1、审计的功能：监控用户在database 的 action （操作）
2、审计分类：
1） session ：在同一个session，相同的语句只产生一个审计结果（默认）
2） access ： 在同一个session，每一个语句产生一个审计结果
3、启用审计（默认不启用）
SYS@LGR> show parameter audit; NAME TYPE VALUE ------------------------------------ ----------- ------------------------------ audit_file_dest string /u01/app/oracle/admin/lgr/adum p audit_sys_operations boolean FALSE audit_syslog_level string audit_trail string NONE SYS@LGR> alter system set audit_trail=db scope=spfile; System altered. SYS@LGR> startup force; ORACLE instance started. Total System Global Area 835104768 bytes Fixed Size 2257840 bytes Variable Size 536874064 bytes Database Buffers 289406976 bytes Redo Buffers 6565888 bytes Database mounted. Database opened. SYS@LGR> show parameter audit; NAME TYPE VALUE ------------------------------------ ----------- ------------------------------ audit_file_dest string /u01/app/oracle/admin/lgr/adum p audit_sys_operations boolean FALSE audit_syslog_level string audit_trail string DB --audit_trail 1）none 不启用audit 2）db 将审计结果放在数据字典里（database），只有dba 可以访问 3）os 将审计结果存放到操作系统的文件里（由audit_file_dest指定的位置） --启用audit ，默认不审计sys用户的action audit_sys_operations=true ，启用对于sys 用户的审计
4、审计的对象：（默认情况：session ，对所有用户（除了sys），对成功和不成功的同时审计)
1）语句审计
SYS@LGR> audit table; Audit succeeded. SYS@LGR> audit table by LGR whenever successful; Audit succeeded ----------查看审计设置 SYS@LGR> select user_name,audit_option from dba_stmt_audit_opts; USER_NAME AUDIT_OPTION ------------------------------ --------------------------- TABLE
2）权限审计
SYS@LGR> audit create table; Audit succeeded.
3）对象审计
SYS@LGR> audit all on scott.emp; Audit succeeded.
4）精细审计Fine Grained Auditing (FGA)
--建立审计策略 SYS@LGR> exec dbms_fga.add_policy(object_schema=>'scott',- > object_name=>'emp',policy_name=>'chk_emp',- > audit_condition =>'deptno=20',audit_column =>'sal',- > statement_types =>'update,select'); PL/SQL procedure successfully completed. SCOTT@LGR> select * from emp; EMPNO ENAME JOB MGR HIREDATE SAL COMM DEPTNO ----- ---------- --------- ---------- --------- ---------- ---------- ---------- 7369 SMITH CLERK 7902 17-DEC-80 800 20 7499 ALLEN SALESMAN 7698 20-FEB-81 1600 300 30 7521 WARD SALESMAN 7698 22-FEB-81 1250 500 30 7566 JONES MANAGER 7839 02-APR-81 2975 20 7654 MARTIN SALESMAN 7698 28-SEP-81 1250 1400 30 7698 BLAKE MANAGER 7839 01-MAY-81 2850 30 7782 CLARK MANAGER 7839 09-JUN-81 2450 10 7788 SCOTT ANALYST 7566 19-APR-87 3000 20 7839 KING PRESIDENT 17-NOV-81 5000 10 7844 TURNER SALESMAN 7698 08-SEP-81 1500 0 30 7876 ADAMS CLERK 7788 23-MAY-87 1100 20 7900 JAMES CLERK 7698 03-DEC-81 950 30 7902 FORD ANALYST 7566 03-DEC-81 3000 20 7934 MILLER CLERK 7782 23-JAN-82 1300 10 14 rows selected. SCOTT@LGR> select * from emp where deptno=20; EMPNO ENAME JOB MGR HIREDATE SAL COMM DEPTNO ----- ---------- --------- ---------- --------- ---------- ---------- ---------- 7369 SMITH CLERK 7902 17-DEC-80 800 20 7566 JONES MANAGER 7839 02-APR-81 2975 20 7788 SCOTT ANALYST 7566 19-APR-87 3000 20 7876 ADAMS CLERK 7788 23-MAY-87 1100 20 7902 FORD ANALYST 7566 03-DEC-81 3000 20 SCOTT@LGR> update emp set deptno=10 where empno=7788; 1 row updated. SCOTT@LGR> update emp set sal=8000 where empno=7788; 1 row updated. SCOTT@LGR> update emp set sal=8000 where deptno=20; 4 rows updated. SCOTT@LGR> commit; Commit complete. --禁止精细审计 SYS@LGR> exec dbms_fga.disable_policy(- > object_schema=>'scott',object_name=>'emp',- > policy_name=>'chk_emp'); PL/SQL procedure successfully completed. SYS@LGR> --激活精细审计 SYS@LGR> exec dbms_fga.enable_policy(- object_schema=>'scott',object_name=>'emp',- > > policy_name=>'chk_emp'); PL/SQL procedure successfully completed. SYS@LGR> --删除FGA策略 PL/SQL procedure successfully completed. SYS@LGR> exec dbms_fga.drop_policy(- > object_schema=>'scott',object_name=>'emp',- > policy_name=>'chk_emp'); PL/SQL procedure successfully completed. SYS@LGR> --删除精细审计的结果 SYS@LGR> delete from sys.fga_log$;
5）应用审计（通过触发器来实现）
用于记载DML操作所引起的数据变化
1）建立审计表
11:37:32 SQL> conn scott/tiger Connected. create table audit_emp_change ( 04:20:47 2 name varchar2(10),oldsal number(6,2), 04:21:12 3 newsal number(6,2) ,time date); Table created.
2）建立DML 触发器
04:26:47 SQL> l 1 create or replace trigger tr_sal_change 2 after update of sal on scott.emp 3 for each row 4 declare 5 v_temp int; 6 begin 7 select count(*) into v_temp from audit_emp_change 8 where name=:old.ename; 9 if v_temp=0 then 10 insert into audit_emp_change 11 values(:old.ename,:old.sal,:new.sal,sysdate); 12 else 13 update audit_emp_change 14 set oldsal=:old.sal ,newsal=:new.sal ,time=sysdate 15 where name=:old.ename; 16 end if; 17* end; /
3）执行DML操作
04:28:02 SQL> update scott.emp set sal=6000 where empno=7788; 1 row updated.
4）查看审计结果
04:28:35 SQL> select name,oldsal,newsal, 04:28:46 2 to_char(time,'YYYY-MM-DD HH24:MI') FROM AUDIT_EMP_CHANGE; NAME OLDSAL NEWSAL TO_CHAR(TIME,'YY ---------- ---------- ---------- ---------------- SCOTT 2000 6000 2011-03-03 04:28 09:40:03 SQL> r 1* select TRIGGER_NAME,TRIGGER_TYPE,TABLE_NAME,COLUMN_NAME,status,TRIGGER_BODY from user_triggers TRIGGER_NAME TRIGGER_TYPE TABLE_NAME COLUMN_NAM STATUS TRIGGER_BODY -------------------- ---------------- ---------- ---------- -------- ---------------------------------------- TR_SAL_CHANGE AFTER EACH ROW EMP ENABLED declare v_temp int; begin select count(*) into v_temp from