【Oracle】审计

1、审计的功能：监控用户在database 的 action （操作）
2、审计分类：
1） session ：在同一个session，相同的语句只产生一个审计结果（默认）
2） access ： 在同一个session，每一个语句产生一个审计结果
3、启用审计（默认不启用）

SYS@LGR> show parameter audit;

NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
audit_file_dest                      string      /u01/app/oracle/admin/lgr/adum
                                                 p
audit_sys_operations                 boolean     FALSE
audit_syslog_level                   string
audit_trail                          string      NONE
SYS@LGR> alter system set audit_trail=db scope=spfile;

System altered.
SYS@LGR> startup force;
ORACLE instance started.

Total System Global Area  835104768 bytes
Fixed Size                  2257840 bytes
Variable Size             536874064 bytes
Database Buffers          289406976 bytes
Redo Buffers                6565888 bytes
Database mounted.
Database opened.
SYS@LGR> show parameter audit;

NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
audit_file_dest                      string      /u01/app/oracle/admin/lgr/adum
                                                 p
audit_sys_operations                 boolean     FALSE
audit_syslog_level                   string
audit_trail                          string      DB
--audit_trail
1）none 不启用audit
2）db 将审计结果放在数据字典里（database），只有dba 可以访问
3）os 将审计结果存放到操作系统的文件里（由audit_file_dest指定的位置）

--启用audit ，默认不审计sys用户的action

     audit_sys_operations=true ，启用对于sys 用户的审计

4、审计的对象：（默认情况：session ，对所有用户（除了sys），对成功和不成功的同时审计)

1）语句审计

SYS@LGR> audit table;

Audit succeeded.

SYS@LGR> audit table by LGR whenever successful;

Audit succeeded

----------查看审计设置
SYS@LGR> select user_name,audit_option from dba_stmt_audit_opts;                                                                   

USER_NAME                      AUDIT_OPTION
------------------------------ ---------------------------
                               TABLE    

2）权限审计

SYS@LGR> audit create table;

Audit succeeded.

3）对象审计

SYS@LGR> audit all on scott.emp;

Audit succeeded.

4）精细审计Fine Grained Auditing (FGA)

--建立审计策略

SYS@LGR> exec dbms_fga.add_policy(object_schema=>'scott',-
> object_name=>'emp',policy_name=>'chk_emp',-
> audit_condition =>'deptno=20',audit_column =>'sal',-
> statement_types =>'update,select');

PL/SQL procedure successfully completed.

SCOTT@LGR> select * from emp;

EMPNO ENAME      JOB              MGR HIREDATE         SAL       COMM     DEPTNO
----- ---------- --------- ---------- --------- ---------- ---------- ----------
 7369 SMITH      CLERK           7902 17-DEC-80        800                    20
 7499 ALLEN      SALESMAN        7698 20-FEB-81       1600        300         30
 7521 WARD       SALESMAN        7698 22-FEB-81       1250        500         30
 7566 JONES      MANAGER         7839 02-APR-81       2975                    20
 7654 MARTIN     SALESMAN        7698 28-SEP-81       1250       1400         30
 7698 BLAKE      MANAGER         7839 01-MAY-81       2850                    30
 7782 CLARK      MANAGER         7839 09-JUN-81       2450                    10
 7788 SCOTT      ANALYST         7566 19-APR-87       3000                    20
 7839 KING       PRESIDENT            17-NOV-81       5000                    10
 7844 TURNER     SALESMAN        7698 08-SEP-81       1500          0         30
 7876 ADAMS      CLERK           7788 23-MAY-87       1100                    20
 7900 JAMES      CLERK           7698 03-DEC-81        950                    30
 7902 FORD       ANALYST         7566 03-DEC-81       3000                    20
 7934 MILLER     CLERK           7782 23-JAN-82       1300                    10

14 rows selected.

SCOTT@LGR> select * from emp where deptno=20;

EMPNO ENAME      JOB              MGR HIREDATE         SAL       COMM     DEPTNO
----- ---------- --------- ---------- --------- ---------- ---------- ----------
 7369 SMITH      CLERK           7902 17-DEC-80        800                    20
 7566 JONES      MANAGER         7839 02-APR-81       2975                    20
 7788 SCOTT      ANALYST         7566 19-APR-87       3000                    20
 7876 ADAMS      CLERK           7788 23-MAY-87       1100                    20
 7902 FORD       ANALYST         7566 03-DEC-81       3000                    20

SCOTT@LGR> update emp set deptno=10 where empno=7788;

1 row updated.

SCOTT@LGR> update emp set sal=8000 where empno=7788;

1 row updated.

SCOTT@LGR> update emp set sal=8000 where deptno=20;

4 rows updated.

SCOTT@LGR> commit;

Commit complete.

--禁止精细审计
SYS@LGR> exec dbms_fga.disable_policy(-
> object_schema=>'scott',object_name=>'emp',-
> policy_name=>'chk_emp'); 

PL/SQL procedure successfully completed.

SYS@LGR>
--激活精细审计
SYS@LGR> exec dbms_fga.enable_policy(-
object_schema=>'scott',object_name=>'emp',-
> > policy_name=>'chk_emp');

PL/SQL procedure successfully completed.

SYS@LGR> 

--删除FGA策略
PL/SQL procedure successfully completed.

SYS@LGR> exec dbms_fga.drop_policy(-
> object_schema=>'scott',object_name=>'emp',-
> policy_name=>'chk_emp');

PL/SQL procedure successfully completed.

SYS@LGR>
--删除精细审计的结果
SYS@LGR> delete from sys.fga_log$;

5）应用审计（通过触发器来实现）
用于记载DML操作所引起的数据变化
1）建立审计表

11:37:32 SQL> conn scott/tiger
Connected.
create table audit_emp_change (
04:20:47   2  name varchar2(10),oldsal number(6,2),
04:21:12   3  newsal number(6,2) ,time date);

Table created.

2）建立DML 触发器

04:26:47 SQL> l
  1  create or replace trigger tr_sal_change
  2   after update of sal on scott.emp
  3   for each row
  4   declare
  5     v_temp int;
  6  begin
  7     select count(*)  into v_temp from audit_emp_change
  8           where name=:old.ename;
  9  if v_temp=0 then
 10    insert into audit_emp_change
 11       values(:old.ename,:old.sal,:new.sal,sysdate);
 12  else
 13    update audit_emp_change
 14      set oldsal=:old.sal ,newsal=:new.sal ,time=sysdate
 15           where name=:old.ename;
 16    end if;
 17* end;
        /

3）执行DML操作

04:28:02 SQL> update scott.emp set sal=6000 where empno=7788;

1 row updated.

4）查看审计结果

04:28:35 SQL> select name,oldsal,newsal,
04:28:46   2   to_char(time,'YYYY-MM-DD HH24:MI') FROM AUDIT_EMP_CHANGE;

NAME           OLDSAL     NEWSAL TO_CHAR(TIME,'YY
---------- ---------- ---------- ----------------
SCOTT            2000       6000 2011-03-03 04:28

09:40:03 SQL> r
  1* select TRIGGER_NAME,TRIGGER_TYPE,TABLE_NAME,COLUMN_NAME,status,TRIGGER_BODY from user_triggers

TRIGGER_NAME         TRIGGER_TYPE     TABLE_NAME COLUMN_NAM STATUS   TRIGGER_BODY
-------------------- ---------------- ---------- ---------- -------- ----------------------------------------
TR_SAL_CHANGE        AFTER EACH ROW   EMP                   ENABLED  declare
                                                                            v_temp int;
                                                                         begin
                                                                            select count(*)  into v_temp from