文章版权所有 Jusin Hao（luckyfriends） ，支持原创，转载请注明

1.1.1.1.           迁移审计表到新表空间

---创建存放审计记录的表空间

create tablespace erptbs_audit datafile '/u02/LUCKY/erptbs_audit_01.dbf' size 200M autoextend on maxsize 5G;

---将审计表及其索引存放到新的表空间

select * from dba_indexes a where a.table_name IN ('AUD$','AUDIT$','AUDIT_ACTIONS');

alter table aud$ move tablespace erptbs_audit;

alter index I_aud1 rebuild online tablespace erptbs_audit;

alter table audit$ move tablespace erptbs_audit;

alter index i_audit rebuild online tablespace erptbs_audit;

alter table audit_actions move tablespace erptbs_audit;

alter index i_audit_actions rebuild online tablespace erptbs_audit;

select * from dba_segments a where a.segment_name in ('AUD$','AUDIT$','AUDIT_ACTIONS');

1.1.1.2.           审计LUCKY登录失败

SQL> select * from v$version where rownum<3;

 BANNER

----------------------------------------------------------------

Oracle Database 10g Enterprise Edition Release 10.2.0.5.0 - 64bi

PL/SQL Release 10.2.0.5.0 - Production

 SQL> show parameter audit

NAME                                 TYPE        VALUE

------------------------------------ ----------- ------------------------------

audit_file_dest                      string      /u01/app/oracle/admin/lsdb/adump

audit_sys_operations                 boolean     FALSE

audit_syslog_level                   string     

audit_trail                          string      NONE

SQL> alter system set audit_trail=DB scope=spfile;

SQL> shutdown immediate

SQL> startup

SQL> show parameter audit

NAME                                 TYPE        VALUE

------------------------------------ ----------- ------------------------------

audit_file_dest                      string      /u01/app/oracle/admin/lsdb/adu

                                                 mp

audit_sys_operations                 boolean     FALSE

audit_syslog_level                   string

audit_trail                          string      DB

---只审计LUCKY用户的失败登录

SQL> audit session by LUCKY whenever not successful;

C:\>sqlplus LUCKY/1@lsdb_81

SQL*Plus: Release 11.2.0.3.0 Production on 星期四 6月 5 14:20:35 2014

Copyright (c) 1982, 2011, Oracle.  All rights reserved.

ERROR:

ORA-01017: invalid username/password; logon denied

请输入用户名:  ^C

select os_username,username,userhost,terminal,timestamp,owner,obj_name,action_name,sessionid,os_process,sql_text from dba_audit_trail;

SQL> select * from dba_stmt_audit_opts;

 USER_NAME         PROXY_NAME   AUDIT_OPTION                             SUCCESS    FAILURE

------------------------------ ------------------------------ ------------------------

LUCKY                    CREATE SESSION                           NOT SET    BY ACCESS

SQL> select * from DBA_PRIV_AUDIT_OPTS;

 USER_NAME      PROXY_NAME         PRIVILEGE         SUCCESS    FAILURE

------------------------------ ------------------------------ ------------------------

LUCKY                       CREATE SESSION      NOT SET    BY ACCESS