oracle 开启审计

本地连接
sqlplus /nolog

conn /as sysdba

配置
SQL> alter system set audit_sys_operations=TRUE scope=spfile;--审计管理用户(以sysdba/sysoper角色登陆)
SQL> alter system set audit_trail=db,extended scope=spfile;

重启
SQL> SHUTDOWN IMMEDIATE;
SQL> STARTUP

加入审计策略
AUDIT ALTER SYSTEM;
AUDIT ALTER ANY ROLE;
AUDIT ALTER PROFILE;
AUDIT ALTER USER;
AUDIT CREATE DATABASE LINK;
AUDIT CREATE ROLE;
AUDIT CREATE USER;
AUDIT DELETE ANY TABLE;
AUDIT DROP ANY ROLE;
AUDIT DROP USER;
AUDIT DROP PROFILE;
AUDIT DROP ANY TABLE;
AUDIT GRANT ANY PRIVILEGE;
AUDIT GRANT ANY ROLE;
AUDIT CREATE SESSION;

NOAUDIT 。。。。是用来关闭的

 

查询

select * from dba_stmt_audit_opts;