hijk139的专栏

大江东去

oracle 11g的audit导致system表空间快速增长的问题

11gr2版本,oracle把参数audit_trail 自动设置为DB级别,导致很多数据库的操作被记录在审计表sys.aud$中,导致sys.aud$所在的表空间快速增长。可以通过TRUNCATE清空改表,同时,为了system表空间的安全,建议把改表转移至别的表空间

SQL> show parameter  audit_trail

NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------

audit_trail                          string      DB

TRUNCATE TABLE sys.aud$;

由于sys.aud$有lob字段,将审计结果表从system表空间里移动到别的表空间上的操作具体如下

  实际上sys.aud$表上包含了两个lob字段,并不是简单的move table就可以。

  下面是具体的过程:

  alter table sys.aud$ move tablespace monitor;

  alter table sys.aud$ move lob(sqlbind) store as( tablespace monitor);

  alter table sys.aud$ move lob(SQLTEXT) store as( tablespace monitor);

  TRUNCATE TABLE sys.aud$;


附录:关于SYS.AUD$的删除操作

a) To delete rows from the database audit trail table, an appropriate privilege
   is required. You must either be the user SYS, or a user with DELETE ANY TABLE
   system privilege, or a user to whom SYS has granted the object privilege
   DELETE on SYS.AUD$.

b) To purge audit records from the audit trail, delete all rows:


   -- DELETE FROM sys.aud$;

   To delete rows from the audit trail related to a particular audited table:

   -- DELETE FROM sys.aud$ WHERE obj$name='';

c) If audit trail information must be archived, copy the relevant rows to another
   table before deletion, using either:

   -- CREATE TABLE  
      AS SELECT * from sys.aud$ WHERE 1=2;

   -- INSERT INTO  
      SELECT  FROM sys.aud$

   -- EXPort the  to an OS file, but do not export SYS.AUD$
      directly.

d) Reducing the size of the audit trail:

   1. If you want to save information currently in the audit trail, copy it to
      another table and optionally export that table.

   2. SQL> connect / as sysdba
      SQL> TRUNCATE TABLE sys.aud$;
   
      Truncate uses the DROP STORAGE clause which keeps 'minextents' extents,
      thus only 1 extent.

   3. Reload archived audit trail records generated from Step 1.

   The rows inserted require as many extents as necessary to contain current
   audit trail rows, but no more.

   CAUTION: SYS.AUD$ is the only SYS object that should ever be directly modified
The DELETE ANY TABLE privilege only applies to SYS objects if O7_DICTIONARY_ACCESSIBILITY=TRUE

阅读更多
个人分类: oracle
想对作者说点什么? 我来说一句

没有更多推荐了,返回首页

不良信息举报

oracle 11g的audit导致system表空间快速增长的问题

最多只允许输入30个字

加入CSDN,享受更精准的内容推荐,与500万程序员共同成长!
关闭
关闭