oracle10g 審計功能

oracle10g 審計功能

相關引數：
AUDIT_FILE_DEST 系統存放審計日誌的目錄
AUDIT_SYS_OPERATIONS 是否審計sys system使用者
AUDIT_TRAIL ：
AUDIT_TRAIL = { db | os | none | true | false | db_extended }
其中
None：是預設值，不做審計；
DB：將audit trail 記錄在資料庫的審計相關表中，如aud$，審計的結果只有連線資訊；
DB,Extended：這樣審計結果裡面除了連線資訊還包含了當時執行的具體語句；
OS：將audit trail 記錄在作業系統檔案中，檔名由audit_file_dest引數指定；

審計的幾個選項：
by access / by session：
by access 每一個被審計的操作都會生成一條audit trail。
by session 一個會話裡面同型別的操作只會生成一條audit trail，預設為by session。

whenever [not] successful：
whenever successful 操作成功(dba_audit_trail中returncode欄位為0) 才審計,
whenever not successful 反之。省略該子句的話，不管操作成功與否都會審計。

主要相關的檢視：dba_audit_trail

測試：

SQL> show parameters AUDIT_SYS_OPERATIONS;
 
NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
audit_sys_operations                 boolean     FALSE
 
SQL> show parameters AUDIT_TRAIL;
 
NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
audit_trail                          string      NONE

SQL> alter system set AUDIT_TRAIL=db scope=spfile;
 
System altered

SQL> show parameters AUDIT_TRAIL;
 
NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
audit_trail                          string      NONE
 
 
然後重啟資料庫使得引數生效

SQL> audit select,insert,update,delete on scott.emp;
 
Audit succeeded
 
SQL> conn scott/tiger
Connected to Oracle Database 10g Enterprise Edition Release 10.2.0.1.0
Connected as scott
 
SQL> select * from emp where rownum=1;
 
EMPNO ENAME      JOB         MGR HIREDATE          SAL      COMM DEPTNO
----- ---------- --------- ----- ----------- --------- --------- ------
 7369 SMITH      CLERK      7902 1980-12-17     800.00               20
 
SQL> select OS_USERNAME,username,USERHOST,TERMINAL,TIMESTAMP,
  2  OWNER,obj_name,ACTION_NAME,sessionid,os_process,sql_text from dba_audit_trail;
 
OS_USERNAME                                                                      USERNAME                       USERHOST                                                                         TERMINAL                                                                         TIMESTAMP   OWNER                          OBJ_NAME                                                                         ACTION_NAME                   SESSIONID OS_PROCESS       SQL_TEXT
-------------------------------------------------------------------------------- ------------------------------ -------------------------------------------------------------------------------- -------------------------------------------------------------------------------- ----------- ------------------------------ -------------------------------------------------------------------------------- ---------------------------- ---------- ---------------- --------------------------------------------------------------------------------
ICBCOA-6170D1DD\Administrator                                                    SCOTT                          MSHOME\ICBCOA-6170D1DD                                                           ICBCOA-6170D1DD                                                                  2009-12-19  SCOTT                          EMP                                                                              SESSION REC                         145 2908:2116       
ICBCOA-6170D1DD\Administrator                                                    SCOTT                          MSHOME\ICBCOA-6170D1DD                                                           ICBCOA-6170D1DD                                                                  2009-12-19  SCOTT                          EMP                                                                              SESSION REC                         148 2908:520        
 
SQL>

 

 

來自 “ ITPUB部落格 ” ，連結：http://blog.itpub.net/16179598/viewspace-623088/，如需轉載，請註明出處，否則將追究法律責任。