本地连接
sqlplus /nolog
conn /as sysdba
配置
SQL> alter system set audit_sys_operations=TRUE scope=spfile;--审计管理用户(以sysdba/sysoper角色登陆)
SQL> alter system set audit_trail=db,extended scope=spfile;
重启
SQL> SHUTDOWN IMMEDIATE;
SQL> STARTUP
加入审计策略
AUDIT ALTER SYSTEM;
AUDIT ALTER ANY ROLE;
AUDIT ALTER PROFILE;
AUDIT ALTER USER;
AUDIT CREATE DATABASE LINK;
AUDIT CREATE ROLE;
AUDIT CREATE USER;
AUDIT DELETE ANY TABLE;
AUDIT DROP ANY ROLE;
AUDIT DROP USER;
AUDIT DROP PROFILE;
AUDIT DROP ANY TABLE;
AUDIT GRANT ANY PRIVILEGE;
AUDIT GRANT ANY ROLE;
AUDIT CREATE SESSION;
NOAUDIT 。。。。是用来关闭的
查询
select * from dba_stmt_audit_opts;