Wednesday, January 23, 2008

Enable database level audit.

1.Create pfile from spfile to get the updated pfile.
SQL>create pfile from spfile;

2.Add *.audit_trail='DB' parameter in init.ora (pfile).

3. Restart the database using pfile.
SQL>startup pfile=initxxxx.ora

4.Login as DBA and run,
audit session by access whenever successful;
audit session by access whenever not successful;
audit system grant by access whenever successful;
audit system grant by access whenever not successful;
audit user by access whenever successful;
audit user by access whenever not successful;
audit role by access whenever successful;
audit role by access whenever not successful;
audit public synonym by access whenever successful;
audit public synonym by access whenever not successful;
audit database link by access whenever successful;
audit database link by access whenever not successful;
audit drop any table by access whenever successful;
audit drop any view by access whenever successful;
audit drop any procedure by access whenever successful;
audit drop any sequence by access whenever successful;
audit drop any index by access whenever successful;
audit create any table by access whenever successful;
audit create any view by access whenever successful;
audit create any procedure by access whenever successful;
audit create any sequence by access whenever successful;
audit create any index by access whenever successful;
audit alter system by access whenever successful;
audit alter system by access whenever not successful;
audit delete table by access whenever successful;
audit table by access whenever successful;
audit table by access whenever not successful;
audit view by access whenever successful;
audit view by access whenever not successful;
audit create any table by access whenever successful;
audit create any view by access whenever successful;
audit sequence by access whenever successful;
audit sequence by access whenever not successful;
audit synonym by access whenever successful;
audit synonym by access whenever not successful;
audit trigger by access whenever successful;
audit trigger by access whenever not successful;

5. Create spfile from pfile.
SQL>create spfile from pfile;

6. Restart the database using spfile.
SQL>startup

7.If you want to keep the audit data in a seperate tablespace, then
Create audit_data tablespace with enough space.

8. Move SYS.AUD$ to audit_data tablespace.
SQL>alter table sys.aud$ move tablespace audit_data;

9. Rebuild the index I_AUD1 using audit_storage tablespace.
SQL>alter index sys.I_AUD1 rebuild tablespace audit_data;

No comments: