Oracle上の監査情報取得についてメモ。

設定の確認

SQL> SHOW PARAMETER AUDIT_TRAIL;

NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
audit_trail                          string      DB

SQL>

設定の変更

SQL> ALTER SYSTEM SET AUDIT_TRAIL=NONE SCOPE=SPFILE;

システムが変更されました。

SQL>

SQL> SHOW PARAMETER AUDIT_TRAIL;

NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
audit_trail                          string      NONE
SQL>

監査ファイル保存場所

SQL> SHOW PARAMETER AUDIT_FILE_DEST

NAME                                 TYPE        VALUE
--------------------- ----------- ------------------------------
audit_file_dest       string      C:\APP\ADMINISTRATOR\ADMIN\ORCL\ADUMP
                                                 
SQL>

監査対象アクションの確認

SQL> SELECT * FROM DBA_STMT_AUDIT_OPTS;

USER_NAME  PROXY_NAME   AUDIT_OPTION                 SUCCESS    FAILURE
---------- ------------ ---------------------------- ---------- ----------
                        ALTER SYSTEM                 BY ACCESS  BY ACCESS
                        SYSTEM AUDIT                 BY ACCESS  BY ACCESS
                        CREATE SESSION               BY ACCESS  BY ACCESS
                        CREATE USER                  BY ACCESS  BY ACCESS
                        ALTER USER                   BY ACCESS  BY ACCESS
                        DROP USER                    BY ACCESS  BY ACCESS
                        PUBLIC SYNONYM               BY ACCESS  BY ACCESS
                        DATABASE LINK                BY ACCESS  BY ACCESS
                        ROLE                         BY ACCESS  BY ACCESS
                        PROFILE                      BY ACCESS  BY ACCESS
                        CREATE ANY TABLE             BY ACCESS  BY ACCESS
                        ALTER ANY TABLE              BY ACCESS  BY ACCESS
                        DROP ANY TABLE               BY ACCESS  BY ACCESS
                        CREATE PUBLIC DATABASE LINK  BY ACCESS  BY ACCESS
                        GRANT ANY ROLE               BY ACCESS  BY ACCESS
                        SYSTEM GRANT                 BY ACCESS  BY ACCESS
                        ALTER DATABASE               BY ACCESS  BY ACCESS
                        CREATE ANY PROCEDURE         BY ACCESS  BY ACCESS
                        ALTER ANY PROCEDURE          BY ACCESS  BY ACCESS
                        DROP ANY PROCEDURE           BY ACCESS  BY ACCESS
                        ALTER PROFILE                BY ACCESS  BY ACCESS
                        DROP PROFILE                 BY ACCESS  BY ACCESS
                        GRANT ANY PRIVILEGE          BY ACCESS  BY ACCESS
                        CREATE ANY LIBRARY           BY ACCESS  BY ACCESS
                        EXEMPT ACCESS POLICY         BY ACCESS  BY ACCESS
                        GRANT ANY OBJECT PRIVILEGE   BY ACCESS  BY ACCESS
                        CREATE ANY JOB               BY ACCESS  BY ACCESS
                        CREATE EXTERNAL JOB          BY ACCESS  BY ACCESS

28行が選択されました。

SQL>

追加

SQL> audit session;

監査が成功しました。

SQL>
SQL> SELECT * FROM DBA_STMT_AUDIT_OPTS WHERE AUDIT_OPTION LIKE '%SESSION%';

USER_NAME  PROXY_NAME   AUDIT_OPTION                 SUCCESS    FAILURE
---------- ------------ ---------------------------- ---------- ----------
                        CREATE SESSION               BY ACCESS  BY ACCESS



SQL>

削除

SQL> noaudit session;

監査取消しが成功しました。

SQL>
SQL> SELECT * FROM DBA_STMT_AUDIT_OPTS WHERE AUDIT_OPTION LIKE '%SESSION%';

レコードが選択されませんでした。

SQL>