OracleConnections

Oracle Community Network

Auditing tha auditor

Hi all,

11.2.0.3

I want to audit all the actions being done by the user "sys" and "system" and all other users with DBA privilege. Especially the action when they delete or truncate the SYS.$AUD table.
I read in the docs that they are audited by default? Is truncating the SYS.$AUD included? Is there a simple command for this?

Thanks a lot

0 members like this

▶ Reply to This

Replies to This Discussion

Permalink Reply by Richard Hames on July 25, 2013 at 9:20am

unwilling or incapable to actually use GOOGLE yourself?

http://www.lmgtfy.com/?q=Oracle+audit+sys+user

▶ Reply

Permalink Reply by Matthew Perry on July 25, 2013 at 9:23am

The Oracle security guidelines said:

1.1 Log the following events in the audit log
1.1.1 ALTER ANY PROCEDURE
1.1.2 ALTER ANY TABLE
1.1.3 ALTER DATABASE
1.1.4 ALTER PROFILE
1.1.5 AUDIT ROLE BY ACCESS
1.1.6 ALTER SYSTEM
1.1.7 ALTER USER
1.1.8 AUDIT SYSTEM
1.1.9 AUDIT SYSTEM BY ACCESS
1.1.10 CREATE ANY JOB
1.1.11 CREATE ANY LIBRARY
1.1.12 CREATE ANY PROCEDURE
1.1.13 CREATE ANY TABLE
1.1.14 CREATE EXTERNAL JOB
1.1.15 CREATE PUBLIC DATABASE LINK
1.1.16 CREATE SESSION
1.1.17 CREATE USER
1.1.18 DROP ANY PROCEDURE
1.1.19 DROP ANY TABLE
1.1.20 DROP PROFILE
1.1.21 DROP USER
1.1.22 EXEMPT ACCESS POLICY
1.1.23 GRANT ANY OBJECT PRIVILEGE
1.1.24 GRANT ANY PRIVILEGE
1.1.25 GRANT ANY ROLE