| Oracle® Database Vault Administrator's Guide Oracle9i Release 2 (9.2.0.8) Part Number B32509-05 |
|
|
View PDF |
| Oracle® Database Vault Administrator's Guide Oracle9i Release 2 (9.2.0.8) Part Number B32509-05 |
|
|
View PDF |
This section contains:
Oracle Database Vault defines custom events to track violations in realms, command rules, and so on. You can audit the following in Oracle Database Vault:
Rule Set Audit: Audits the rule set processing results. You can audit both successful and failed processing. Realm authorizations can be managed using rule sets. You can audit the rule set processing results. Factor assignments and secure application roles audits can be managed using a rule set.
Realm Audit: A realm violation occurs when a database account, performing an action on a realm object, is not authorized to perform that action in the realm. You can audit realm violations.
Factor Audit: You can audit both successful and failed factor processing. For failed factor processing, you can audit on all or any of the following events: Retrieval Error, Retrieval Null, Validation Error, Validation False, Trust Level Null, or Trust Level Less Than Zero.
Oracle Label Security Session Initialization Failed: Audits instances where the Oracle Label Security session fails to initialize.
Oracle Label Security Attempt to Upgrade Session Label Failed: Audits instances where the Oracle Label Security component prevents a session from setting a label that exceeds the maximum session label.
See Also:
"Audit Options" (for factors)
"Audit Options" (for rule sets)
Chapter 16, "Oracle Database Vault Reports" for information about viewing the audit reports
The Oracle Database Vault custom audit event records are stored in the AUDIT_TRAIL$ table, which is part of the DVSYS schema. These audit records are not part of the typical Oracle Database audit trail. (In fact, if auditing has been disabled in Oracle Database, the Oracle Database Vault audit will continue to write to the AUDIT_TRAIL$ table.)
Note:
Oracle Audit Vault can collect the audit data for Oracle Database Vault. See Oracle Audit Vault Administrator's Guide for more information.Table A-1 describes the format of the audit trail, which you must understand if you plan to create custom reports that use the AUDIT_TRAIL$ table.
Table A-1 Audit Trail Format
| Column | Datatype | Null | Description |
|---|---|---|---|
|
|
|
|
Numeric identifier for the audit record |
|
|
|
Operating system login user name of the user whose actions were audited |
|
|
|
|
Name of the database user whose actions were audited |
|
|
|
|
Client computer name |
|
|
|
|
Identifier for the user's terminal |
|
|
|
|
Date and time of creation of the audit trail entry (in the local database session time zone) |
|
|
|
|
Creator of the object affected by the action, always |
|
|
|
|
Name of the object affected by the action. Expected values are:
|
|
|
|
|
|
Numeric action type code. The corresponding name of the action type is in the
|
|
|
|
Name of the action type corresponding to the numeric code in the |
|
|
|
|
The unique identifier of the record in the table specified under |
|
|
|
|
The unique name or natural key of the record in the table specified under |
|
|
|
|
The SQL text of the command procedure that was executed that resulted in the audit event being triggered |
|
|
|
|
The labels for all audit options specified in the record that resulted in the audit event being triggered. For example, a factor set operation that is supposed to audit on get failure and get |
|
|
|
|
The unique identifier of the rule set that was executing and caused the audit event to trigger |
|
|
|
|
The unique name of the rule set that was executing and caused the audit event to trigger |
|
|
|
|
The unique identifier of the rule that was executing and caused the audit event to trigger |
|
|
|
|
The unique name of the rule that was executing and caused the audit event to trigger |
|
|
|
|
An XML document that contains all of the factor identifiers for the current session at the point when the audit event was triggered |
|
|
|
|
Text comment on the audit trail entry, providing more information about the statement audited |
|
|
|
|
|
Numeric identifier for each Oracle session |
|
|
|
|
Same as the value in the |
|
|
|
|
Numeric identifier for the statement invoked that caused the audit event to be generated. This is empty for most Oracle Database Vault events. |
|
|
|
|
Oracle error code generated by the action. The error code for a statement or procedure invoked that caused the audit event to be generated. This is empty for most Oracle Database Vault events. |
|
|
|
Time stamp of creation of the audit trail entry (time stamp of user login for entries) in UTC (Coordinated Universal Time) time zone. |
|
|
|
|
Proxy session serial number, if an enterprise user has logged in through the proxy mechanism. |
|
|
|
|
Global user identifier for the user, if the user has logged in as an enterprise user |
|
|
|
|
Instance number as specified by the |
|
|
|
|
Operating system process identifier of the Oracle process |
|
|
|
|
Database login user name of the user whose actions were audited |
|
|
|
|
Date on which the action occurred, based on the |
|
|
|
|
Same as |
|
|
|
|
Same as |
You can create an archive of the Oracle Database Vault audit trail by exporting the AUDIT_TRAIL$ system table, which is owned by DVSYS, to a dump file. You should periodically archive and then purge the audit trail to prevent it from growing too large.
