Re: audit statement for tracking alter table?

From: Mark D Powell <Mark.Powell_at_eds.com>
Date: Sat, 31 May 2008 08:05:39 -0700 (PDT)
Message-ID: <9c8a5466-3420-4e83-bc38-bd06d53104fe@34g2000hsf.googlegroups.com>


On May 30, 5:42 pm, DA Morgan <damor..._at_psoug.org> wrote:
> rgvguplb wrote:
> > Hi
>
> > What is the appropriate AUDIT command if you want to track ALTER TABLE
> > statements?
>
> AUDIT ALTER ANY TABLE BY ACCESS;
> --
> Daniel A. Morgan
> Oracle Ace Director & Instructor
> University of Washington
> damor..._at_x.washington.edu (replace x with u to respond)
> Puget Sound Oracle Users Groupwww.psoug.org

I suggest you also do (at least in production) an "audit table" as this will cause an audit record to be written for every create, drop, and truncate table performed on your system. You can write a query to filter out tables that are truncated as a part of normal production batch processing and then quickly look for any unexpected actiivity.

In fact I suggest auditing all Oracle object creation in production: index, procedure, view, and any other object types used on your system.

HTH -- Mark D Powell -- Received on Sat May 31 2008 - 10:05:39 CDT

Original text of this message