Orcale审计命令

1、查看审计功能是否开启

sqlplus "/as sysdba"

SQL> show parameter audit;

NAME TYPE VALUE

-------------------- ------- --------------------------------

audit_file_dest string /u01/app/oracle/admin/ORCL/adump

audit_sys_operations boolean TRUE

audit_syslog_level string

audit_trail string DB

说明：表明审计功能为开启的状态

2、关闭oracle的审计功能

SQL> alter system set audit_sys_operations=FALSE scope=spfile;

System altered.

SQL> alter system set audit_trail=NONE scope=spfile;

System altered.

3、重启数据库

SQL> shutdown immediate;

SQL> startup;

4、验证审计是否已经被关闭

SQL> show parameter audit;

NAME TYPE VALUE

-------------------- ------- --------------------------------

audit_file_dest string /u01/app/oracle/admin/ORCL/adump

audit_sys_operations boolean FALSE

audit_syslog_level string

audit_trail string NONE

说明：表明审计功能为关闭的状态

5、清空审计表数据

SQL> truncate table SYS.AUD$;

6，查询审计日志数据

select count(*) from SYS.AUD$;

select rr.logoff$time,rr.* from SYS.AUD$ rr where rr.logoff$time > to_date('2020-01-01 00:00:00','yyyy-mm-dd hh24:mi:ss');