oracle审计规则,oracle审计详解

审计可以记录ORACLE的各种操作，比如谁访问了或者删除表数据等。

SQL> conn /as sysdba SQL> show parameter audit

NAME                                 TYPE        VALUE

------------------------------------ ----------- ------------------------------

audit_file_dest                      string      /u01/app/oracle/admin/ORCL/adump

audit_sys_operations                 boolean     FALSE

audit_syslog_level                   string

audit_trail                          string      NONE

SQL> alter system set audit_sys_operations=TRUE scope=spfile;    --审计管理用户(以sysdba/sysoper角色登陆)

SQL> alter system set audit_trail=db,extended scope=spfile;

SQL> startup force;

SQL> show parameter audit

NAME                                 TYPE        VALUE

------------------------------------ ----------- ------------------------------

audit_file_dest                      string      /u01/app/oracle/admin/ORCL/adump

audit_sys_operations                 boolean     TRUE

audit_syslog_level                   string

audit_trail                          string      DB, EXTENDED

AUDIT DELETE ANY TABLE BY ACCESS  WHENEVER SUCCESSFUL;    --只审计删除成功的情况

AUDIT TABLE BY ACCESS  WHENEVER SUCCESSFUL;  --CREATE,DROP,TRUNCATE

--审计信息

SELECT * FROM SYS.AUD$;

SELECT * FROM SYS.DBA_AUDIT_TRAIL;