Oracle PL/SQL for DBAs

What Else Does FGA Capture?

In the example query from the audit trial, I selected only the user who issued the SELECT statement and the SQL statement that was actually issued by the user. FGA records more information in the audit trail, most important of which is the time of the action. The TIMESTAMP column in the DBA_FGA_AUDIT_TRAIL view records the timestamp, which you will probably want to view using this format so you can see the full timestamp:

    TO_CHAR(TIMESTAMP,'mm/dd/yyyy hh24:mi:ss')

There are a number of other important columns that can be used to further establish the user’s identity and provide details on the action that was audited, all of which help in accountability and analysis. Key columns in this view include:

DB_USER

User who issued the statement.

SQL_TEXT

SQL statement the user issued.

TIMESTAMP

Time the user performed the action.

OS_USER

Operating system user who connected to the database.

USERHOST

Terminal or client machine from which the user is connected.

EXT_NAME

Sometimes the user is externally authenticated—for example, via LDAP; in such cases, the username in the external authentication mechanism is relevant and is captured in this column.

SQL_BIND

Values of the bind variables used in the query, if any.