What Else Does FGA Capture?
In the example query from the audit trial, I selected only the user who issued the SELECT statement and the SQL statement that was actually issued by the user. FGA records more information in the audit trail, most important of which is the time of the action. The TIMESTAMP column in the DBA_FGA_AUDIT_TRAIL view records the timestamp, which you will probably want to view using this format so you can see the full timestamp:
TO_CHAR(TIMESTAMP,'mm/dd/yyyy hh24:mi:ss')
There are a number of other important columns that can be used to further establish the user’s identity and provide details on the action that was audited, all of which help in accountability and analysis. Key columns in this view include:
- DB_USER
User who issued the statement.
- SQL_TEXT
SQL statement the user issued.
- TIMESTAMP
Time the user performed the action.
- OS_USER
Operating system user who connected to the database.
- USERHOST
Terminal or client machine from which the user is connected.
- EXT_NAME
Sometimes the user is externally authenticated—for example, via LDAP; in such cases, the username in the external authentication mechanism is relevant and is captured in this column.
- SQL_BIND
Values of the bind variables used in the query, if any.