审计audit

审计是对用户在数据库中操作情况进行监控和记录

审计类型：
    语句审计
    权限审计
    对象审计
    
开启审计功能：
    SYS> show parameter audit_trail
    SYS> alter system set audit_trail=db,extended scope=spfile;


审计设置：
    1、语句审计
    AUDIT sql [by user_name] [by session|access] [whenever [not] successful]

    
    例：
    SYS> audit table by scott by access;


    查看审计结果
    SYS> select USERNAME,TIMESTAMP,SQL_TEXT from dba_audit_trail
        where username='SCOTT' order by TIMESTAMP;

    查看作了哪些语句审计
    SYS> select USER_NAME,AUDIT_OPTION,SUCCESS,FAILURE from dba_stmt_audit_opts;

    停止审计
    SYS> noaudit alter table by scott;
    SYS> noaudit all by scott;
   

    2、权限审计
    AUDIT privilege_name  [by user_name] [by session|access]
        [whenever [not] successful]

    例：
    SYS> audit create view by scott by access;
    SYS> audit create table by scott by access;

    查看做了哪些权限审计
    SYS> select USER_NAME,PRIVILEGE,SUCCESS,FAILURE from dba_priv_audit_opts;

    查看审计结果
    SYS> select USERNAME,TIMESTAMP,SQL_TEXT from dba_audit_trail
         where username='SCOTT' order by TIMESTAMP

    3、对象审计
    AUDIT stmt_name ON object_name [by user_name] [by session|access]
        [whenever [not] successful]

    SYS> audit all on scott.emp by access;


    查看作了哪些对象审计
    SYS> select * from dba_obj_audit_opts;


    取消审计
    SYS> noaudit all on scott.emp by access;

审计信息的清除
    SYS> delete from sys.aud$;


精细化审计（FGA）
    精细化审计（FGA）主要是ORACLE包来实现的
    SYS> begin
      2  dbms_fga.ADD_POLICY
      3  (OBJECT_SCHEMA=>'SCOTT',
      4  OBJECT_NAME=>'EMP',
      5  POLICY_NAME=>'AUDIT_EMP',
      6  AUDIT_CONDITION=>'DEPTNO=30',
      7  ENABLE=>TRUE,
      8  STATEMENT_TYPES=>'SELECT,UPDATE,DELETE'
      9  );
     10  end;
     11  /
   

    查看作了哪些FGA
    SYS> select OBJECT_SCHEMA,OBJECT_NAME,POLICY_NAME,SEL,INS,UPD,DEL
        from dba_audit_policies;


    查看审计结果
    SYS> select DB_USER,TIMESTAMP,SQL_TEXT from dba_fga_audit_trail;

    禁用/启用
    SYS> exec dbms_fga.DISABLE_POLICY('SCOTT','EMP','AUDIT_EMP');
    SYS> exec dbms_fga.ENABLE_POLICY('SCOTT','EMP','AUDIT_EMP');
                                          用户名   对象名    策略名

    删除FGA审计
    SYS> exec dbms_fga.DROP_POLICY('SCOTT','EMP','AUDIT_EMP');

对DBA审计
    audit_sys_operations    设置为true
    结果保存在操作系统下  audit_file_dest 变量指定的目录中，
    文件名的格式：${ORACLE_SID}_ora_$SPID.aud
 

来自 “ ITPUB博客 ” ，链接：http://blog.itpub.net/21175589/viewspace-755798/，如需转载，请注明出处，否则将追究法律责任。

转载于:http://blog.itpub.net/21175589/viewspace-755798/