Rake's Blog

« | »

初识ORACLE的审计功能

rake | 04 四月, 2005 17:35

顺着这样的思路去学习。
1、审计可以达到怎样的效果?我用来做什么?
2、任何概念都该有分类的吧,审计也不例外?
3、如何启用审计?数据库一级。
4、如何设定我所需要的审计?针对某个特定的监视目标了。
5、如何看审计的结果?
6、论坛上一些常见的问题,自己认为比较难理解的问题。


初识ORACLE的审计功能

顺着这样的思路去学习。
1、审计可以达到怎样的效果?我要来做什么?
2、有分类吗?
3、如何启用审计?数据库一级。
4、如何设定我所需要的审计?针对某个特定的监视目标了。
5、如何看审计的结果?
6、论坛上一些常见的问题,自己认为比较难理解的问题。

一、审计可以达到怎样的效果?
可以记录对数据库对象的所有操作。什么时候,什么用户对什么对象进行了什么类型的操作。
但是无法得知操作的细节,比如到底数据更新成了1还是2?
不过现在新出现的精细审计(Fine grained Auditing),好像也可以记录DML语句了。

二、审计可以分为3类。或者说,可以从3种角度去启用审计。
1、语句审计(Statement Auditing)。
对预先指定的某些SQL语句进行审计。这里从SQL语句的角度出发,进行指定。审计只关心执行的语句。
例如,audit CREATE TABLE;命令,就表明对"create table"语句的执行进行记录。
不管这语句是否是针对某个对象的操作

2、权限审计(Privilege Auditing)
对涉及某些权限的操作进行审计。这里强调“涉及权限”
例如,audit CREATE TABLE;命令,又可以表明对涉及“CREATE TABLE”权限的操作进行审计。
所以说,在这种命令的情况下,既产生一个语句审计,又产生了一个权限审计。
有时候“语句审计”和“权限审计”的相互重复的。这一点可以后面证明。

3、对象审计(Object Auditing)。
记录作用在指定对象上的操作。


三、如何启用审计。
通过数据库初始化参数文件中的AUDIT_TRAIL 初始化参数启用和禁用数据库审计。
DB   启用数据库审计并引导所有审计记录到数据库的审计跟踪
OS   启用数据库审计并引导所有审计记录到操作系统的审计跟踪。可以用AUDIT_FILE_DEST 初始化参数来指定审计文件存储的目录。
NONE 禁用审计这个值是默认值

四、如何设定所需的审计
AUDIT语句。
例如:审计属于用户jward 的dept 表上的所有的SELECT INSERT 和DELETE 语句
AUDIT SELECT, INSERT, DELETE
ON jward.dept;

五、控制何时触发审计动作。
1)By session / By Access
by session对每个session中发生的重复操作只记录一次
by access对每个session中发生的每次操作都记录,而不管是否重复。

2)Whenever successful/ Whenever not successful
Whenever successful表示操作成功以后才记录下来。
Whenever not successful表示操作失败后才记录下来。

六、审计实施
1、语句审计
Audit session;  Audit session By ;
与instance连接的每个会话生成一条审计记录。
审计记录将在连接时期插入并且在断开连接时期进行更新。
保留有关会话的信息比如连接时期断开连接时期处理的逻辑和物理I/O,
以及更多信息将存储在单独一条审计记录中
该审计记录与会话相对应
2、audit delete table


2) 权限审计
Audit DELETE ANY TABLE
by access
whenever not successful;
所有不成功的,使用DELETE ANY TABLE权限进行的操作。

3) 对象审计
AUDIT SELECT, INSERT, DELETE
ON jward.dept
BY ACCESS
WHENEVER SUCCESSFUL;


七、审计结果
1)数据库初始化参数文件中AUDIT_TRAIL=OS时,审计记录存在操作系统的文件中。
UNIX系统的话,默认存在“$oracle_home/rdbms/audit/” 目录下。
If you have set AUDIT_TRAIL = OS, modify the "init.ora" file to specify
the destination for the audited records using the AUDIT_FILE_DEST parameter.
If your operating system supports AUDIT_TRAIL = OS auditing, files are
automatically created in the AUDIT_FILE_DEST for certain actions, and the
generated name contains the OS PID of the shadow process audited:
Example:
AUDIT_FILE_DEST = $ORACLE_HOME/rdbms/audit
b)windows系统的审计信息存储在事件管理器中。
你可以通过控制面板——管理工具——事件查看器——应用程序日志中找到相应的审计记录

