v12 dashboard: Oracle Database (blocked on the parser)

[kryonsx]

Part of: #2696 · Needs first: #2697 (click-through to the Log Explorer and the value/count table)
Related: #1978 (parsers and rules for this integration, owned by the detection team)

Goal

Ship a built-in Oracle Database dashboard. Blocked on the parser: no parser exists for data type oracle, so there is nothing to group these logs by (see #1978). Only the widgets below are possible until that is fixed. They sit in the standard positions, so the event-type list and the other widgets can be added later without moving them. Build this version now or wait for the parser fix, whichever fits your queue.

Where the data comes from

Integration (catalog name)	ORACLE
Data type	oracle
How the logs arrive	rsyslog on the Oracle server reads the audit (.aud), listener and alert log files and forwards each line as syslog (facility local5) to the UTMStack forwarder on port 7021.
Parser	none (see below)
What dataSource holds	The IP address of the machine that sent the syslog line, normally the Oracle database server running rsyslog (or a relay). Proof: collectors/forwarder/collector/syslog/handler.go resolveRemoteAddr (lines 21-33) and readLoop (line 79); listener.go lines 264-266 for UDP; 127.0.0.1 becomes the forwarder's host name. Port 7021 comes from collectors/forwarder/config/const.go (DataTypeOracle, lines 70 and 99).
Grouped by	nothing yet (see below)

No parser exists for dataType oracle (no file under definitions/filters declares it), so a stored Oracle log has only the fixed columns (@timestamp, dataType, dataSource, raw ...) and no log.* fields. There is nothing to group by, so the dashboard has no event-type list until a parser is written.

Widgets

The widgets of the standard layout that work without parsed fields.

#	Title	Shown as	Query	Why
W1	Total logs	number	logs: count	How many Oracle log lines arrived; proves the feed works even without a parser.
W5	Log volume over time	area chart	logs: count over time	Shows gaps (a server stopped forwarding) and bursts.
W6	Logs by database server	bar chart	logs: top 10 values of dataSource	dataSource is the sending server's IP.
W15	Latest logs	table of latest logs	logs: latest 20 records; columns @timestamp, dataSource, raw	Without a parser the raw text is the only content to show.

Fields used and where they come from

• raw: The full syslog line as received: header plus one line of an Oracle file, with the rsyslog tag 'oracle-audit', 'oracle-listener' or 'oracle-alerts' if the customer followed the setup guide. Examples: <174>Sep 24 10:00:00 dbhost1 oracle-listener: 24-SEP-2026 10:00:00 * (CONNECT_DATA=...) * (ADDRESS=(PROTOCOL=tcp)(HOST=10.0.0.5)(PORT=51234)) * establish * ORCL * 0. Source: No parser, so raw is stored untouched (installer/docker/clickhouse-schema.sql column raw). Tags from frontend/src/features/integrations/components/setup/collector/collectors/oracle.tsx lines 14-31.
• dataSource: Sender IP (the database server). Examples: 10.0.40.12. Source: collectors/forwarder/collector/syslog/handler.go lines 21-33 and 79; listener.go lines 264-266

Watch out for

• This dashboard is blocked on a parser. It has only 4 widgets: total, volume over time, logs by server and the latest raw lines. The positions follow the standard layout, so the remaining widgets can be added later without moving these.
• There are no correlation rules for dataType oracle (none of the 664 rules under definitions/rules lists it), so the alert widgets (W4, W13, W14) were left out; they would always show zero.
• The setup guide sends three different files under one dataType, told apart only by the rsyslog tag inside raw ('oracle-audit', 'oracle-listener', 'oracle-alerts'). Customers may change those tags, so they are not used as filters.
• The rsyslog config in the setup guide reads .aud files line by line. One audit record in a .aud file spans many lines, so each record arrives split into many separate logs.

Parser problems found while designing this

These are not dashboard work, but they limit what the dashboard can show. They belong to #1978; raise them there rather than working around them in the dashboard.

