2","Edition":"","Line of Business":{"code":"LOB24","label":"Security Software"}}]

Document Information

Modified date:
16 June 2018