Re: audit 'revoke' statement

From: Howard J. Rogers <hjr_at_dizwell.com>
Date: Sat, 22 May 2004 10:53:47 +1000
Message-ID: <40aea491$0$31677$afc38c87@news.optusnet.com.au>

"Joe" <nospam_at_joekaz.net> wrote in message news:b9c56449.0405211053.51e65239_at_posting.google.com...
> desertflowerln_at_yahoo.com (Alan) wrote in message
news:<b1217045.0405201239.a5e16d6_at_posting.google.com>...
> > "Michel Cadot" <micadot{at}altern{dot}org> wrote in message
news:<40ac4a34$0$26908$626a14ce_at_news.free.fr>...
> > > "Alan" <desertflowerln_at_yahoo.com> a écrit dans le message de
> > > news:b1217045.0405191531.5df3eb15_at_posting.google.com...
> > > > Joe <nospam_at_joekaz.net> wrote in message
news:<xcyqc.9799$if5.8512_at_fe17.usenetserver.com>...
> > > > > On 05/18/2004 07:53 PM, Alan said:
> > > > > > Does anyone know how can I audit any 'revoke' statements?
> > > > >
> > > > > Do: AUDIT SYSTEM GRANT;
> > > > > This will audit all grants and revokes of roles and privileges.
> > > > > Also make sure that the init.ora AUDIT_TRAIL=DB,
> > > > > otherwise the audit statement will have no effect.
> > > >
> > > > Do you know which view will this audit result be kept?
> > > >
> > > > Thanks,
> > > > Alan
> > >
> > > dba_audit_statement and dba_audit_trail.
> > >
> > > Regards
> > > Michel Cadot
> >
> >
> > I know those two views. But by just doing 'Audit System Grant;' and
> > with audit_trail=DB, I don't see any audit record in those two views.
> > That's why I ask to see whether they are stored somewhere else.
> >
> > Thanks for the reply.

>
>

> What user are you doing the GRANTs and REVOKEs as? You should see it
> in those views, unless you are doing the GRANT while connected as SYS
> - in that case you probably won't find it in the audit trail because
> actions done by SYS are not audited the same as a normal user.

Unless of course you are running 9i and set the parameter

audit_sys_operations = TRUE

(It's false by default).

But you're right that even then it doesn't go into the normal audit trail, but to the operating system's audit trail.

Regards
HJR
> --
> Joe
> http://www.cafeshops.com/joekaz
> http://www.joekaz.net
Received on Fri May 21 2004 - 19:53:47 CDT