I have no choice but to implement Oracle database auditing. I have to
retain
audit data for 8 years for legal reasons. My questions are:
- I presume, I can alter sys.aud$ table storage parameters to hold a
large amount of data.
- If sys.aud$ table extends to several giga bytes. will it create
any performance problems for database operations. As sys.aud$ table
grows, performance of inserts in this table should not change all that
much.
- Is it possible to keep sys.aud$ in tablespace other than system. I
am using Oracle8i. I have read conflicting articles on keeping
sys.aud$ table in non system tablespaces (some articles say, it is not
Oracle supported but it can
still be done).
- I presume when I look in sys.aud$ using Oracle's commands, there
are indexes on this table so I should be able to look at the
information fast.
- I know some people periodically move data from sys.aud$ table to
some other table. My question is if I move data to some other table
can I still use
Oracle's audit commands/views to search into new tables or I have to
write my
own scripts.
- I want to do some minimal security auditing for Sarbanes Oxley
compliance,
does any one have recommendations what "events" to audit. Right now, I
have
been told to audit loon/logoff, any structural changes to database,
any password
changes, profile changes.
Appreciate your answers,
Prem
Certified Oracle 8, 8i and 9i DBA
Received on Wed Jun 16 2004 - 15:10:47 CDT
