About Event-Based Tracing of Real Application Security Components

Event-based tracing can be used to track events related to specific Real Application Security components. Real Application Security Components and Events lists the events assigned to Real Application Security components.

Real Application Security Components and Events

Real Application Security Components	Event (Oracle Error #)
Application Sessions (`XSSESSION)`	46148
Application Principals (`XSPRINCIPAL`)	46150
Security Classes (`XSSECCLASS`)	46149
ACLs `(XSACL)`	46110
Data Security (`XSXDS`)	46049
Mid-Tier Caches (`XS_MIDTIER`)	46151
Data Security VPD Rewrite (`XSVPD`)	10730

The following sections describe event-based tracing for individual Real Application Security components:

About Application Sessions (XSSESSION) Event-Based Tracing

Use the following SQL statement to enable event-based tracing for the XSSESSION component:

ALTER SESSION SET EVENTS '46148 trace name context forever, level="1", level="2", level="3"';

Here, 46148 is the Oracle Database error number associated with XSSESSION events. You can set a trace level of 1 (low), 2 (medium), or 3 (high). XSSESSION Trace Contents describes the trace levels.

Alternatively, you can use the following statement:

ALTER SESSION SET EVENTS 'TRACE [XSSESSION] disk=[low, medium, high]'

You can find the location of this trace file by using the following SQL statement:

SHOW PARAMETER USER_DUMP_DEST;

XSSESSION Trace Contents shows the XSSESSION trace contents for each trace level.

XSSESSION Trace Contents

Event	Trace Level 1 (Low)	Trace Level 2 (Medium)	Trace Level 3 (High)
`createSession`	Includes the following: User name Session Id for the session	Includes the following in addition to trace level 1 items: User GUID Session attributes such as create time, last authentication time, global variable namespace, and cookie information	Same as level 2
`attachSession`	Includes the following: User name Session Id for the session	Includes the following in addition to trace level 1 items: Roles	Includes the following in addition to trace level 1 and 2 items: Application namespace with attribute values
`detachSession`	Includes the following: User name Session Id for the session before detaching	Same as level 1	Same as levels 1 and 2
`createNamespace`	Includes the following: User name Session Id Application namespace with attribute values	Includes the following in addition to trace level 1 items: Session attributes such as create time, last authentication time, global variable namespace, and cookie information	Includes the following in addition to trace level 1 and 2 items: Namespace handler
`switchUser`	Includes the following: User name Session Id for the session	Includes the following in addition to trace level 1 items: Roles	Includes the following in addition to trace level 1 and 2 items: Application namespace with attribute values
`assignUser`	Includes the following: User name Session Id for the session	Includes the following in addition to trace level 1 items: Roles	Includes the following in addition to trace level 1 and 2 items: Application namespace with attribute values
`setAttribute`	Includes the following: Namespace name Name and value of the given attribute before and after the `setAttribute` operation	Same as level 1	Same as levels 1 and 2
`deleteAttribute`	Includes the following: Namespace name and Name and value of the given attribute before and after the `deleteAttribute` operation	Same as level 1	Same as levels 1 and 2

In addition to the preceding event, you can use the named event, xs_session_state to dump the current state of application sessions. Use the following SQL statement to enable tracing for the xs_session_state event:

ALTER SESSION SET EVENTS 'immediate eventdump(xs_session_state)';

The event dump contains information on all session attributes in the User Global Area (UGA) memory, such as session Id, user name, create time, last authentication time, global variable namespace, and so on. The dump does not contain information on secure items such as passwords.

About Application Principals (XSPRINCIPAL) Event-Based Tracing

Use the following SQL statement to enable event-based tracing for the XSPRINCIPAL component:

ALTER SESSION SET EVENTS '46150 trace name context forever, level="1", level="2", level="3"';

Here, 46150 is the Oracle Database error number associated with XSPRINCIPAL events. You can set a trace level of 1 (low), 2 (medium), or 3 (high). XSPRINCIPAL Trace Contents describes the trace levels.

Alternatively, you can use the following statement:

ALTER SESSION SET EVENTS 'TRACE [XSPRINCIPAL] disk=[low, medium, high]';

You can find the location of this trace file by using the following SQL statement:

SHOW PARAMETER USER_DUMP_DEST;

XSPRINCIPAL Trace Contents shows the XSPRINCIPAL trace contents for each trace level.

XSPRINCIPAL Trace Contents

Event	Trace Level 1 (Low)	Trace Level 2 (Medium)	Trace Level 3 (High)
Enable Role	Includes the following: User name Session Id for the session	Includes the following in addition to trace level 1 items: If the Enable Role operation fails, then the cause is logged. For example, the operation may fail if the role does not exist or the user has not been granted the role	Same as levels 1 and 2
Disable Role	Includes the following: All user enabled roles in the session after the role is disabled	Includes the following in addition to trace level 1 items: If the Disable Role operation fails, then the cause is logged.	Same as levels 1 and 2
Role Graph Traverse	Includes the following: User name Session Id for the session	Same as level 1	Same as levels 1 and 2

Event

Trace Level 1 (Low)

Trace Level 2 (Medium)

Trace Level 3 (High)

Enable Role

Includes the following:

User name
Session Id for the session

Includes the following in addition to trace level 1 items:

If the Enable Role operation fails, then the cause is logged. For example, the operation may fail if the role does not exist or the user has not been granted the role

Same as levels 1 and 2

Disable Role

Includes the following:

All user enabled roles in the session after the role is disabled

Includes the following in addition to trace level 1 items:

If the Disable Role operation fails, then the cause is logged.