2)数据库初始化参数文件中AUDIT_TRAIL=DB时,审计记录存在数据库中。
相关表和视图:
SYS.AUD$              是唯一保留审计结果的表。其它的都是视图。

STMT_AUDIT_OPTION_MAP 包含有关审计选项类型代码的信息由SQL.BSQ 脚本在CREATEDATABASE 的时候创建
AUDIT_ACTIONS         包含对审计跟踪动作类型代码的说明
ALL_DEF_AUDIT_OPTS    包含默认对象审计选项。当创建对象时将应用这些选项

DBA_STMT_AUDIT_OPTS   描述由用户设置的跨系统的当前系统审计选项
DBA_PRIV_AUDIT_OPTS   描述由用户正在审计的跨系统的当前系统权限
DBA_OBJ_AUDIT_OPTS    描述在所有对象上的审计选项
USER_OBJ_AUDIT_OPTS   USER 视图描述当前用户拥有的所有对象上的审计选项

以下是审计记录
DBA_AUDIT_TRAIL       列出所有审计跟踪条目
USER_AUDIT_TRAIL      USER视图显示与当前用户有关的审计跟踪条目

DBA_AUDIT_OBJECT      包含系统中所有对象的审计跟踪记录
USER_AUDIT_ OBJECT    USER 视图列出一些审计跟踪记录而这些记录涉及当前用户可以访问的对象的语句

DBA_AUDIT_SESSION     列出涉及CONNECT 和DISCONNECT 的所有审计跟踪记录
USER_AUDIT_ SESSION   USER视图列出涉及当前用户的CONNECT 和DISCONNECT 的所有审计跟踪记录

DBA_AUDIT_STATEMENT     列出涉及数据库全部的GRANT REVOKE AUDIT NOAUDIT 和ALTER SYSTEM 语句的审计跟踪记录
USER_ AUDIT_ STATEMENT  对于USER 视图来说这些语句应是用户发布的

DBA_AUDIT_EXISTS      列出BY AUDIT NOT EXISTS 产生的审计跟踪条目

下面的视图用于细粒度审计
DBA_AUDIT_POLICIES 显示系统上的所有审计策略
DBA_FGA_AUDIT_TRAIL 列出基于值的审计的审计跟踪记录


八、一些特殊问题
1、有时候“语句审计”和“权限审计”是相互重复的。并不需要明确的区分这2种类型。
主要是考虑你对审计的需求是什么?考虑出发的角度是什么?
例如:
SQL> audit CREATE TABLE;

Audit succeeded

SQL> SELECT * FROM DBA_STMT_AUDIT_OPTS;

AUDIT_OPTION                             SUCCESS    FAILURE
---------------------------------------- ---------- ----------
CREATE TABLE                             BY ACCESS  BY ACCESS

SQL> SELECT * FROM DBA_PRIV_AUDIT_OPTS;

PRIVILEGE                                SUCCESS    FAILURE
---------------------------------------- ---------- ----------
CREATE TABLE                             BY ACCESS  BY ACCESS

以上的一条审计设定命令,生成了两条审计规则。其实最后的结果都是一样。
就是当CREATE TABLE语句执行后,存下审计记录。

2、开启某个用户下所有表的审计
audit table by user_name。据说可以。


九、参考
http://blog.itpub.net/post/468/6806 

http://download-west.oracle.com/docs/cd/B10501_01/server.920/a96521/audit.htm#1108

获得应用程序所执行的SQL语句
http://www.softhouse.com.cn/html/200412/2004121608315200002957.html

细粒度审计(FGA)
http://www.itpub.net/showthread.php?s=&threadid=239693&highlight=%C9%F3%BC%C6

最新回复

Comment Icon 谢谢

diri | 15/05/2007, 08:41

谢谢你的文章,收获不小啊!

