Oracle Database Audit Events
The script content on this page is for navigation purposes only and does not alter the content in any way.
Audit events are in a wide variety of categories, such as account management events and peer association events.
About the Oracle Database Audit Events
The audit events are categorized into events such as account management or audit command events.
This audit event names used in the Oracle Database to their equivalent values in the Command Class and Target Type fields in the Oracle Database Security Central audit record. The audit events are organized in useful categories, for example, Account Management events. You can use the audit events mapped here to create custom audit reports using other Oracle Database reporting products or third-party tools.
See Also: Oracle Database Security Central Database Schemas for Oracle Database Security Central data warehouse details that may be useful in designing your own reports.
Account Management Events
Account management events track SQL statements that affect user accounts, such as creating users or altering their profiles.
Table 1 lists the Oracle Database account management audit events and the equivalent Oracle DBSecCentral events.
Table 1 Oracle Database Account Management Audit Events
| Source Event | Event Description | Command Class | Target Type |
|---|---|---|---|
ALTER PROFILE |
Alter Profile | ALTER |
PROFILE |
ALTER USER |
Alter User | ALTER |
USER |
CREATE PROFILE |
Create Profile | CREATE |
PROFILE |
CREATE USER |
Create User | CREATE |
USER |
DROP PROFILE |
Drop Profile | DROP |
PROFILE |
DROP USER |
Drop User | DROP |
USER |
Audit Command Events
Audit command events track the use of AUDIT SQL statements on other SQL statements and on database objects.
Table 2 lists the Oracle Database audit command audit events and the equivalent Oracle DBSecCentral events.
Table 2 Oracle Database Audit Command Audit Events
| Source Event | Event Description | Command Class | Target Type |
|---|---|---|---|
AUDIT DEFAULT |
Audit Default | AUDIT |
DEFAULT |
AUDIT OBJECT |
Audit Object | AUDIT |
OBJECT |
NOAUDIT DEFAULT |
NoAudit default | NOAUDIT |
DEFAULT |
NOAUDIT OBJECT |
NoAudit Subject | NOAUDIT |
OBJECT |
AUDIT SYSTEM |
System Audit | AUDIT |
SYSTEM |
NOAUDIT SYSTEM |
System No Audit | NOAUDIT |
SYSTEM |
Data Access Events
Data access events track audited data manipulation language (DML) activities.
Examples of such activies are all SELECT, INSERT, UPDATE, or DROP SQL statements. The Data Access Report uses these events.
Table 3 lists the Oracle Database data access audit events and the equivalent Oracle Database Security Central events.
Table 3 Oracle Database Data Access Audit Events
| Source Event | Event Description | Command Class | Target Type |
|---|---|---|---|
DELETE |
Delete | DELETE |
NULL |
INSERT |
Insert | INSERT |
NULL |
SELECT |
Select | SELECT |
NULL |
TRUNCATE TABLE |
Truncate Table | TRUNCATE |
TRUNCATE TABLE |
UPDATE |
Update | UPDATE |
NULL |
See Also: Data Access Report
Exception Events
Exception events track audited error and exception activity, such as network errors.
Table 4 lists the Oracle Database exception audit events and the equivalent Oracle Database Security Central event.
Table 4 Oracle Database Exception Audit Event
| Source Event | Event Description | Command Class | Target Type |
|---|---|---|---|
ERROR NETWORK |
Network Error | ERROR |
NETWORK |
Invalid Record Events
Invalid record events track audited activity that Oracle DBSecCentral cannot recognize, possibly due to a corrupted audit record.
Table 5 lists the Oracle Database invalid record audit events and the equivalent Oracle DBSecCentral event.
Table 5 Oracle Database Invalid Record Audit Event
| Source Event | Event Description | Command Class | Target Type |
|---|---|---|---|
INVALID RECORD |
Invalid Record | INVALID |
RECORD |
Peer Association Events
Peer association events track database link statements.
Table 6 lists the Oracle Database peer association audit events and the equivalent Oracle DBSecCentral events.
Table 6 Oracle Database Peer Association Audit Events
| Source Event | Event Description | Command Class | Target Type |
|---|---|---|---|
CREATE DATABASE LINK |
Create Database Link | CREATE |
DATABASE LINK |
DROP DATABASE LINK |
Drop Database Link | DROP |
DATABASE LINK |
Role and Privilege Management Events
Role and privilege management events track audited role and privilege management activity, such as granting object permissions to a user.
Table 7 lists the Oracle Database role and privilege management audit events and the equivalent Oracle DBSecCentral events.