Same as levels 1 and 2

Role Graph Traverse

Includes the following:

User name
Session Id for the session

Same as level 1

Same as levels 1 and 2

About Security Classes (XSSECCLASS) Event-Based Tracing

Use the following SQL statement to enable event-based tracing for the XSSECCLASS component:

ALTER SESSION SET EVENTS '46149 trace name context forever, level="1", level="2", level="3"';

Here, 46149 is the Oracle Database error number associated with XSSECCLASS events. You can set a trace level of 1 (low), 2 (medium), or 3 (high).

Alternatively, you can use the following statement:

ALTER SESSION SET EVENTS 'TRACE [XSSECCLASS] disk=[low, medium, high]';

You can find the location of this trace file by using the following SQL statement:

SHOW PARAMETER USER_DUMP_DEST;

The trace information includes the following:

Content from the Security Class document, such as parent classes, child classes, privileges, and aggregate privileges
For security class deletions, it includes information on parent classes that require invalidation from the cache
Exception related information, such as security class validation errors

About ACL (XSACL) Event-Based Tracing

Use the following SQL statement to enable event-based tracing for the XSACL component:

ALTER SESSION SET EVENTS '46110 trace name context forever, level="1", level="2", level="3"';

Here, 46110 is the Oracle Database error number associated with XSACL events. You can set a trace level of 1 (low), 2 (medium), or 3 (high).

Alternatively, you can use the following statement:

ALTER SESSION SET EVENTS 'TRACE [XSACL] disk=[low, medium, high]';

You can find the location of this trace file by using the following SQL statement:

SHOW PARAMETER USER_DUMP_DEST;

XSACL Trace Contents shows the XSACL trace contents for each trace level.

XSACL Trace Contents

Event	Trace Level 1 (Low)	Trace Level 2 (Medium)	Trace Level 3 (High)
Check privilege against ACLs	Includes the following: ACL results during cursor sharing	Includes the following in addition to trace level 1 items: ACL evaluation including ACL loading	Same as levels 1 and 2

Event

Trace Level 1 (Low)

Trace Level 2 (Medium)

Trace Level 3 (High)

Check privilege against ACLs

Includes the following:

ACL results during cursor sharing

Includes the following in addition to trace level 1 items:

ACL evaluation including ACL loading

Same as levels 1 and 2

About Data Security (XSXDS and XSVPD) Event-Based Tracing

Use the following SQL statement to enable event-based tracing for the XSXDS component:

ALTER SESSION SET EVENTS '46049 trace name context forever, level="1", level="2", level="3"';

Here, 46049 is the Oracle Database error number associated with XSXDS events. You can set a trace level of 1 (low), 2 (medium), or 3 (high). XSXDS Trace Contents describes the trace levels.

Alternatively, you can use the following statement:

ALTER SESSION SET EVENTS 'TRACE [XSXDS] disk=[low, medium, high]';

You can find the location of this trace file by using the following SQL statement:

SHOW PARAMETER USER_DUMP_DEST;

XSXDS Trace Contents shows the XSXDS trace contents for each trace level.

XSXDS Trace Contents

Event	Trace Level 1 (Low)	Trace Level 2 (Medium)	Trace Level 3 (High)
Data Security Document (DSD) loaded into System Global Area (SGA)	Includes the following: Security data realm constraint rules with resolved parameter values	Includes the following in addition to trace level 1 items: Access Control List (ACL) identifiers	Same as levels 1 and 2

Event

Trace Level 1 (Low)

Trace Level 2 (Medium)

Trace Level 3 (High)

Data Security Document (DSD) loaded into System Global Area (SGA)

Includes the following:

Security data realm constraint rules with resolved parameter values

Includes the following in addition to trace level 1 items:

Access Control List (ACL) identifiers

Same as levels 1 and 2

Use the following SQL statement to enable event-based tracing for the XSVPD component:

ALTER SESSION SET EVENTS '10730 trace name context forever level [1, 2, 3]';

Here, 10730 is the Oracle Database error number associated with XSVPD events. You can set a trace level of 1 (low), 2 (medium), or 3 (high). XSXDS Trace Contents describes the trace levels.

Alternatively, you can use the following statement:

ALTER SESSION SET EVENTS 'TRACE [XSVPD] disk=[low, medium, high]';

XSXDS Trace Contents shows the XSVPD trace contents for each trace level.

XSVPD Trace Contents

Event	Trace Level 1 (Low)	Trace Level 2 (Medium)	Trace Level 3 (High)
Data Security Document (DSD) loaded into System Global Area (SGA) All subsequent SQL statements issued in the current database session	Includes the following: VPD view of XDS enabled objects during hard-parse, soft-parse, or SQL statement parsing Data realm constraint rules with resolved parameter values, their corresponding ACL paths and ACL identifiers	Includes the following in addition to trace level 1 items: Current application session user name and enabled roles when the SQL statement is parsed or run	Includes the following in addition to trace level 1 items: Contents of all ACLs associated with data realm constraints, which are associated with the XDS enabled objects in the query

Event

Trace Level 1 (Low)

Trace Level 2 (Medium)

Trace Level 3 (High)

Data Security Document (DSD) loaded into System Global Area (SGA)
All subsequent SQL statements issued in the current database session

Includes the following:

VPD view of XDS enabled objects during hard-parse, soft-parse, or SQL statement parsing
Data realm constraint rules with resolved parameter values, their corresponding ACL paths and ACL identifiers

Includes the following in addition to trace level 1 items:

Current application session user name and enabled roles when the SQL statement is parsed or run

Includes the following in addition to trace level 1 items:

Contents of all ACLs associated with data realm constraints, which are associated with the XDS enabled objects in the query