Oracle 审计 部署监控 user DML操作

1、移动audit表及索引到dbadmin表空间

alter table aud$ move tablespace DBADMIN;
alter table AUDIT$ move tablespace DBADMIN;
alter index I_AUDIT rebuild online tablespace DBADMIN;
alter table AUDIT_ACTIONS move tablespace DBADMIN;
alter index I_AUDIT_ACTIONS rebuild online tablespace DBADMIN;

2、移动fga表及索引到DBADMIN表空间

alter table FGA$ move tablespace DBADMIN;
alter index I_FGA rebuild online tablespace DBADMIN;
alter index I_FGAP rebuild online tablespace DBADMIN;
alter table FGACOL$ move tablespace DBADMIN;
alter index I_FGACOL rebuild online tablespace DBADMIN;

3、移动fga_log$到DBADMIN表空间

1)新建fga_log$表:
create table sys.fga_lognew$(........)
Tablespace DBADMIN;  grant..
2)導出原先該表資料：
exp \'sys/oracle as sysdba\'
file=/u03/dump_dir/fga.dump log=/u03/dump_dir/fga.log  tables=sys.fga_log$;
3)重命名兩表：
SQL> rename fga_log$ to fga_logold$;
SQL> rename fga_lognew$ to fga_log$;
4)導出資料到新建的表：
Imp \'sys/oracle as sysdba\'
file=/u03/dump_dir/fga.dump log=/u03/dump_dir/fgaimp.log  full=y  ignore=y;

4、查看是否有無效對象并編譯過去

會有兩個同義詞編譯不了：
執行如下內部的腳本:
SQL> @/u01/app/oracle/product/11.2.0/db_1/rdbms/admin/utlrp.sql

Select * from v$dba_objects

5、修改審計相關的db 參數

alter system set audit_sys_operations=true scope=spfile;
alter system set audit_trail=db,extended scope=spfile;

6、關閉DB實例

1)關閉oracle實例
su – oracle
sqlplus / as sysdba
shutdown immediate;
2)關閉asm實例
su – grid
sqlplus / as sysasm
Shutdown;

7、開啟DB實例

1)開啟asm實例
su – grid
sqlplus / as sysasm
select instance_name,status  from v$instance;
startup;
2)開啟oracle實例
su – oracle
sqlplus / as sysdba
Startup;

8、實施監控個人帳號的腳本

audit insert table,update table,delete table by EASON_MA by access;
audit insert table,update table,delete table by JENY_GENG by access;
audit insert table,update table,delete table by RANKLY_LI by access;
audit insert table,update table,delete table by BEN_CHEN by access;
audit insert table,update table,delete table by HARDY_XUE by access;
audit insert table,update table,delete table by XINGDONG_YANG by access;
audit insert table,update table,delete table by WINTER_WANG by access;
audit insert table,update table,delete table by CAFOR_WU by access;
audit insert table,update table,delete table by HELEN_QIAO by access;
audit insert table,update table,delete table by BILL_SHEN by access;