Thursday, March 26, 2026

view

 Oracle Apps DBA

Fix Slow View Execution Plan in Oracle EBS 12.2 / 19c DB
— Step-by-Step Guide

Oracle EBS 12.2.xDatabase 19cSQL Tuning & SPMPerformance
DBMS_XPLANDBMS_SPMSQL Plan BaselineDBMS_STATSDBMS_SHARED_POOL
Scenario: The view CHPOZF_IC_UI_SEARCH_V runs in ~4 seconds on P04 and PRD, but hangs on P05. The fix involves identifying the bad execution plan, capturing the good plan from the healthy instance, and pinning it on P05 using SQL Plan Baselines (SPM) — Oracle's preferred plan stabilization mechanism in 19c.
Phase 1

Identify the SQL on P05 (Slow Instance)

Run the following queries on P05 as apps or system.

Step 1.1 — Find SQL_ID of the slow view query
SQL
col sql_id           for a15
col plan_hash_value  for 9999999999
col avg_sec          for 999.99
col last_active      for a20

SELECT sql_id,
       child_number,
       plan_hash_value,
       executions,
       ROUND(elapsed_time/GREATEST(executions,1)/1e6, 2) avg_sec,
       TO_CHAR(last_active_time,'YYYY-MM-DD HH24:MI:SS') last_active
FROM   v$sql
WHERE  UPPER(sql_text) LIKE '%CHPOZF_IC_UI_SEARCH_V%'
  AND  sql_text NOT LIKE '%v$sql%'
ORDER  BY last_active_time DESC;
Step 1.2 — Get full execution plan with actuals
SQL
-- Replace &sql_id and &child_number with values from Step 1.1
SELECT * FROM TABLE(
  DBMS_XPLAN.DISPLAY_CURSOR(
    '&sql_id',
    &child_number,
    'ALLSTATS LAST +PEEKED_BINDS +OUTLINE'
  )
);
⚠ Save this output! You need the Outline Data section for the SQL Profile in Phase 5.
Step 1.3 — Note the bad plan_hash_value
SQL
SELECT plan_hash_value FROM v$sql
WHERE  sql_id = '&sql_id' AND child_number = &child_number;

Phase 2

Capture the Good Plan from P04 / PRD

Step 2.1 — Find SQL_ID on P04/PRD
SQL
SELECT sql_id,
       child_number,
       plan_hash_value,
       ROUND(elapsed_time/GREATEST(executions,1)/1e6,2) avg_sec
FROM   v$sql
WHERE  UPPER(sql_text) LIKE '%CHPOZF_IC_UI_SEARCH_V%'
  AND  sql_text NOT LIKE '%v$sql%'
ORDER  BY elapsed_time/GREATEST(executions,1);
Step 2.2 — Capture good plan with OUTLINE
SQL
SELECT * FROM TABLE(
  DBMS_XPLAN.DISPLAY_CURSOR(
    '&good_sql_id',
    &good_child_number,
    'ALLSTATS LAST +PEEKED_BINDS +OUTLINE'
  )
);
Copy the Outline Data hints block from the output — you will use these hints in Phase 5 for SQL Profile creation.

Phase 3

Root Cause Diagnosis on P05

Step 3.1 — Compare optimizer parameters (run on BOTH instances)
SQL
SELECT name, value
FROM   v$parameter
WHERE  name IN (
  'optimizer_mode',
  'optimizer_features_enable',
  'db_file_multiblock_read_count',
  'optimizer_adaptive_plans',
  'optimizer_adaptive_statistics',
  '_optimizer_use_feedback',
  'statistics_level'
)
ORDER BY name;
Step 3.2 — Check stats on base tables of the view
SQL
-- Find base tables first
SELECT referenced_name AS table_name
FROM   dba_dependencies
WHERE  name            = 'CHPOZF_IC_UI_SEARCH_V'
  AND  type            = 'VIEW'
  AND  referenced_type = 'TABLE';

