第65讲：Chapter 18--Auditing

参考文献：ORACLE DATABASE Security Guide (B28531-03)
                    第六章 CONFIGRING AUDITING

一、介绍
         Auditing is the monitoring of selected user database actions:
        1. 调查、收集指定数据库操作
        2. 收集特定数据库操作的信息
        3. Auditing can be performed by session(distinct operate) or access(all operate)
        ORACLE多用户系统，管理人员对用户的操作进行监控。
        alert trace 是ORACLE自身的日志文件，但是修改数据，修改表oracle只可以通过Auditing进行记录
   
二、审计的分类
    1. Standard auditing
       SQL statements, privileges, schemas, objects, and network and multitier activity.
       Standard audit records are written to :
       SYS.AUD$ system table -> DBA_AUDIT_TRAIL
                                                    -> DBA_COMMON_AUDIT_TRAIL
       OPERATING SYSTEM FILES
   
       a. STATEMENT(特定sql语句,动作)
          Audites specific SQL statements or groups of statements that affect a particular type of database object.
          e.g.  SQL> AUDIT TABLE (CREATE TABLE, TRUNCATE TABLE, COMMENT ON TABLE , DELETE FROM TABLE)      
                  SQL> NOAUDIT TABLE
       b. PRIVILEGE
          Audits SQL statements the are authorized by system privilege.
          e.g.  SQL> AUDIT CREATE ANY TRIGGER 
                   SQL> NOAUDIT CREATE ANY TRIGGER    
       c. OBJECT(特定对象)
          Audits specific statements on specific objects
          e.g.  SQL> AUDIT SELECT ON HR.EMPLOYEES  
                  SQL> NOAUDIT SELECT ON HR.EMPLOYEES    
       d. NETWORK 
      
    2. Fine-grained auditing
       specific activities,基于条件内容的审计
       a. SYS.FGA_LOG$ -> DBA_FGA_AUDIT_TRAIL
                                          -> DBA_COMMON_AUDIT_TRAIL
                      
    3. Administrator auditing
       activities of system administrators(sys, sysdba, sysoper) by using the syslog audit trail
       a. Auditing user SYS provides:
          Extra level of security
          SET AUDIT_SYS_OPERATIONS = TRUE

三、开启审计
    1. Audit options(打开审计开关)
       SQL> SHOW PARAMETER AUDIT
            AUDIT_TRAIL (NONE:不审计; DB:数据库级；OS:OS级别)
       SQL> ALTER SYSTEM SET AUDIT_TRAIL=DB SCOPE=SPFILE;(静态参数)
       SQL> select * from AUD$
             
    2. Enable database auditing(设置审计条件)
       SQL> AUDIT SESSION BY USER1;          
   
    3. Check Audit trail(检查审计结果)
       SQL> SELECT username, timestamp, action_name FROM DBA_AUDIT_TRAIL
            USERNAME           TIMESTAMP         ACTION_NAME
            --------           --------          ---------
              USER1            10-FEB-10          LOGON
  
四、审计的属性
    1. AUDITED BY DEFAULT
       a. instance startup and instance shutdown
       b. administrator privileges
       default auditing log 存放路径：audit_file_dest -> $ORACLE_HOME/rdbms/audit
    2. Database auditing
       a. enabled by the dba
       b. cannot record column values
    3. value-based or application auditing
       a. implemented through code
       b. can record column values
       c. used to track changes to tables

五、审计的数据字典
    审计类型，审计对象:
    a. ALL_DEF_AUDIT_OPTS(审计类型，审计对象)
    b. DBA_STMT_AUDIT_OPTS
    c. DBA_PRIV_AUDIT_OPTS
    d. DBA_OBJ_AUDIT_OPTS
    审计后的结果：
    a. DBA_AUDIT_TRAIL(总表) 基表AUD$
    b. DBA_AUDIT_EXISTS
    c. DBA_AUDIT_OBJECT
    d. DBA_AUDIT_SESSION
    e. DBA_AUDIT_STATEMENT

参考链接：http://www.boo booke.com/bbs/viewthread.php?tid=7630&extra=page%3D1

audit.JPG