FGA Compared with Regular Auditing
Starting with Oracle Database 10g Release 1, Oracle’s regular auditing (using the AUDIT command) has been enhanced so that it captures more information than it did in previous releases—for example, the text of the SQL statement issued, the bind variables, and more. In many respects it looks identical to FGA. Does it, therefore, obviate the need for FGA? Not at all. Let’s look at the differences between regular and fine-grained auditing.
- Types of statements
Regular auditing can track many different types of statements—DML, DDL, session control statements, privilege management statements, and so on. FGA, on the other hand, can track only one statement (SELECT) in Oracle9i Database and four (SELECT, INSERT, UPDATE, DELETE) in Oracle Database 10g.
- Special parameters
FGA runs out of the box without requiring any special parameters. The FGA_LOG$ table, the repository for FGA audit entries, is already present in the SYS schema. In contrast, regular auditing must first be enabled at the database level before individual objects can be audited. You do this by setting the initialization parameter AUDIT_TRAIL. Because this parameter is not dynamic, you must also restart the database for it to take effect.
- Success or failure
Regular auditing can be set up so that auditing is done regardless of the success or failure of the user’s action. With FGA, tracking is done only if the action is successful.
- Disable/enable
FGA can be temporarily disabled and enabled ...