-- Check stats freshness
SELECT table_name,
       num_rows,
       blocks,
       last_analyzed,
       stattype_locked,
       stale_stats
FROM   dba_tab_statistics
WHERE  table_name IN (
  SELECT referenced_name FROM dba_dependencies
  WHERE  name = 'CHPOZF_IC_UI_SEARCH_V'
    AND  type = 'VIEW'
    AND  referenced_type = 'TABLE'
)
ORDER BY last_analyzed NULLS FIRST;
Step 3.3 — Check indexes on P05
SQL
SELECT i.table_name, i.index_name, i.status, i.visibility,
       i.last_analyzed, i.num_rows
FROM   dba_indexes i
WHERE  i.table_name IN (
  SELECT referenced_name FROM dba_dependencies
  WHERE  name = 'CHPOZF_IC_UI_SEARCH_V'
    AND  type = 'VIEW'
    AND  referenced_type = 'TABLE'
)
ORDER BY i.table_name, i.index_name;
Step 3.4 — Check adaptive plan / cardinality feedback (19c specific)
SQL
SELECT sql_id, child_number, is_resolved_adaptive_plan,
       is_reoptimizable, use_feedback_stats
FROM   v$sql_shared_cursor
WHERE  sql_id = '&p05_sql_id';
Root CauseP05 SymptomFix
Stale / missing statsFull table scans, bad cardinality estimatesPhase 4 — Gather stats
Different optimizer_modeDifferent plan shape vs P04Align parameter in P05
Missing index on P05Full scan where P04 uses index range scanRebuild index
Bind variable peeking mismatchDifferent plan_hash_value per executionPhase 5 — Pin via SPM
19c Adaptive Plans interferenceis_reoptimizable = YDisable feedback or pin plan

Phase 4

Fix Option A — Gather Fresh Stats (Try First)

Step 4.1 — Gather stats on base tables
SQL
-- Replace 'APPS' / 'YOUR_BASE_TABLE' with actual schema and table name
BEGIN
  DBMS_STATS.GATHER_TABLE_STATS(
    ownname          => 'APPS',
    tabname          => 'YOUR_BASE_TABLE',
    estimate_percent => DBMS_STATS.AUTO_SAMPLE_SIZE,
    method_opt       => 'FOR ALL COLUMNS SIZE AUTO',
    degree           => 4,
    cascade          => TRUE,
    no_invalidate    => FALSE
  );
END;
/
Step 4.2 — Flush the specific cursor (preferred over full shared pool flush)
SQL
DECLARE
  l_address  RAW(8);
  l_hash_val NUMBER;
BEGIN
  SELECT address, hash_value
  INTO   l_address, l_hash_val
  FROM   v$sqlarea
  WHERE  sql_id = '&p05_sql_id';

  DBMS_SHARED_POOL.PURGE(
    l_address || ',' || l_hash_val, 'C'
  );
END;
/
Re-run the view query and check avg execution time. If still slow — proceed to Phase 5.

Phase 5

Fix Option B — Pin Good Plan via SQL Plan Baseline (SPM)

Step 5A — Load good plan into SPM on P04/PRD
Run as SYS or user with ADMINISTER SQL MANAGEMENT OBJECT privilege.
SQL — On P04/PRD
DECLARE
  l_cnt PLS_INTEGER;
BEGIN
  l_cnt := DBMS_SPM.LOAD_PLANS_FROM_CURSOR_CACHE(
    sql_id          => '&good_sql_id',
    plan_hash_value => &good_plan_hash_value
  );
  DBMS_OUTPUT.PUT_LINE('Plans loaded: ' || l_cnt);
END;
/
Step 5B — Verify baseline created on P04/PRD
SQL — On P04/PRD
col sql_handle  for a30
col plan_name   for a35
col origin      for a20

