Oracle fine-grained audit (FGA) Preliminary

Fine-grained auditing (FGA) is introduced in Oracle 9i. It can record SCN numbers and row-level changes to recreate old data,
However, they can only be used for select statements, but not for DML, such as update, insert, and delete statements.
Therefore, for Oracle database versions earlier than 10 Gb, although using triggers is not attractive for tracking users' initial changes at the row level, it is the only reliable method

 

Operations performed during database audits are recorded, but information about the statements that cause the operations is not captured.
Fine-grained audit (FGA) extends the audit function to capture the actual SQL statements used to query or process data.
Compared with standard database audit or value-based database audit, FGA can narrow the scope of key audit.

The FGA feature in Oracle10g not only supports select operations, but also DML operations. In Oracle 10g,
An audit has evolved from a simple "Operation Recorder" to a "fact record mechanism", which can capture user behavior at a very detailed level,
This eliminates your need for manual, trigger-based auditing. It also integrates standard auditing and FGA tracking, which makes it easier to track database access without considering how it is generated.
Through fine-grained audit, we can record:

◆ A table is accessed between six o'clock P.M. and in the morning or on Saturday and Sunday.

◆ An IP address outside the company's network is used

◆ Specified columns selected or updated

◆ Specific values of this column are used

Audit is actually performed by the server process of a session on Recursive SQL operations, rather than relying on some background processes. This can be observed from event 10046.