| expanding audit trail information [message #345208] |
Tue, 02 September 2008 10:52  |
earniep
Messages: 4
Registered: September 2008
Location: Aruba
|
Junior Member |
|
|
Hi all,
my name is earnie, and i'm a oracle dba.
The company for which i work for gave me recently the task to setup a auditing trail for all users who log into the database server.So i did that and set a auditing on all sessions.
The kind of auditing is operating system based, meaning that every thing is being logged to the syslog server locally witch in turn sends all information to a remote syslog server.
Every thing works fine, but the only problem is that the audit trail functionality that oracle uses doesn't log wich program the user (client) uses to connect to the database.
The question that i have is if there is a way i can include this information whatsoever to the auditing trail log?? i noticed that the sys.aud$ doesn't include a 'PROGRAM' column.
An example of the logs I'm getting u can see below
Sep 2 10:05:33 servername user:alert Oracle Audit[598190]: SESSIONID: "2786212"
ENTRYID: "1"
STATEMENT: "1"
USERID: "EARNIEP"
USERHOST: "client"
TERMINAL: "pts/0"
ACTION: "100"
RETURNCODE: "0"
COMMENT$TEXT: "Authenticated by: DATABASE"
OS$USERID: "oracle"
PRIV$USED: 5
but no PROGRAM to be seen...
thank you for your help in advanced
regards,
Earnie
|
|
|
|
|
|
|
|
|
|
| Re: expanding audit trail information [message #345237 is a reply to message #345218] |
Tue, 02 September 2008 12:55  |
earniep
Messages: 4
Registered: September 2008
Location: Aruba
|
Junior Member |
|
|
Hey peeps,
You told me that i can use a after logon trigger, but that doesn't solve the fact that it must log it to the syslog..how can i do that simultaneously...
The commands a used so far are..
audit_syslog_level string
SQL> ALTER SYSTEM SET audit_trail=OS SCOPE=SPFILE;
System altered.
SQL> ALTER SYSTEM SET audit_syslog_level='USER.ALERT' SCOPE=SPFILE;
audit insert, update, delete on sys.aud$ by access;
audit session ;
audit create user by access;
audit alter user by access;
audit profile by access;
audit system grant by access;
How can i put the audit session to log programs etc..
I'm not a expert for that matter..
thank you
|
|
|
|
|
|
|
|
| Re: expanding audit trail information [message #345246 is a reply to message #345242] |
Tue, 02 September 2008 13:37 |
 |
Michel Cadot
Messages: 68732
Registered: March 2007
Location: Saint-Maur, France, https...
|
Senior Member
Account Moderator |
|
|
1. Right
2. Wrong, you can extract it from v$session but you have to use your owne trigger and this information is not reliable as client can put it what it wants (so my question you still didn't answer)
3. Did you search another way?
Regards
Michel
[Updated on: Tue, 02 September 2008 13:39] Report message to a moderator |
|
|
|
|
|
|
|
] 
Blog
Search
Help
Members
Register
Login
Home
)