SELECT sql_handle, plan_name, enabled, accepted, fixed, origin,
       TO_CHAR(created,'YYYY-MM-DD HH24:MI') created
FROM   dba_sql_plan_baselines
WHERE  sql_text LIKE '%CHPOZF_IC_UI_SEARCH_V%';
Step 5C — Create staging table on P04/PRD
SQL — On P04/PRD (as SYS)
BEGIN
  DBMS_SPM.CREATE_STGTAB_BASELINE(
    table_name  => 'SPM_XFER_STAGE',
    table_owner => 'SYSTEM',
    db_version  => '19.1.0.0.0'
  );
END;
/
Step 5D — Pack the baseline into staging table
SQL — On P04/PRD
DECLARE
  l_cnt PLS_INTEGER;
BEGIN
  l_cnt := DBMS_SPM.PACK_STGTAB_BASELINE(
    table_name  => 'SPM_XFER_STAGE',
    table_owner => 'SYSTEM',
    sql_handle  => '&sql_handle_from_5B'
  );
  DBMS_OUTPUT.PUT_LINE('Plans packed: ' || l_cnt);
END;
/
Step 5E — Export staging table via DataPump (OS level on P04/PRD)
Bash — OS
expdp system/password \
  tables=SYSTEM.SPM_XFER_STAGE \
  directory=DATA_PUMP_DIR \
  dumpfile=spm_xfer_p04.dmp \
  logfile=spm_xfer_p04.log
Step 5F — Transfer dump file to P05 server
Bash — OS
scp spm_xfer_p04.dmp oracle@p05_host:/u01/app/oracle/admin/P05/dpdump/
Step 5G — Import on P05
Bash — OS on P05
impdp system/password \
  tables=SYSTEM.SPM_XFER_STAGE \
  directory=DATA_PUMP_DIR \
  dumpfile=spm_xfer_p04.dmp \
  logfile=spm_xfer_p05_import.log \
  remap_schema=SYSTEM:SYSTEM
Step 5H — Unpack baseline into P05 SPM repository
SQL — On P05 (as SYS)
DECLARE
  l_cnt PLS_INTEGER;
BEGIN
  l_cnt := DBMS_SPM.UNPACK_STGTAB_BASELINE(
    table_name  => 'SPM_XFER_STAGE',
    table_owner => 'SYSTEM'
  );
  DBMS_OUTPUT.PUT_LINE('Plans unpacked: ' || l_cnt);
END;
/
Step 5I — Verify and mark baseline as FIXED on P05
SQL — On P05
-- Confirm it's accepted
SELECT sql_handle, plan_name, enabled, accepted, fixed
FROM   dba_sql_plan_baselines
WHERE  sql_text LIKE '%CHPOZF_IC_UI_SEARCH_V%';

-- Mark as FIXED so optimizer always uses this plan
DECLARE
  l_cnt PLS_INTEGER;
BEGIN
  l_cnt := DBMS_SPM.ALTER_SQL_PLAN_BASELINE(
    sql_handle      => '&sql_handle',
    plan_name       => '&plan_name',
    attribute_name  => 'FIXED',
    attribute_value => 'YES'
  );
END;
/

Phase 6

Validate the Fix on P05

SQL — On P05
-- Step 1: Purge old cursor
DECLARE
  l_address  RAW(8);
  l_hash_val NUMBER;
BEGIN
  SELECT address, hash_value
  INTO   l_address, l_hash_val
  FROM   v$sqlarea
  WHERE  sql_id = '&p05_sql_id';
  DBMS_SHARED_POOL.PURGE(l_address||','||l_hash_val,'C');
END;
/

-- Step 2: Re-run view query, then check new plan
SELECT * FROM TABLE(
  DBMS_XPLAN.DISPLAY_CURSOR(
    '&new_sql_id', NULL,
    'ALLSTATS LAST +PEEKED_BINDS'
  )
);

-- SUCCESS: Look for this line in output:
-- "SQL plan baseline SQL_PLAN_xxx used for this statement"
✓ Confirmation: If the plan output contains SQL plan baseline SQL_PLAN_xxx used for this statement — the fix is successful.

Summary

Decision Flow — Which Fix to Apply

P05 view query is slow? │ ├── Stats stale/missing? ──YES──► Gather stats (Phase 4) → retest │ ├── optimizer params differ? ──YES──► Align parameter with P04 │ or set at session level │ ├── Index missing on P05? ──YES──► Rebuild index → gather stats │ └── Plan just wrong? ──────────► SPM Baseline transfer (Phase 5)

spluk

 Oracle EBS 12.2  ·  SIEM Engineering

Complete Guide: Capturing Oracle EBS 12.2 Logs in Splunk

A production-grade reference covering all 8 tiers — from the DB alert log to DMZ extranet servers, WAF, SiteMinder, OAM WebGate, and custom automation feeds. 80+ log sources. No log left behind.

