Shulou(Shulou.com)05/31 Report--

This article introduces you how to analyze Oracle SYSDBA audit, the content is very detailed, interested friends can use for reference, hope to be helpful to you.

Oracle SYSDBA auditing is controlled by the initialization parameter audit_sys_operations, which is a static parameter and defaults to false. If it is set to true, the SYSDBA auditing function is turned on.

Enable sysdba auditing

Alter system set audit_sys_operations=true scope=spfile

Restart the database instance takes effect

Shutdown immediate

Startup

At this point, every statement issued by a user who connects to the database as sysdba and sysoper is written to the operating system audit trace so that a complete record of the operation performed by DBA can be recorded.

The target location of sysdba audit records is determined by the system platform, the Windows system is the Windows application log, and the Unix system is determined by the initialization parameter audit_file_dest. The Windows application log can be opened by the Windows event Viewer, which runs eventvwr. The default location for audit_file_dest is $ORACLE_BASE/admin/$ORACLE_SID/adump for 11g databases and $ORACLE_BASE/product/10.2.0/admin/$ORACLE_SID/adump for 10g databases.

The following is the application log in the Windows event Viewer, which records the statements executed by sys:

The following is a record of the audit file in Linux, showing the statements executed by sys:

On how to analyze the Oracle SYSDBA audit to share here, I hope the above content can be of some help to you, can learn more knowledge. If you think the article is good, you can share it for more people to see.

Welcome to subscribe "Shulou Technology Information " to get latest news, interesting things and hot topics in the IT industry, and controls the hottest and latest Internet news, technology news and IT industry trends.