首先创造实验环境:
create table test_audit(pid int,name char(20) ,name2 char(20) ,name3 char(20),name4 char(20),name5 char(20),name6 char(20))
begin
for i in 1..5 loop
insert into test_audit(pid,name,name2,name3,name4,name5,name6) values(i,'this is a test','this is a test2','this is a test3','this is a test4','this is a test5','this is a test6');
end loop;
end;
/
分以下三种情况:
1)没开审计
环境检查:
SQL> show parameter audit;
NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
audit_file_dest string /u01/app/oracle/admin/orcl/adu
mp
audit_sys_operations boolean FALSE
audit_syslog_level string
audit_trail string OS
unified_audit_common_systemlog string
unified_audit_sga_queue_size integer 1048576
unified_audit_systemlog string
SQL>
SQL> select username,userhost,to_char(timestamp,'yyyy-mm-dd hh24:mi:ss') "time",action_name from dba_audit_trail;
no rows selected
SQL> select count(*) from aud$;
COUNT(*)
----------
0
2)开审计,使用默认情况
检查当前审计情况:
select username,userhost,to_char(timestamp,'yyyy-mm-dd hh24:mi:ss') "time",action_name from dba_audit_trail;
3)开审计,将默认表空间位置挪向非system表空间