· Oracle Apps DBA Lead· Oracle Solaris 11.4 SPARC· EBS 12.2.x Production· Splunk Universal Forwarder
8+
Log layers
80+
Log sources
5
DMZ hops
24/7
Coverage
Table of Contents
  1. 01. Why Splunk for Oracle EBS?
  2. 02. Application Tier Logs
  3. 03. WebLogic Server (WLS) Logs
  4. 04. Database Tier Logs
  5. 05. OS / Solaris 11.4 Logs
  6. 06. Security & Threat Detection Logs
  7. 07. Monitoring & Automation Feeds
  8. 08. Infrastructure / Storage / Network
  9. 09. Patching / ADOP / Change Logs
  10. 10. DMZ & Extranet EBS — Full Log Strategy
  11. 11. Splunk inputs.conf Reference
  12. 12. SPL Correlation Queries
01

Why Splunk for Oracle EBS?

Oracle E-Business Suite 12.2 generates logs across a sprawling multi-tier stack — OHS, WebLogic, Oracle DB, Solaris OS, OAM, SiteMinder, ADOP, and custom automation scripts. Without centralised log aggregation, an incident that spans even two layers can take hours to diagnose.

Splunk bridges this gap by ingesting all these sources into a single searchable platform, enabling real-time alerting, cross-layer correlation, and forensic investigation.

Post-CL0P Ransomware Context: The CL0P ransomware campaign specifically targeted Oracle EBS environments via unpatched JSP endpoints. Complete Splunk coverage — especially JSP endpoint monitoring on OHS access logs and DB audit trails — is no longer optional.
02

Application Tier Logs

The application tier covers the full request lifecycle — OHS web entry point, OAF/Forms, Concurrent Manager, and ADOP patching artefacts.

LogPathSource TypePriority
Apache/OHS access$INST_TOP/logs/ora/10.1.3/Apache/access_logoracle:ebs:ohs:accessP1
Apache/OHS error$INST_TOP/logs/ora/10.1.3/Apache/error_logoracle:ebs:ohs:errorP1
OA Framework / JSP errors$INST_TOP/logs/ora/10.1.3/j2ee/oracle:ebs:oafP1
OPMN process log$INST_TOP/logs/ora/10.1.3/opmn/oracle:ebs:opmnP2
Forms server$INST_TOP/logs/ora/10.1.3/forms/oracle:ebs:formsP2
Concurrent Manager startup$APPLCSF/$APPLLOG/oracle:ebs:cm:managerP1
Concurrent request logs$APPLCSF/$APPLLOG/*.reqoracle:ebs:cm:request:logP2
Concurrent request output$APPLCSF/$APPLOUT/*.outoracle:ebs:cm:request:outP3
ADOP patch logs$NE_BASE/EBSapps/patch/oracle:ebs:adopP2
AutoConfig logs$INST_TOP/admin/log/oracle:ebs:autoconfigP3
03

WebLogic Server (WLS) Logs

WLS is the critical Java EE container underpinning EBS 12.2. These logs are the first place to look for SSO login failures, 500 errors on the external portal, OAM redirect loops, and JDBC pool exhaustion.

Real-world case: A production CORP EBS SSO login performance issue traced to a CRP Test OAM server being referenced instead of production was first visible in the WLS managed server log — not the OHS access log.
LogPathSource TypePriority
AdminServer log$DOMAIN_HOME/servers/AdminServer/logs/AdminServer.logoracle:wls:adminP1
Managed server log$DOMAIN_HOME/servers/EBS_managed*/logs/*.logoracle:wls:managedP1
WLS access log$DOMAIN_HOME/servers/*/logs/access.logoracle:wls:accessP1
OAM/SSO integration log$DOMAIN_HOME/servers/*/logs/oracle:wls:oamP1
GC / JVM heap log$FMW_HOME/../domain/logs/*.logoracle:wls:jvmP2
WLS Node Manager log$WL_HOME/common/nodemanager/*.logoracle:wls:nodemanagerP2
WLS JDBC datasource log$DOMAIN_HOME/servers/*/logs/oracle:wls:jdbcP2
WLS deployment log$DOMAIN_HOME/servers/*/logs/oracle:wls:deployP3
04

Database Tier Logs

The DB alert log is the single highest-priority log in any EBS environment. It surfaces ORA- errors, startup/shutdown events, redo switches, deadlocks, and block corruption — all in one place.