Table 7 Oracle Database Role and Privilege Management Audit Events
| Source Event | Event Description | Command Class | Target Type |
|---|---|---|---|
ALTER ROLE |
Alter Role | ALTER |
ROLE |
CREATE ROLE |
Create Role | CREATE |
ROLE |
DROP ROLE |
Drop Role | DROP |
ROLE |
GRANT OBJECT |
Grant Object | GRANT |
OBJECT |
GRANT ROLE |
Grant Role | GRANT |
ROLE |
ERROR OBJECT |
Object Exists ErrorsFoot 1 | FAIL |
OBJECT |
REVOKE OBJECT |
Revoke Object | REVOKE |
OBJECT |
REVOKE ROLE |
Revoke Role | REVOKE |
ROLE |
|
Set User or Program Unit Label1 |
|
|
PRIVILEGED OPERATION |
Privileged Operation | EXECUTE |
SYSTEM PRIVILEGE |
PRIVILEGED ACTION |
Privileged Action1 | PRIVILEGED |
ACTION |
Footnote 1
OBJECT EXISTS ERRORS, SET USER OR PROGRAM UNIT LABEL, and PRIVILEGED ACTION are Oracle Label Security events.
Service and Application Utilization Events
Service and application utilization events track audited application access activity, such as the execution of PL/SQL procedures or functions.
Table 8 lists the Oracle Database service and application utilization audit events and the equivalent Oracle Database Security Central events.
Table 8 Oracle Database Service and Application Utilization Audit Events
| Source Event | Event Description | Command Class | Target Type |
|---|---|---|---|
CALL METHOD |
Call Method | CALL |
METHOD |
EXECUTE PROCEDURE |
Execute Procedure | EXECUTE |
PROCEDURE |
EXECUTE PL/SQL |
PL/SQL Execute | EXECUTE |
PL/SQL |
Unknown or Uncategorized Events
Unknown or uncategorized events track audited activity that cannot be categorized, such as ALTER SUMMARY statements.
Table 9 lists the Oracle Database unknown or uncategorized audit events and the equivalent Oracle Database Security Central events.
Table 9 Oracle Database Unknown or Uncategorized Audit Events
| Source Event | Event Description | Command Class | Target Type |
|---|---|---|---|
ALTER SUMMARY |
Alter Summary | ALTER |
SUMMARY |
COMMENT |
Comment | COMMENT |
NULL |
CREATE SUMMARY |
Create Summary | CREATE |
SUMMARY |
DROP SUMMARY |
Drop Summary | DROP |
SUMMARY |
NO-OP |
No-Op | NO-OP |
NO-OP |
SUPER USER UNKNOWN |
Super User Unknown | UNKNOWN |
SUPER USER |
UNKNOWN |
Unknown | UNKNOWN |
UNKNOWN |
USER COMMENT |
User Comment | COMMENT |
USER |
User Session Events
User session events track audited authentication events for users who log in to the database.
Table 10 lists the Oracle Database user session audit events and the equivalent Oracle Database Security Central events.
Table 10 Oracle Database User Session Audit Events
| Source Event | Event Description | Command Class | Target Type |
|---|---|---|---|
ALTER SESSION |
Alter Session | ALTER |
SESSION |
COMMIT |
Commit | COMMIT |
NULL |
CREATE RESTORE POINT |
Create Restore Point | CREATE |
RESTORE POINT |
CREATE SESSION |
Create Session | CREATE |
SESSION |
DROP RESTORE POINT |
Drop Restore Point | DROP |
RESTORE POINT |
LOGOFF |
Logoff | LOGOUT |
NULL |
LOGOFF BY CLEANUP |
Logoff by Cleanup | LOGOFF BY CLEANUP |
NULL |
LOGON |
Logon | LOGIN |
NULL |
PROXY AUTHENTICATION ONLY |
Proxy Authentication Only | PROXY |
AUTHENTICATION ONLY |
PURGE USER_RECYCLEBIN |
Purge User Recycle Bin | DROP |
USER_RECYCLEBIN |
ROLLBACK |
Rollback | ROLLBACK |
NULL |
SAVEPOINT |
Savepoint | SAVEPOINT |
NULL |
SESSION REC |
Session Record | MERGE |
SESSION RECORD |
SET ROLE |
Set Role | SET |
ROLE |
SET TRANSACTION |
Set Transaction | SET |
TRANSACTION |
SUPER USER LOGON |
Super User Logon | LOGON |
SUPER USER |