Oracle WebLogic Server

When you configure your Oracle WebLogic Server to send log data to USM Appliance, you can use the Oracle WebLogic Server plugin to translate raw log data into normalized events for analysis. The table below provides some basic information for the plugin.

Plugin Information
Device Details
Vendor Oracle
Device Type Server
Connection Type Syslog
Data Source Name Oracle WebLogic
Data Source ID 1907

Integrating Oracle WebLogic Server

Before you configure the Oracle WebLogic Server integration, you must have the IP Address of the USM Appliance Sensor.

To configure Oracle WebLogic Server to send Syslog messages to USM Appliance

You need to attach an appender to send log events to syslog. With the Log4j Logger, you can attach a custom appender to receive the log events. Here are the steps to follow using Log4j:

  1. Obtain a copy of the Apache log4j.jar file from the following location:
  2. Copy the log4j.jar file and the WL_HOME/server/lib/wllog4j.jar file dynamically to the server classpath during server startup. If you place these .jar files elsewhere, make sure that both files are placed in the same directory and that you update the server classpath to include this directory.
  3. Configure Oracle WebLogic Server to use Log4j logging:

    log4j.logger.syslog =DEBUG, syslogApp # Appender configuration log4j.appender.syslogApp.SyslogHost=<USM ApplianceServer IP Address> log4j.appender.syslogApp.layout=org.apache.log4j.PatternLayout log4j.appender.syslogApp.layout.ConversionPattern=%m

  4. From the Admin Console, select <Domain Name> > Configuration > Logging > Advanced Options > Logging Implementation: Log4J.
  5. Restart the server.

Note: Some Oracle forum users have reported that they needed to uncomment the following properties in their rsyslog.conf file, to get logging to work successfully:

# Provides UDP syslog reception

#$ModLoad imudp

#$UDPServerRun 514

Plugin Enablement

For plugin enablement information, see Enable Plugins.

Additional Resources and Troubleshooting

For troubleshooting, see the vendor documentation.