LogPathSource TypePriority
DB alert log$ORACLE_BASE/diag/rdbms/<db>/<SID>/trace/alert_<SID>.logoracle:db:alertP1
Listener log (XML)$ORACLE_BASE/diag/tnslsnr/<host>/listener/alert/log.xmloracle:db:listenerP1
DB audit trail (AUD$)$ORACLE_BASE/admin/<SID>/adump/*.audoracle:db:auditP1
FGA audit (FGA_LOG$)DB view → flat file extractoracle:db:fgaP1
Trace files$ORACLE_BASE/diag/rdbms/<db>/<SID>/trace/*.trcoracle:db:traceP1
RMAN backup log$ORACLE_BASE/admin/<SID>/log/oracle:db:rmanP2
Data Pump log$DATA_PUMP_DIR/*.logoracle:db:datapumpP3
FND_LOGINS (app audit)DB extract → flat fileoracle:ebs:fnd:loginsP1
FND_UNSUCCESSFUL_LOGINSDB extract → flat fileoracle:ebs:fnd:auth_failP1
AD_PATCH_HISTDB extract → flat fileoracle:ebs:patch:histP2
05

OS / Solaris 11.4 Logs

Oracle Solaris 11.4 SPARC has a distinct log layout from Linux. Syslog lives in /var/adm/messages, auth in /var/log/authlog, and C2/BSM audit in /var/audit/. The SMF service log is Solaris-specific and frequently missed in Splunk deployments.

LogPathSource TypePriority
Syslog / messages/var/adm/messagessolaris:syslogP1
Auth log/var/log/authlogsolaris:authP1
Cron log/var/cron/logsolaris:cronP2
Audit log (BSM/C2)/var/audit/solaris:bsmP2
ZFS / Volume manager/var/adm/messages (zpool events)solaris:zfsP2
NFS / mount events/var/adm/messagessolaris:nfsP1
SMF service log/var/svc/log/*.logsolaris:smfP2
Disk / SCSI errors/var/adm/messagessolaris:diskP1
Core dump events/var/core/solaris:coredumpP2
Network interface errorskstat / snoop logssolaris:networkP2
06

Security & Threat Detection Logs

Security-focused logs deserve their own tier. Several are DB extracts that require a scheduled export script to make them Splunk-consumable as flat files. These feed SOC dashboards, incident response playbooks, and compliance reports.

LogSourceSource TypePriority
OHS access — JSP endpointsaccess_log (filtered)oracle:ebs:ohs:accessP1
EBS FND security eventsFND_EVENTS_Q extractoracle:ebs:fnd:securityP1
SiteMinder / FCC log$OAM_HOME/../logs/oracle:oam:siteminderP1
OAM access server log$OAM_HOME/../logs/oracle:oam:accessP1
OS sudo / privilege log/var/log/authlogsolaris:sudoP1
File integrity eventsAIDE / Solaris BARTsecurity:fimP1
Network IDS alertsSnort/Suricata/Sourcefiresecurity:idsP1
Oracle AVDF / DB VaultAVDF exportoracle:avdfP2
Patch compliance gapsADOP / OEM feedoracle:ebs:patch:complianceP2
07

Monitoring & Automation Feeds

Custom automation scripts encode your team's institutional knowledge about what "healthy" looks like. Treat them as first-class Splunk sources, not afterthoughts. These feeds are especially valuable for trend analysis and proactive alerting.