To archive and purge the Oracle Database Vault audit trail:
Ensure that the Export utility is installed.
Log on to SQL*Plus with administrative privileges and then run the following query:
sqlplus "sys/as sysdba" Enter password: password SQL> SELECT ROLE FROM DBA_ROLES WHERE ROLE LIKE '%FULL%'
If the query does not return the EXP_FULL_DATABASE and IMP_FULL_DATABASE roles, then Export is not installed. To install Export, run either the catexp.sql or catalog.sql script. For example:
@/opt/oracle/app/oracle/admin/catexp.sql;
See Oracle Database Utilities for more information about the Export utility.
Disable Oracle Database Vault.
See "Step 1: Disable Oracle Database Vault" for more information.
If the DVSYS account is locked, then unlock it. You need to have this account unlocked when you run the EXP export command.
ALTER USER DVSYS IDENTIFIED BY password ACCOUNT UNLOCK;
At the operating system command line, enter a command similar to the following to export the DVSYS.AUDIT_TRAIL$ audit table into a new dump file.
EXP DVSYS/password \
TABLES=DVSYS.AUDIT_TRAIL$ \
FILE=/opt/oracle/app/oracle/admin/orcl/adump/dv_audit_031607.dmp \
ROWS=y
In this specification:
TABLES: Enter DVSYS.AUDIT_TRAIL$, the name of the audit trail table.
FILE: Enter the name of the dump file that you want to create. The default extension is .dmp, but you can use any extension. Ensure that the file name you specify is unique.
ROWS: Enter y (yes) to export all rows of the table data.
Exit SQL*Plus.
When you install Oracle Database Vault, it creates a number of AUDIT settings in the database. However, in order for these audit settings to take place, auditing must be enabled in this database. You can check if auditing is enabled by using the SHOW PARAMETER command to find the value of the AUDIT_TRAIL initialization parameter. By default, auditing is disabled in Oracle Database.
If the AUDIT_TRAIL parameter is set to NONE, then auditing is not enabled, so you must set AUDIT_TRAIL. For detailed information about the AUDIT_TRAIL parameter, see Oracle Database Reference.
Table A-2 lists the AUDIT settings that Oracle Database Vault adds to the database.
Table A-2 Audit Policy Settings Oracle Database Vault Adds to Oracle Database
| Audit Setting Type | Audited Commands (BY ACCESS and on Success or Failure Unless Otherwise Noted) |
|---|---|
|
System Audit Settings/System Privilege Usage |
|
|
System Audit Settings/Object Management |
|
|
System Audit Settings/Intrusive Commands |
|
|
System Audit Settings/Administration Commands |
|
|
System Audit Settings/Audit Commands |
|
|
System Audit Settings/Access Control |
|
|
User Audit Settings for User Audit Settings for See Table 10-2, "Database Accounts Used by Oracle Database Vault" for more information about these accounts. See also these sections for detailed information on the |
|
|
|
|
|
|
|
 Copyright © 2006, 2008, Oracle. All rights reserved. Legal Notices |
|