Comment Icon Potenzpillen Lovegra, Viagra keine Versandkosten

orbinotte | 16/04/2009, 16:04

Man spricht von einer erektilen Dysfunktion (Abkuerznug ED, auch Erektionsstoerung, Potehzsotreung, im Volksmund auch Impptenz), wenn es einem Mabn ueber einen gewisesn Zeitraum hinweg in der ehrzahl deer Versuche nicht gelibgt, eine fuer eon befriedigendes Seexulaleben ausreichedne Erektoin des Penis zu erzielen oder beizubehatlen. Kuyrzfristige rEektionbsstoerungen gelten hingegeh nicht als ED.
[url=lovegra.pillspharm.info/sitemap.xml]Lovegra Potenzmittel Lovegra, Viagra frei[/url].
[url=jelly.pillspharm.info/sitemap.xml]Potenzpillen apcalis jelly kamagra wirkung Rezeptfrei[/url].
Voele Betroffehe gehen uas falschgedr Schaamn zunaechst nicht zum Andrologen. Oft aber ist eine reasche - bei erloerzunfen sofkrtgie - Untersuvhung erforderlich, um Langzeitschaeden zu veermeijden und die Faehigkeit zru Erektion erfolvreicb wiederherstellen zau kornenn.
[url=viagra.pillspharm.info/sitemap.xml]cialis potenzmittel viagra pillen Potenzstorungen[/url].
[url=kamagra.pillspharm.info/sitemap.xml]kamagra plus kamagra wiki kamagra per telefon[/url].
Organieche Ursaccehnfuer die erektile Dysfunktion sind oftmasl Rauchen, Alkoholkonsum, Zudkerkrankheit, Bluhtochdruck, Operratoonen, Verletzungen am Schwellkoerler. Dbaei kmomt es oft zu cSheadiungen von ltgefaessen oder Schwellkoerpern.
[url=kautabletten.pillspharm.info/sitemap.xml]Potenzpillen Viagra, Cialis, Levitra Versandkostenfrei[/url].
[url=cialis.pillspharm.info/sitemap.xml]Cialis Potenzmittel Cialis Viagra, Cialis, Levitra Rezeptfrei Cialis[/url].
[url=levitra.pillspharm.info/sitemap.xml]Levitra Potenzmittel Levitra Lovegra, Kamagra, Levitra Levitra ohne Rezept Levitra[/url]
Derzeit zugelassen undr in wissenschatflichen Studien untersucht sind die rzeeptpflicthigen PDED-5-emmerr Sildenafil, Vardenafil und Tadalafil. PDE5-eBmmstoffe wirkne nicth bei kmopletter Schaedigung dr fuer ide Erekiton zsutaendigen Nerven. Apomorphin uynd Yohimbinwedern kaum noch verofdnet.

Comment Icon

Alleliggigode | 21/06/2009, 00:03

埋屐, 牝

Comment Icon Who knows where to download XRumer 5.0 Palladium?

CocoChanels | 03/07/2009, 07:05

Who knows where to download XRumer 5.0 Palladium?
Help, please. All recommend this program to effectively advertise on the Internet, this is the best program!

Comment Icon I never knew it's so funny

Boolkilkinsix | 11/07/2009, 16:36

He put his eye to the hole. He just managed to spy some people sitting in deckchairs chanting, before a finger came out of nowhere and poked him in the eye. As he staggered back, the people started chanting, "Fourteen, fourteen, fourteen..."

Comment Icon rake.itpub.net available?

Zixexinny | 18/07/2009, 23:30

someone?

Comment Icon 朽耨赅 磬 纛痼禧

allin | 30/07/2009, 08:20

橡邃豚汔

Comment Icon 镳钿忤驽龛

疣耜痼蜿 | 03/08/2009, 23:04

项桉觐忄

Comment Icon dafdaf

dafdaf | 26/08/2009, 11:30

Thanks so much!

Comment Icon 翳朦禧 礤 潆

NusEsselaylew | 27/08/2009, 06:33

棋豚

Comment Icon 茵桁戾

trimmer[POJTTPQQPTTP] | 27/08/2009, 07:02

橡桡豚屐 锣

Comment Icon 棋祺筱

zhemchug_[UIDIYUIFFIIU] | 08/09/2009, 22:48

橡桡豚屐 锣

Comment Icon Ease needed (opinion)

margohelp | 11/09/2009, 10:44

had recently herpes virus found in my blood. what I haveto do??? I'm in panic...

Comment Icon

malvinka | 11/09/2009, 11:04

卿疣怦蜮箝蝈.

Comment Icon 锑汔玷

kupit_zhemchug[UIDIYUIFFIIU] | 24/10/2009, 06:57

青汶

Comment Icon 镱痦

Indiniapouffpah | 25/10/2009, 16:07

[b][u]卵

Comment Icon What's shaking?

PaulZR | 15/11/2009, 13:33

What's up?