FeedSourceSource TypePriority
OEM metric alertsOEM → syslog bridgeoracle:oem:alertP1
PagerDuty incident feedPagerDuty REST → HECpagerduty:incidentP2
Datadog APM spansDatadog → HECdatadog:apmP2
FlexDeploy deploy logFlexDeploy log exportflexdeploy:deployP2
ServiceNow change recordsSNOW REST feedsnow:changeP2
mount_monitor.sh output/var/log/mount_monitor.logcustom:mount_monitorP1
Batch consolidation report (72 programs)HTML email + log filecustom:batch_monitorP1
copy_clonebkp.sh exit codessyslog or log filecustom:clone_pipelineP2
CORP_QCC_RELINK outputLog filecustom:relinkP2
EBS URL extractor reportHTML email + logcustom:url_extractorP3
08

Infrastructure / Storage / Network

NTP is often overlooked: Clock drift on any EBS tier silently breaks Kerberos token validity and OAM session handling. Monitor NTP sync on ALL hosts — internal and DMZ — as a P1 operational alert.
LogSourceSource TypePriority
Storage array logNetApp/EMC syslogstorage:arrayP1
SAN switch logBrocade/Cisco FC syslogstorage:sanP1
Load balancer logF5/Oracle LBR syslognetwork:lbP1
Firewall / ACL logFirewall syslognetwork:firewallP1
DNS resolution logBIND / Unbound lognetwork:dnsP2
IPMI / iLO / ILOM hardwareIPMI sysloghardware:ipmiP1
Backup agent logVeritas/Commvault agentbackup:agentP2
NTP sync logntpd / chrony loginfra:ntpP2
09

Patching / ADOP / Change Logs

ADOP introduced online patching for EBS 12.2. Each phase generates distinct log artefacts. Capturing these phase-by-phase enables automatic change window validation and unauthorized patch detection — including out-of-window DFF recompilation events.

LogPathSource TypePriority
ADOP prepare phase$NE_BASE/EBSapps/patch/*/log/adop_*.logoracle:ebs:adop:prepareP1
ADOP apply phase$NE_BASE/EBSapps/patch/*/log/adop_*.logoracle:ebs:adop:applyP1
ADOP finalize phase$NE_BASE/EBSapps/patch/*/log/adop_*.logoracle:ebs:adop:finalizeP1
ADOP cleanup phase$NE_BASE/EBSapps/patch/*/log/adop_*.logoracle:ebs:adop:cleanupP2
ADOP worker log$NE_BASE/EBSapps/patch/*/log/worker*.logoracle:ebs:adop:workerP2
AD_PATCH_HIST extractDB extract → flat fileoracle:ebs:patch:histP1
AutoPatch log$APPL_TOP/admin/log/oracle:ebs:autopatchP2
DFF / flex compilation logConcurrent req log + AD workeroracle:ebs:dff:compileP3

10

DMZ & Extranet EBS — Full Log Strategy

This is the section most teams get wrong. The DMZ/extranet layer is not just "another OHS server" — it is a separate attack surface with distinct authentication infrastructure, network controls, and external-facing modules. A Splunk deployment that treats DMZ hosts the same as internal hosts will have critical blind spots.

DMZ Traffic Flow — Log Capture at Every Hop
External user
FW1 ①
WAF / F5 LBR
DMZ OHS (SSL term.)
OAM WebGate / SiteMinder
FW2 ②
Internal WLS / OAM
Oracle DB
Critical distinction: The DMZ OHS access log captures real external client IPs. The internal OHS access log shows only the DMZ proxy IP. Both logs are mandatory for end-to-end IP correlation during incident investigation. Tag them with different host values in inputs.conf.

