Re: AUDITing

From: Suzy Vordos <lvordos_at_uswest.com>
Date: Fri, 18 Aug 2000 12:45:30 -0600
Message-Id: <10593.115001@fatcity.com>

I also have difficulty remembering the details of auditing.. here are some notes to myself, maybe this will help.

LISTING ACTIVE AUDIT OPTION LEVELS

---

Three audit option levels, can be set BY ACCESS or BY SESSION

statement - SQL statements
  SELECT * FROM sys.dba_stmt_audit_opts;

privilege - system privilege (eg, create table)   SELECT * FROM sys.dba_priv_audit_opts;

object - statements on objects (alter, delete, execute, insert, select, update)
  SELECT * FROM sys.dba_obj_audit_opts WHERE owner = 'VGN' ;   SELECT * FROM all_def_audit_opts;

To list AUDIT SESSION information:
  SELECT username, logoff_time, logoff_lread, logoff_pread, logoff_lwrite,
  logoff_dlock FROM sys.dba_audit_session;

  SELECT username, to_char(timestamp,'MM-DD-RRRR HH24:MI:SS'), action_name,
  to_char(logoff_time,'MM-DD-RRRR HH:MI:SS')   from sys.dba_audit_session where username = 'VGN'   order by 4 ;

The character "-" indicates that the audit option is not set.
The character "S" indicates that the audit option is set, BY SESSION.
The character "A" indicates that the audit option is set, BY ACCESS.

Charlie Mengler wrote:
>
> On a V7.3.4 Oracle instance what would a query look like
> to generate a report that shows what "AUDIT" statements
> or object are currently enabled?
>
> Another way of asking the same thing is assume that one
> has an existing instance and over its life numerous AUDIT
> commands have been issued against it. Now also assume
> that you desired to impose the current auditing onto
> a similar but different instance. I'm looking for a
> way to automate the (re)generation of the actual AUDIT
> commands & a way to procedurally compare the two DBs
> periodically to ensure that the AUDITs between the
> two remain in synch.
>
> I just can't seem to find where the AUDIT information
> is stored within Oracle. Of course I just may need
> more coffee. It appears to me that the DBA_AUDIT_*
> views & the USER_AUDIT_* views are views that look
> into the AUD$ table where records resulting from
> actual audit events get recorded. I don't think
> that these tables contain the data I desire because
> auditing for certain user, or statement could be
> enabled but has not been reported because no event
> occurred to result in an audit record.
>
> TIA!
>
> --
> Charlie Mengler Maintenance Warehouse
> charliem_at_mwh.com 10641 Scripps Summit Ct
> 858-831-2229 San Diego, CA 92131
> Ready, Fire, Aim; is a sure way to fail as a DBA!
> --
> Author: Charlie Mengler
> INET: charliem_at_mwh.com
>
> Fat City Network Services -- (858) 538-5051 FAX: (858) 538-5051
> San Diego, California -- Public Internet access / Mailing Lists
> --------------------------------------------------------------------
> To REMOVE yourself from this mailing list, send an E-Mail message
> to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in
> the message BODY, include a line containing: UNSUB ORACLE-L
> (or the name of mailing list you want to be removed from). You may
Received on Fri Aug 18 2000 - 13:45:30 CDT