• No parser exists for oracle. None of the 35 files under definitions/filters lists 'oracle' in its dataTypes, so Oracle logs are stored with only the raw text and no field-based widget is possible.
• A parser would need to extract, from the syslog header: priority, time, host and the rsyslog tag (to tell audit, listener and alert-log lines apart, for example into log.logSource).
• From audit trail records (the .aud files, or better single-line records sent with AUDIT_SYSLOG_LEVEL or unified audit to syslog): the action (ACTION / ACTION NUMBER, for example 100 LOGON, 101 LOGOFF) into action as a readable name; the result (RETURNCODE or STATUS: 0 = success, 1017 = invalid user name or password, 28000 = account locked) into actionResult success/failed; DATABASE USER / USERID into origin.user; CLIENT USER / OS$USERID into log.osUser; PRIVILEGE (for example SYSDBA) into log.privilege; USERHOST / CLIENT TERMINAL into origin.host; the client IP from CLIENT ADDRESS or COMMENT$TEXT '(HOST=...)' into origin.ip; OBJ$CREATOR / OBJ$NAME into the target object; plus SESSIONID and DBID.
• From listener.log lines: the time, CONNECT_DATA (SERVICE_NAME, PROGRAM, HOST, USER) into target service, origin.process, origin.host and origin.user; ADDRESS (PROTOCOL, HOST, PORT) into origin.ip and origin.port; the command (establish, ping, service_update) into action; and the return code (0 or a TNS-xxxxx number) into actionResult.
• From alert log lines: ORA-xxxxx error codes (for example ORA-00600 internal error, ORA-01017 invalid login) into a log.errorCode field, plus startup and shutdown messages.
• Then geolocation on origin.ip, and correlation rules for failed logins, SYSDBA use, account lockouts and privilege changes, which would unlock KPIs such as 'Failed logins' and 'Privileged sessions'.
• Collection fix needed first: the setup guide (frontend/src/features/integrations/components/setup/collector/collectors/oracle.tsx lines 14-31) reads .aud files with imfile line by line, splitting multi-line audit records. It should join records (imfile startmsg.regex) or switch to Oracle's own syslog audit output, which writes one line per record.
• The AIX parser already contains grok steps for Oracle's single-line syslog audit format (definitions/filters/ibm/ibm_aix.yaml lines 203-381 and actionResult at lines 541-553) that could seed an Oracle parser, after fixing their unescaped '$' patterns and key-order assumptions.

How to build it

Before you start: parser field names are changing while the parsers are updated for the engine's new underscore handling (see "Field names are about to move" in #2696). Check every field in this issue against the v12 parser at that moment and against real logs, and build against what you find.

1. Add definitions/dashboards/integration-oracle.yaml. Keep it in the top folder: the test that checks shipped dashboards (TestEveryShippedDashboardDefinitionIsValid) only reads the top folder.
2. Start from the file below; it follows the table above and passes the same checks as the backend (domain.Spec.Validate).
3. Load real logs from this technology on a v12 test server (or replay samples) and check every widget before opening the pull request.

Starting dashboard file

# Dashboard version v1.0.0
#
# System-owned default dashboard for the Oracle Database integration, seeded by
# backend/modules/dashboards/repository/dashboard_bootstrap.go.
# No parser exists for this data type yet.
# Verify every widget against real logs before shipping.
name: "Oracle Database"
description: "What Oracle Database is sending: volume, event types, and the activity worth a look."
widgets:
  - layout: { x: 0, y: 0, w: 3, h: 2 }
    spec:
      dataset: logs
      dataType: "oracle"
      chart: metric
      metric:
        agg: count
    config:
      __builder:
        chartType: metric
        title: "Total logs"

  - layout: { x: 0, y: 2, w: 8, h: 4 }
    spec:
      dataset: logs
      dataType: "oracle"
      chart: time
      metric:
        agg: count
    config:
      __builder:
        chartType: area
        title: "Log volume over time"

  - layout: { x: 8, y: 2, w: 4, h: 4 }
    spec:
      dataset: logs
      dataType: "oracle"
      chart: category
      metric:
        agg: count
      dimension: "dataSource"
      limit: 10
    config:
      __builder:
        chartType: bar
        title: "Logs by database server"

  - layout: { x: 0, y: 6, w: 12, h: 6 }
    spec:
      dataset: logs
      dataType: "oracle"
      chart: table
      metric:
        agg: count
      limit: 20
      columns: ["@timestamp", "dataSource", "raw"]
    config:
      __builder:
        chartType: table
        title: "Latest logs"

Done when

• definitions/dashboards/integration-oracle.yaml is merged to release/v12.0.0 and go test ./modules/dashboards/... passes in backend/.
• With Oracle Database logs flowing on a v12 test server, every widget shows data. A widget that stays empty while logs arrive means a wrong field or value: fix it, don't ship it.
• Clicking a row, bar or line point opens the Log Explorer on the same logs, and the Log Explorer count matches the widget.
• A time range with no logs shows empty states, not errors.
• A screenshot of the finished dashboard is attached to this issue.