Layer 1 — Perimeter / WAF / External Load Balancer

LogSourceSource TypePriority
F5 BIG-IP access logF5 syslog → Splunknetwork:lb:accessP1
F5 BIG-IP SSL logF5 syslognetwork:lb:sslP1
WAF alert logF5 ASM / ModSecuritynetwork:waf:alertP1
WAF traffic logF5 ASM / ModSecuritynetwork:waf:trafficP1
External firewall (FW1)Firewall syslognetwork:fw:externalP1

Layer 2 — DMZ OHS / Reverse Proxy (SSL Termination)

LogPathSource TypePriority
DMZ OHS access log$INST_TOP/logs/ora/10.1.3/Apache/access_log (DMZ host)oracle:ebs:dmz:ohs:accessP1
DMZ OHS error log$INST_TOP/logs/ora/10.1.3/Apache/error_log (DMZ host)oracle:ebs:dmz:ohs:errorP1
SSL/TLS error log$INST_TOP/logs/ora/10.1.3/Apache/ssl_error_logoracle:ebs:dmz:sslP1
mod_proxy / mod_rewrite logApache error log (rewrite debug)oracle:ebs:dmz:proxyP2
OHS OPMN (DMZ)$INST_TOP/logs/ora/10.1.3/opmn/ (DMZ)oracle:ebs:dmz:opmnP2

Layer 3 — Authentication: SiteMinder + OAM WebGate

LogPathSource TypePriority
SiteMinder Web Agent log$NETE_WA_ROOT/webagent.logoracle:siteminder:webagentP1
SiteMinder Policy Server log$SMPS_HOME/log/smps.logoracle:siteminder:policyP1
SiteMinder Audit log$SMPS_HOME/log/smaccess.logoracle:siteminder:auditP1
FCC (Forms Credential Collector) logSiteMinder Web Agent logoracle:siteminder:fccP1
SiteMinder session store logLDAP / SQL session DBoracle:siteminder:sessionP2
OAM WebGate log (DMZ)$WEBGATE_HOME/oblix/log/oracle:oam:webgate:dmzP1
OAM Access Server log$OAM_HOME/oblix/log/oracle:oam:accessP1
OAM Audit log$OAM_HOME/oblix/log/obaudit.logoracle:oam:auditP1
OID / LDAP access log$ORACLE_HOME/ldap/log/oracle:oid:accessP2

Layer 4 — External-Facing EBS Modules

ModuleFilter PatternSource TypePriority
iSupplier Portal/OA_HTML/OA.jsp?OAFunc=ISUPPLIER*oracle:ebs:isupplier:accessP1
XML Gateway / B2BWLS log + $INST_TOP/logsoracle:ebs:xmlgwP1
Guest / anonymous sessionsFND_LOGINS (GUEST user extract)oracle:ebs:fnd:guestP1
iRecruitmentOHS access log (filtered by function)oracle:ebs:irecruitment:accessP2
Self-Service HR (SSHR)OHS access log (filtered)oracle:ebs:sshr:accessP2
iStore / QuotingOHS access log (filtered)oracle:ebs:istore:accessP2
XML Gateway is high-risk: B2B/EDI inbound payloads can arrive unauthenticated in some configurations. Monitor for abnormal payload sizes, unexpected source IPs, and calls outside business hours.

Layer 5 — DMZ Network & Infrastructure

LogSourceSource TypePriority
Internal firewall (FW2)FW2 syslog (DMZ → internal)network:fw:internalP1
IDS / IPS alerts (DMZ)Snort/Suricata/Sourcefiresecurity:ids:dmzP1
SSL certificate expiry alertsCert manager / cron checksecurity:cert:expiryP1
DMZ switch logCisco/Juniper syslognetwork:switch:dmzP2
Reverse DNS failure logDNS server lognetwork:dns:dmzP2
NTP sync (DMZ hosts)chrony/ntpd loginfra:ntp:dmzP1

Layer 6 — DMZ OS & Bastion Host

LogPathSource TypePriority
DMZ host syslog/var/adm/messages (DMZ Solaris)solaris:syslog:dmzP1
DMZ auth log/var/log/authlog (DMZ Solaris)solaris:auth:dmzP1
Bastion / jump host auth/var/log/authlog (bastion)security:bastion:authP1
Bastion session recording/var/log/bastion/sessions/ (CyberArk/Teleport)security:bastion:sessionP1
DMZ cron log/var/cron/log (DMZ)solaris:cron:dmzP2
DMZ BSM audit/var/audit/ (DMZ)solaris:bsm:dmzP2

11

Splunk inputs.conf Reference

Representative inputs.conf snippets for both internal and DMZ Universal Forwarder deployments on Solaris 11.4.

