# Audit log - Oracle DB setup

How to create the Oracle DB audit log user, including TLS connections.

This page shows how to prepare an Oracle DB server for the [audit log](https://zato.io/docs/admin/audit-log/index.html). Oracle DB 19c and later is supported.

## Creating the user {#creating-the-user}

In Oracle DB, a schema belongs to a user, so creating the user is all that is needed. As an administrative user, create a user named `zato_audit_log` with an unlimited quota on its default tablespace. The audit log creates its table and indexes the first time a server connects.

Now, point the servers at the database - `Zato_Audit_Log_DB_Name` is the service name of the database:

```bash
export Zato_Audit_Log_DB_Type=oracle
export Zato_Audit_Log_DB_Host=db.example.com
export Zato_Audit_Log_DB_Port=1521
export Zato_Audit_Log_DB_Username=zato_audit_log
export Zato_Audit_Log_DB_Password=my.secret.password
export Zato_Audit_Log_DB_Name=ORCLPDB1
```

## Enabling SSL/TLS on the server {#enabling-ssltls-on-the-server}

Oracle DB encrypts connections through the TCPS protocol. Create a wallet holding the server certificate:

```bash
orapki wallet create -wallet /opt/oracle/wallet -auto_login -pwd "wallet.password"
orapki wallet add -wallet /opt/oracle/wallet -trusted_cert -cert /path/to/ca.crt -pwd "wallet.password"
orapki wallet add -wallet /opt/oracle/wallet -user_cert -cert /path/to/server.crt -pwd "wallet.password"
```

Add a TCPS endpoint to `listener.ora`:

```text
LISTENER =
  (DESCRIPTION_LIST =
    (DESCRIPTION =
      (ADDRESS = (PROTOCOL = TCP)(HOST = 0.0.0.0)(PORT = 1521))
      (ADDRESS = (PROTOCOL = TCPS)(HOST = 0.0.0.0)(PORT = 2484))
    )
  )

WALLET_LOCATION =
  (SOURCE = (METHOD = FILE)(METHOD_DATA = (DIRECTORY = /opt/oracle/wallet)))
```

And restart the listener:

```bash
lsnrctl stop && lsnrctl start
```

With the server prepared, enable TLS on the client side, pointing the port at the TCPS endpoint:

```bash
export Zato_Audit_Log_DB_Port=2484

export Zato_Audit_Log_DB_SSL=on
export Zato_Audit_Log_DB_SSL_CA_File=/path/to/ca.crt
```

All the client-side variables are described in the [audit log documentation](https://zato.io/docs/admin/audit-log/index.html).

## Learn more {#learn-more}

- [Production checklist](https://zato.io/docs/admin/production-checklist.html) - What to confirm before an environment takes real traffic
- [Audit log](https://zato.io/docs/admin/audit-log/) - Every request, response and error, and what you can do with them afterwards
- [Health checks](https://zato.io/docs/admin/health-checks.html) - Have Zato ping your outgoing connections instead of waiting for traffic to fail
- [Logging](https://zato.io/docs/admin/logging.html) - What is written where, and how to ship it to Splunk, Loki, Elastic or Datadog
- [GitOps with enmasse](https://zato.io/docs/admin/enmasse.html) - Keep the whole environment in git as YAML and import it anywhere