关于add_policy过程调用问题

FGA审计调用函数问题： 

 begin
  DBMS_FGA.ADD_POLICY(
     object_schema   =>'sec',
     object_name     =>'t',
     policy_name     =>'audit_t' ,
     audit_condition =>'X>300 and Y>300',
     audit_column    =>'X,Y',
     handler_schema  =>'SEC',
     handler_module  =>'PROC_NAME,
     enable          =>true,
     statement_types =>'select',
     audit_trail    =>DBMS_FGA.DB+DBMS_FGA.EXTENDED,
     audit_column_opts =>DBMS_FGA.ANY_COLUMNS);
  end;

以上过程handler_module  =>'PROC_NAME‘该项调用的PROC_MON_T过程写法是由讲究的。过程名可以随便设定，但是过程的参数必须是(schema_name varchar2,table_name varchar2, policy_name varchar2) 这种格式。要不然，审计调用这个过程的时候就会报错。

一下是我开始定义的过程(不含标准输入参数)：

CREATE OR REPLACE PROCEDURE PROC_MON_T

as
begin
insert into mon_t values(sysdate);
end;

 

当执行查询语句 sec@prod>select * from t where x>300时，就会爆如下错误：

ERROR:
ORA-06550: line 1, column 7:
PLS-00306: wrong number or types of arguments in call to 'PROC_MON_T'
ORA-06550: line 1, column 7:
PL/SQL: Statement ignored
------------------------------------------------------

然后报过程的输入参数改为要求的标准输入参数。代码如下：

CREATE OR REPLACE PROCEDURE PROC_MON_T(schema_name varchar2,table_name varchar2, policy_name varchar2)

as
begin
insert into mon_t values(sysdate);
end;

 

再次执行语句 sec@prod>select * from t where x>300 就不不会以上报错了。

 

附：精细化审计对调用过程有要求；官方文档里有特别说明，如下

#

The audit function (handler_module) is an alerting mechanism for the administrator. The required interface for such a function is as follows:

PROCEDURE ( object_schema VARCHAR2, object_name VARCHAR2, policy_name VARCHAR2 )  AS ...

where fname is the name of the procedure, object_schema is the name of the schema of the table audited, object_name is the name of the table to be audited, and policy_name is the name of the policy being enforced.

位置：Oracle? Database Security Guide—>12 Configuring and Administering Auditing

 

 

 

来自 “ ITPUB博客 ” ，链接：http://blog.itpub.net/9606353/viewspace-775233/，如需转载，请注明出处，否则将追究法律责任。

转载于:http://blog.itpub.net/9606353/viewspace-775233/