Re: what is being audited by the database

From: Powell, Mark <mark.powell2_at_dxc.com>
Date: Fri, 26 Apr 2019 20:04:10 +0000
Message-ID: <DM6PR01MB39146C79213676F0EAAEDF13CE3E0_at_DM6PR01MB3914.prod.exchangelabs.com>



Why do you have "where USER_NAME is not null" if you want to see all audit rules in effect?

What full version of Oracle is this?

Is Unified Auditing in use?

Mark Powell
Database Administration
(313) 592-5148



From: oracle-l-bounce_at_freelists.org <oracle-l-bounce_at_freelists.org> on behalf of Ls Cheng <exriscer_at_gmail.com> Sent: Friday, April 26, 2019 10:01:58 AM To: Oracle Mailinglist
Subject: what is being audited by the database

Hi

I have a database which is generating large amount of audit information in syslog. audit_trail is set to OS. SELECT statements are being audited, one sample audit record

Apr 26 14:54:42 no1b local6:notice
Oracle Audit[54526112]:
LENGTH: "272"
SESSIONID:[8] "99149799"
ENTRYID:[5] "37831"
STATEMENT:[5] "82728"
USERID:[4] "MOON"

USERHOST:[7] "curve2"
TERMINAL:[7] "unknown"
ACTION:[1] "3"

RETURNCODE:[1] "0"
OBJ$CREATOR:[4] "MOON"
OBJ$NAME:[19] "API_Q_POINT"
OS$USERID:[6] "curve"
DBID:[10] "3327503583"
I checked what is being audited but nothing is being audited. Ichecked by running these queries:
SELECT * FROM DBA_STMT_AUDIT_OPTS where USER_NAME is not null order by user_name,audit_option;
SELECT * FROM DBA_PRIV_AUDIT_OPTS where USER_NAME is not null order by user_name,privilege;
SELECT * FROM DBA_OBJ_AUDIT_OPTS order by owner,object_name,object_type;
SELECT * FROM ALL_DEF_AUDIT_OPTS;

All of them return cero rows except ALL_DEF_AUDIT_OPTS which shows

ALT AUD COM DEL GRA IND INS LOC REN SEL UPD REF EXE FBK REA --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/-

Anyone know where else can I check :-?

audit parameters

show parameter audit

NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
audit_file_dest                      string      /u01/app/oracle/admin/AIX112/adump
audit_sys_operations                 boolean     FALSE
audit_syslog_level                   string      LOCAL6.NOTICE
audit_trail                          string      OS

Thank you

DXC Technology Company - Headquarters: 1775 Tysons Boulevard, Tysons, Virginia 22102, USA. DXC Technology Company -- This message is transmitted to you by or on behalf of DXC Technology Company or one of its affiliates. It is intended exclusively for the addressee. The substance of this message, along with any attachments, may contain proprietary, confidential or privileged information or information that is otherwise legally exempt from disclosure. Any unauthorized review, use, disclosure or distribution is prohibited. If you are not the intended recipient of this message, you are not authorized to read, print, retain, copy or disseminate any part of this message. If you have received this message in error, please destroy and delete all copies and notify the sender by return e-mail. Regardless of content, this e-mail shall not operate to bind DXC Technology Company or any of its affiliates to any order or other contract unless pursuant to explicit written agreement or government initiative expressly permitting the use of e-mail for such purpose. --.

--
http://www.freelists.org/webpage/oracle-l
Received on Fri Apr 26 2019 - 22:04:10 CEST

Original text of this message