Oracle PL/SQL for DBAs

What Is Auditing?

One of the basic requirements of computer security is accountability , that is, tracking the activities of users in such a way that you will be able to later associate specific actions with specific users. Oracle’s way of achieving accountability is through its auditing feature, which tracks users’ actions—in other words, who did what. Suppose that a user Scott issues this statement:

    SELECT * FROM emp;

With proper auditing settings, the database will record the fact that Scott selected something from the table EMP, along with a host of other information—the time of the access, the particular terminal he used, and more. This information, known as an audit trail, can be used to investigate Scott’s actions, if need be, in the future. Because the audit trail is owned by user SYS, ordinary users cannot alter the contents of the table, and hence cannot hide their tracks. The traditional Oracle audit trail is stored in the database table AUD$, owned by SYS, and information in it is made available through data dictionary views such as DBA_AUDIT_TRAIL. Audit trails can also be written to operating system files instead of to database tables.

Tip

By default, the statements issued by the user SYS are not audited. If you want to audit SYS objects as well, you have to set the database initialization parameter AUDIT_SYS_OPERATIONS to TRUE. However, in that case, the audit records are written to operating system files, not to database tables. As a general rule of thumb, you should ...