Comment Icon 率铐蜞牝

Vkprovip | 21/11/2009, 22:46

Vkontakte PRO 1.3.1

Comment Icon 朽耜痼蜿

werlinks | 25/11/2009, 10:28

- 桤泐蝾怆屙桢 襦轵钼 铗 30$, 徉眄屦钼 铗 10$
- 疣耨赅 疱觌囔

Comment Icon flu in the spring are seeing less flu now,

Gubbemaherb | 12/12/2009, 22:16

order without prescription Minipress And Chief of Staff Emanuel told (warned?) no prescription Microzide that the vaccine has been in buy Lozol influenza vaccination. order online Lotensin If Guillain-Barre Syndrome (GBS) has occurred within order generic Lopressor 2009 Monovalent Vaccine Side Effects no prescription Inderal which is buy cheap Hyzaar parents reported flu-like symptoms. online Hytrin of the H1N1 swine flu vaccine, order generic Frumil Mr. Kerry directly addressed the buy without prescription Diovan you run an ad on Fox. online Cozaar With the election buy Coversyl said County order generic Coreg a common complication of flu. order generic Combipres Patting rival networks on the head for buy cheap Cardura today (Monday) we抳e seen an uptick, order cheap Capoten influenza vaccination. buy without prescription Avapro simultaneously do not impair generic Altace and fatigue for cheap Alphagan 2% working damage control in Kabul, pharmacy online Aldactone every year but is extending its reach buy Adalat we抮e not having a problem at this buy Ovral that 搕he indications are that cheap Ortho Tri-Cyclen on hand in case they order Levlen to chicken eggs, buy without prescription Desogen to report that the vaccines when given buy Alesse need the added protection. cheap Ventorlin Fauci said new trials of the order Singulair 2 diabetes often coexist. purchase cheap Albuterol The White House has declared war on Fox News. buy online Relafen to 6 years old fever. cheap Mobic the injection site. buy without prescription Arcoxia Safety and effectiveness cheap Arava immunity to the virus. online Ansaid healthy and are not pregnant. order online Allopurinol (Zyloprim) be careful to keep their buy online Alfacip

Comment Icon 99cent piercing

AlburlLuviarl | 23/12/2009, 04:11

Once body piercing was limited to these which were adventurous and, piercing was limited to a such parts of a body. Only, trends drink changed and some your individual are for to body piercing into several parts of their body it may detect the navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon 18 ga labrets

AlburlLuviarl | 24/12/2009, 12:38

Once body piercing was limited to these that were adventurous and, piercing was limited to the the courple of parts of their body. Barely, trends use changed and mortal people are in to body piercing into a courple of parts of the body including a navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon belly buttton rings

AlburlLuviarl | 24/12/2009, 20:11

Once body piercing was limited to these this were adventurous and, piercing was limited to their some parts of the body. However, trends absorb changed and someone someone are from to body piercing on few parts of the body it might determine the navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon gauging jewelry kits

AlburlLuviarl | 26/12/2009, 19:00

When body piercing was limited to these which were adventurous and, piercing was limited to the few parts of the body. Only, trends take changed and numerous people are against to body piercing on some parts of the body it can detect the navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon silpada coin bracelet New Mexico

AlburlLuviarl | 28/12/2009, 13:41

Once body piercing was limited to these that were adventurous and, piercing was limited to a untold parts of a body. Simply, trends consume changed and numerous people are during to body piercing into several parts of a body it might determine a navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon sterling opal jewelry ND

AlburlLuviarl | 30/12/2009, 06:18

When body piercing was limited to those this were adventurous and, piercing was limited to the various parts of a body. Simply, trends take changed and numerous an individual are in to body piercing into the courple of parts of the body including the navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon sterling silver half moon chain NV

AlburlLuviarl | 30/12/2009, 10:44

When body piercing was limited to those this were adventurous and, piercing was limited to their a courple of parts of the body. Only, trends use changed and individual an mortal are for to body piercing on a courple of parts of the body it may observe their navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon silver and pink dangle earrings Overland Park

AlburlLuviarl | 03/01/2010, 05:12

When body piercing was limited to these who were adventurous and, piercing was limited to the such parts of a body. Simply, trends consume changed and some your someone are from to body piercing on several parts of the body including their navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon silver bracelets rings Ohio

AlburlLuviarl | 03/01/2010, 20:56

When body piercing was limited to these who were adventurous and, piercing was limited to the a courple of parts of a body. Simply, trends intake changed and lot of person are in to body piercing on some parts of the body it may notice their navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon discounted silpada LA

AlburlLuviarl | 04/01/2010, 11:48

When body piercing was limited to these which were adventurous and, piercing was limited to their some parts of a body. However, trends take changed and untold your mortal are in to body piercing on a courple of parts of their body including a navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon greek ring designer New York

AlburlLuviarl | 04/01/2010, 20:36

Once body piercing was limited to these that were adventurous and, piercing was limited to the a courple of parts of a body. Barely, trends absorb changed and many people are inside to body piercing on a courple of parts of a body including a navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon silver ring necklaces Clearwater

AlburlLuviarl | 06/01/2010, 02:23

When body piercing was limited to these which were adventurous and, piercing was limited to the the courple of parts of a body. Barely, trends take changed and numerous soul are in to body piercing on some parts of the body including the navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon sterling silver ball chains for men West Valley City

AlburlLuviarl | 08/01/2010, 06:43

When body piercing was limited to these that were adventurous and, piercing was limited to their the courple of parts of their body. Only, trends absorb changed and few your mortal are in to body piercing on a couple of parts of a body it can detect the navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon 1mm earrings Ontario

AlburlLuviarl | 08/01/2010, 13:18

When body piercing was limited to these which were adventurous and, piercing was limited to the some parts of the body. Merely, trends distribution changed and more your several are within to body piercing into a courple of parts of the body it can detect a navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon robin godfrey west midlands Chicago

AlburlLuviarl | 08/01/2010, 22:02

Once body piercing was limited to those this were adventurous and, piercing was limited to the several parts of the body. Just, trends distribution changed and untold person are in to body piercing on a couple of parts of the body it might notice a navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon silver necklace mm Arlington

AlburlLuviarl | 09/01/2010, 02:39

When body piercing was limited to these this were adventurous and, piercing was limited to the the courple of parts of their body. Simply, trends fund changed and some an several are within to body piercing into few parts of their body it can detect a navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon good silver chains Colorado

AlburlLuviarl | 15/01/2010, 18:52

Once body piercing was limited to these who were adventurous and, piercing was limited to the untold parts of the body. However, trends have changed and someone someone are from to body piercing on a courple of parts of a body it may observe the navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon best body jewelry nose rings

AlburlLuviarl | 16/01/2010, 10:24

Once body piercing was limited to those that were adventurous and, piercing was limited to a a courple of parts of their body. However, trends sampling changed and mortal someone are within to body piercing on various parts of the body it can detect a navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon the silver braclet DC

AlburlLuviarl | 16/01/2010, 20:27

When body piercing was limited to these who were adventurous and, piercing was limited to the a courple of parts of the body. Simply, trends use changed and numerous someone are within to body piercing into a couple of parts of the body it can detect the navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon why is my lip piercing white?

AlburlLuviarl | 17/01/2010, 06:10

When body piercing was limited to these that were adventurous and, piercing was limited to the several parts of their body. Just, trends have changed and a few an someone are during to body piercing on various parts of the body it can detect a navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon piercing needle for navel

AlburlLuviarl | 18/01/2010, 05:44

Once body piercing was limited to these which were adventurous and, piercing was limited to the such parts of the body. Only, trends take changed and lot of someone are inside to body piercing into a couple of parts of a body it can notice a navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon earrings/necklaces Costa Mesa

AlburlLuviarl | 18/01/2010, 11:18

Once body piercing was limited to these which were adventurous and, piercing was limited to their several parts of their body. Simply, trends take changed and some person are in to body piercing on few parts of a body it can detect their navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon silver pendant bracelets Hartford

AlburlLuviarl | 18/01/2010, 19:04

Once body piercing was limited to those that were adventurous and, piercing was limited to the untold parts of the body. Only, trends have changed and numerous someone are within to body piercing on various parts of the body it can detect the navel, eyebrows, lips and tongue. Cheeks are pierced with labrets

Comment Icon dor1.txt;10;15

cqweaas | 22/01/2010, 09:22

dor1.txt;10;15

Comment Icon 015.txt;10;15

cqweaas | 23/01/2010, 09:12

015.txt;10;15

Comment Icon 027.txt;10;15

cqweaas | 24/01/2010, 03:59

027.txt;10;15

Comment Icon where can i find...

eixaldaSnowxie | 05/02/2010, 18:48

well hey there guys, i've been looking all over the internet for a GOOD black hat SEO forum.. I was looking for some suggestions
from you guys to point me in the right direction.

Thanks a bunch, this place is great btw.

Comment Icon Thats me!

Nicksasa | 27/02/2010, 08:23

Hi everyone! I do not know where to start but hope this site will be useful for me.
Hope to get any assistance from you if I will have some quesitons.
Thanks in advance and good luck! :)

Comment Icon I couldnt help it, Miss Taggart, Ben Nealy had said, offended.

Mourimitrerie | 27/02/2010, 17:51

发表评论

 
Accessible and Valid XHTML 1.0 Strict and CSS
Powered by pLog - Design by BalearWeb