11g默认审计选项-白红宇

11g默认启用强大的审计选项，AUDIT_TRAIL参数的缺省值为DB，这意为着审计数据将记录在数据库中的AUD$审计字典基表上。Oracle官方宣称默认启用的审计日志不会对绝大多数产品数据库的性能带来过大的负面影响，同时Oracle公司还推荐使用基于OS文件的审计日志记录方式(OS audit trail files)。注意因为在11g中CREATE SESSION将被作为受审计的权限来被记录，因此当SYSTEM表空间因磁盘空间而无法扩展时将导致这部分审计记录无法生成，这将最终导致普通用户的新会话将无法正常创建，普通用户将无法登陆数据库。在这种场景中仍可以使用SYSDBA身份的用户创建会话，在将审计数据合适备份后删除一部分记录，或者干脆TRUNCATE AUD$都可以解决上述问题。当AUDIT_TRAIL设置为OS时，审计记录文件将在AUDIT_FILE_DEST参数所指定的目录中生成。全部这些文件均可以随时被删除或复制。注意在默认情况下会以AUTOEXTEND ON自动扩展选项创建SYSTEM表空间，因此系统表空间在必要情况下还是会自动增长的，我们所需注意的是磁盘上的剩余空间是否能够满足其增长需求，以及数据文件扩展的上限，对于普通的8k smallfile表空间而言单个数据文件的最大尺寸是32G。以下权限将对所有用户审计:

SQL> select * from v$version;BANNER--------------------------------------------------------------------------------Oracle Database 11g Enterprise Edition Release 11.2.0.2.0 - 64bit ProductionPL/SQL Release 11.2.0.2.0 - ProductionCORE    11.2.0.2.0      ProductionTNS for Linux: Version 11.2.0.2.0 - ProductionNLSRTL Version 11.2.0.2.0 - ProductionSQL> select * from global_name;GLOBAL_NAME--------------------------------------------------------------------------------www.oracledatabase12g.comSQL> select privilege,success,failure from dba_priv_audit_opts;PRIVILEGE                                SUCCESS    FAILURE---------------------------------------- ---------- ----------CREATE EXTERNAL JOB                      BY ACCESS  BY ACCESSCREATE ANY JOB                           BY ACCESS  BY ACCESSGRANT ANY OBJECT PRIVILEGE               BY ACCESS  BY ACCESSEXEMPT ACCESS POLICY                     BY ACCESS  BY ACCESSCREATE ANY LIBRARY                       BY ACCESS  BY ACCESSGRANT ANY PRIVILEGE                      BY ACCESS  BY ACCESSDROP PROFILE                             BY ACCESS  BY ACCESSALTER PROFILE                            BY ACCESS  BY ACCESSDROP ANY PROCEDURE                       BY ACCESS  BY ACCESSALTER ANY PROCEDURE                      BY ACCESS  BY ACCESSCREATE ANY PROCEDURE                     BY ACCESS  BY ACCESSPRIVILEGE                                SUCCESS    FAILURE---------------------------------------- ---------- ----------ALTER DATABASE                           BY ACCESS  BY ACCESSGRANT ANY ROLE                           BY ACCESS  BY ACCESSCREATE PUBLIC DATABASE LINK              BY ACCESS  BY ACCESSDROP ANY TABLE                           BY ACCESS  BY ACCESSALTER ANY TABLE                          BY ACCESS  BY ACCESSCREATE ANY TABLE                         BY ACCESS  BY ACCESSDROP USER                                BY ACCESS  BY ACCESSALTER USER                               BY ACCESS  BY ACCESSCREATE USER                              BY ACCESS  BY ACCESSCREATE SESSION                           BY ACCESS  BY ACCESSAUDIT SYSTEM                             BY ACCESS  BY ACCESSPRIVILEGE                                SUCCESS    FAILURE---------------------------------------- ---------- ----------ALTER SYSTEM                             BY ACCESS  BY ACCESS23 rows selected.

以下语句也将对所有用户审计:

SQL> select audit_option,success,failure from dba_stmt_audit_opts;AUDIT_OPTION                             SUCCESS    FAILURE---------------------------------------- ---------- ----------ALTER SYSTEM                             BY ACCESS  BY ACCESSSYSTEM AUDIT                             BY ACCESS  BY ACCESSCREATE SESSION                           BY ACCESS  BY ACCESSCREATE USER                              BY ACCESS  BY ACCESSALTER USER                               BY ACCESS  BY ACCESSDROP USER                                BY ACCESS  BY ACCESSPUBLIC SYNONYM                           BY ACCESS  BY ACCESSDATABASE LINK                            BY ACCESS  BY ACCESSROLE                                     BY ACCESS  BY ACCESSPROFILE                                  BY ACCESS  BY ACCESSCREATE ANY TABLE                         BY ACCESS  BY ACCESSAUDIT_OPTION                             SUCCESS    FAILURE---------------------------------------- ---------- ----------ALTER ANY TABLE                          BY ACCESS  BY ACCESSDROP ANY TABLE                           BY ACCESS  BY ACCESSCREATE PUBLIC DATABASE LINK              BY ACCESS  BY ACCESSGRANT ANY ROLE                           BY ACCESS  BY ACCESSSYSTEM GRANT                             BY ACCESS  BY ACCESSALTER DATABASE                           BY ACCESS  BY ACCESSCREATE ANY PROCEDURE                     BY ACCESS  BY ACCESSALTER ANY PROCEDURE                      BY ACCESS  BY ACCESSDROP ANY PROCEDURE                       BY ACCESS  BY ACCESSALTER PROFILE                            BY ACCESS  BY ACCESSDROP PROFILE                             BY ACCESS  BY ACCESSAUDIT_OPTION                             SUCCESS    FAILURE---------------------------------------- ---------- ----------GRANT ANY PRIVILEGE                      BY ACCESS  BY ACCESSCREATE ANY LIBRARY                       BY ACCESS  BY ACCESSEXEMPT ACCESS POLICY                     BY ACCESS  BY ACCESSGRANT ANY OBJECT PRIVILEGE               BY ACCESS  BY ACCESSCREATE ANY JOB                           BY ACCESS  BY ACCESSCREATE EXTERNAL JOB                      BY ACCESS  BY ACCESS28 rows selected.

当前数据库中的现有的审计记录:

10 rows selected.

本文转自maclean_007 51CTO博客，原文链接:

http://blog.51cto.com/maclean/1277835