Re: Sarbanes-Oxley

Hi Daniel,

I can think of one way, which is not particularly practical. You could sniff the network traffic to the server and extract the SQL, DDL and connections to and from it. To do so you would need to sit directly in front of the server hosting the database. You would need to extract the time, user and the SQL from the packets and ideally store them in another database for querying. You could use a packet sniffer or possibly SQL*Net trace on the server.

Don't forget about SQL*net logs and the listener log to get connections.

There are commercial products available that already do this. I don't know the licence costs of them. There is Chakra from OR Solutions, Guardium SQL Guard from Guardium, Entregra for Oracle from Lumigent, Zeus Extensible Traffic Manager from Zeus technology and also Integrigy and Application security Inc are both about to release IDS / firewall type products which slightly less fill the bill. There are links to all of these on my tools page in the commercial section - see http://www.petefinnigan.com/tools.htm

A possible other way would be to poll the SGA and extract the SQL, but this method could "lose" SQL if you do not poll fast enough and also would hurt the database. It is possible to do the same by reading the SGA directly with C programs. Writing a program to just extract SQL would not be that difficult. There are commercial tuning products that do this (access the SGA directly) but whether you can stream the SQL out of them or not, i am not sure. There are some papers on direct SGA access on my site at http://www.petefinnigan.com/other.htm - I also talked about the same in my Oracle security web log recently - see http://www.petefinnigan.com/weblog/entries/index.htm

hope this helps a bit,

kind regards

Pete

-- 
Pete Finnigan (email:pete_at_petefinnigan.com)
Web site: http://www.petefinnigan.com - Oracle security audit specialists
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
Book:Oracle security step-by-step Guide - see http://store.sans.org for details.