--开启oracle审计
su - oracle
sqlplus / as sysdba
SQL> show parameter audit
--看到有下面的内容表示审计没有开启
audit_sys_operations 4 Type boolean FALSE
audit_trail 4 NONE
--ORACLE实例采用spfile启动下，开启的SQL命令如下：
SQL> alter system set audit_sys_operations=true scope=spfile;
SQL> alter system set audit_trail=db scope=spfile;
SQL> shutdown immediate;
SQL> startup;
SQL> quit;
--ORACLE实例采用pfile启动下，开启的SQL命令如下：
--需要将下面两行加入到pfile配置文件($ORACLE_HOME/dbs/init$ORACLE_SID.ora)中
audit_sys_operations=true
audit_trail=db
--然后重启数据库
SQL> shutdown immediate;
SQL> startup;
SQL> quit;
--关闭数据库审计
--ORACLE实例采用spfile启动下，关闭的SQL命令如下：
SQL> alter system set audit_sys_operations=false scope=spfile;
SQL> alter system set audit_trail=none scope=spfile;
SQL> shutdown immediate;
SQL> startup;
SQL> quit;
--ORACLE实例采用pfile启动下，关闭的SQL命令如下：
--需要将下面两行加入到pfile配置文件($ORACLE_HOME/dbs/init$ORACLE_SID.ora)中
audit_sys_operations=false
audit_trail=none
--然后重启数据库
SQL> shutdown immediate;
SQL> startup;
SQL> quit;
--开始审计
sqlplus / as sysdba
SQL> audit all;
SQL> audit alter table;
SQL> audit delete table;
SQL> audit grant any role;
--等等具体的审计项目
--结束审计
sqlplus / as sysdba
SQL> noaudit all;
SQL> noaudit alter table;
SQL> noaudit delete table;
SQL> noaudit grant any role;
--创建审计日志查看用户
sqlplus / as sysdba
SQL> create user audituser identified by password;
SQL> grant connect to audituser;
SQL> alter user audituser account unlock;
SQL> grant select on sys.dba_audit_trail to audituser;
SQL> grant select on sys.v_$instance to audituser;
SQL> grant select on sys.audit$ to audituser;
SQL> grant select any dictionary to audituser;
转播
