Thursday, December 4, 2014

Enable Audit trail for Oracle DB


Setting parameter 

1. AUDIT_TRAIL = { none | db | db,extended | xml | xml,extended | os }

none or false    - Auditing is disabled.
db or true        - Auditing is enabled, with all audit records stored in the                           database audit trial (SYS.AUD$).
db,extended    - As db, but the SQL_BIND and SQL_TEXT columns are also                         populated.
xml                - Auditing is enabled, with all audit records stored as XML                           format OS files.
xml,extended  - As xml, but the SQL_BIND and SQL_TEXT columns are also                          populated.
os                   - Auditing is enabled, with all audit records directed to the                         operating system's audit trail.

2. AUDIT_SYS_OPERATIONS - Static parameter enables audit for SYSDBA or SYSOPER privileges including the SYS user.

3. AUDIT_FILE_DEST  -  Parameter specifies the OS directory used for the audit trail when the os, xml and xml,extended options are used.

Ex : ALTER SYSTEM SET audit_trail=db SCOPE=SPFILE;   

Finally Restart the DB to apply the changes

Enable Audit for Specific user
$ sqlplus / as sysdba
$ sql> AUDIT ALL BY <user_name> BY ACCESS;
$ sql> AUDIT SELECT TABLE, UPDATE TABLE, INSERT TABLE, DELETE TABLE,ALTER TABLE BY <user_name> BY ACCESS;
$ sql> AUDIT EXECUTE PROCEDURE BY <user_name> BY ACCESS;

DB Audit Related Views
DBA_AUDIT_EXISTS
DBA_AUDIT_OBJECT
DBA_AUDIT_POLICIES
DBA_AUDIT_POLICY_COLUMNS
DBA_AUDIT_SESSION
DBA_AUDIT_STATEMENT
DBA_AUDIT_TRAIL
DBA_COMMON_AUDIT_TRAIL
DBA_FGA_AUDIT_TRAIL
DBA_OBJ_AUDIT_OPTS
DBA_PRIV_AUDIT_OPTS
DBA_REPAUDIT_ATTRIBUTE
DBA_REPAUDIT_COLUMN
DBA_STMT_AUDIT_OPTS

No comments:

Post a Comment