inputs.conf — Internal Tier (Solaris UF)
# DB Alert Log
[monitor://$ORACLE_BASE/diag/rdbms/*/*/trace/alert_*.log]
index = oracle_db
sourcetype = oracle:db:alert
host = EBSPROD_DB01

# OHS Access Log
[monitor://$INST_TOP/logs/ora/10.1.3/Apache/access_log]
index = ebs_app
sourcetype = oracle:ebs:ohs:access
host = EBSPROD_APP01

# WLS Managed Server
[monitor://$DOMAIN_HOME/servers/*/logs/*.log]
index = ebs_app
sourcetype = oracle:wls:managed

# Concurrent Manager
[monitor://$APPLCSF/$APPLLOG/*]
index = ebs_batch
sourcetype = oracle:ebs:cm:manager

# ADOP Patch Logs
[monitor://$NE_BASE/EBSapps/patch/*/log/*.log]
index = ebs_change
sourcetype = oracle:ebs:adop

# Solaris OS Logs
[monitor:///var/adm/messages]
index = os_internal
sourcetype = solaris:syslog

[monitor:///var/log/authlog]
index = os_security
sourcetype = solaris:auth

# Custom Automation
[monitor:///var/log/mount_monitor.log]
index = custom_ops
sourcetype = custom:mount_monitor
inputs.conf — DMZ Tier (Solaris UF)
# DMZ OHS — separate index from internal OHS
[monitor://$INST_TOP/logs/ora/10.1.3/Apache/access_log]
index = ebs_dmz
sourcetype = oracle:ebs:dmz:ohs:access
host = EBSDMZ_OHS01

# SiteMinder Web Agent
[monitor://$NETE_WA_ROOT/webagent.log]
index = ebs_security
sourcetype = oracle:siteminder:webagent

# SiteMinder Audit
[monitor://$SMPS_HOME/log/smaccess.log]
index = ebs_security
sourcetype = oracle:siteminder:audit

# OAM WebGate (DMZ)
[monitor://$WEBGATE_HOME/oblix/log/*]
index = ebs_security
sourcetype = oracle:oam:webgate:dmz

# DMZ OS Logs
[monitor:///var/adm/messages]
index = os_dmz
sourcetype = solaris:syslog:dmz
host = EBSDMZ_HOST01

[monitor:///var/log/authlog]
index = os_dmz
sourcetype = solaris:auth:dmz
12

SPL Correlation Queries

Production-ready SPL searches for the most common cross-layer alert scenarios covering internal, DMZ, and security tiers.

Detect external IP bypassing WAF
index=ebs_dmz sourcetype=oracle:ebs:dmz:ohs:access
| where NOT src_ip IN ("<<WAF_IP_LIST>>")
| stats count by src_ip, uri
| where count > 5
FCC 500 error detection (SiteMinder)
index=ebs_security sourcetype=oracle:siteminder:webagent
  (fcc OR redirect) (error OR fail OR 500)
| timechart span=5m count by host
Brute force on extranet login
index=ebs_security sourcetype=oracle:siteminder:audit action=REJECT
| bucket _time span=5m
| stats count by src_ip, _time
| where count > 10
ORA- errors in DB alert log (P1 alert)
index=oracle_db sourcetype=oracle:db:alert
  (ORA-600 OR ORA-7445 OR ORA-4031 OR ORA-1555)
| rex field=_raw "(?P<ora_error>ORA-\d+)"
| stats count by ora_error, host
| sort -count
SSL certificate expiry < 30 days
index=infra sourcetype=security:cert:expiry
| where days_to_expiry < 30
| table cn, expiry_date, host, days_to_expiry
| sort days_to_expiry
ADOP patch applied outside change window
index=ebs_change sourcetype=oracle:ebs:adop:apply
| eval hour=strftime(_time,"%H")
| where hour < 22 AND hour > 6
| stats count by host, _time, patch_id
CM batch job failure rate (QCT production)
index=ebs_batch sourcetype=oracle:ebs:cm:request:log
  completion_status=ERROR
| timechart span=1h count as failures
| where failures > 5