Oracle 11GR2 Enable auditing of SYS user action behavior

In Oracle 11GR2, the login audit information for SYS users is logged by default in the Audit_file_dest directory, but the operation content is not audited.

Enable auditing of SYS user action behavior

Sql> alter system set AUDIT_SYS_OPERATIONS=TRUE Scope=spfile;

System altered.

Because Audit_sys_operations is a static parameter, the database needs to be re-

sql> shutdown immediate;

Database closed.

Database dismounted.

ORACLE instance shut down.

Sql> startup;

Sql> Show parameter audit;

NAME TYPE VALUE

------------------------------------ ----------- ------------------------------

Audit_file_dest String/u01/app/oracle/admin/orcl/adu

Mp

Audit_sys_operations Boolean TRUE

Audit_syslog_level string

Audit_trail string DB

Then delete a test user

sql> drop user Lineqi cascade;

User dropped.

[Email protected] adump]$ more Orcl_ora_32424_20150418163852720955143795.aud

Audit File/u01/app/oracle/admin/orcl/adump/orcl_ora_32424_20150418163852720955143795.aud

Oracle Database 11g Enterprise Edition Release 11.2.0.4.0-64bit Production

With the partitioning, OLAP, Data Mining and Real application testing options

Oracle_home =/u01/app/oracle/product/11.2.0/dbhome_1

System Name:linux

Node NAME:ORCL

Release:2.6.32-358.el6.x86_64

Version: #1 SMP Tue Jan 11:47:41 EST 2013

Machine:x86_64

VM Name:vmware Version:6

Instance NAME:ORCL

Redo thread mounted by this instance:1

Oracle Process number:19

Unix process pid:32424, Image: [email protected] (TNS v1-v3)

NOTE: SYS logs on

Sat APR 18 16:38:52 2015 +08:00

LENGTH: ' 160 '

ACTION: [7] ' CONNECT '

DATABASE user:[1] '/'

PRIVILEGE: [6] ' SYSDBA '

CLIENT user:[6] ' Oracle '

CLIENT terminal:[5] ' pts/0 '

Status:[1] ' 0 '

DBID:[10] ' 1405073182 '

Sat APR 18 16:38:57 2015 +08:00

LENGTH: ' 173 '

ACTION: [+] ' ALTER DATABASE OPEN '

DATABASE user:[1] '/'

PRIVILEGE: [6] ' SYSDBA '

CLIENT user:[6] ' Oracle '

CLIENT terminal:[5] ' pts/0 '

Status:[1] ' 0 '

DBID:[10] ' 1405073182 '

Sat APR 18 16:39:08 2015 +08:00

LENGTH: ' 216 '

ACTION: [] ' BEGIN dbms_cmp_int.drop_cmp_by_cmpid (: SB1,: SB2,: SB3); END; '

DATABASE user:[3] ' SYS '

PRIVILEGE: [6] ' SYSDBA '

CLIENT user:[6] ' Oracle '

CLIENT terminal:[5] ' pts/0 '

Status:[1] ' 0 '

DBID:[10] ' 1405073182 '

Note: Records of the SYS operation

Sat APR 18 16:39:15 2015 +08:00

LENGTH: ' 178 '

ACTION: [+] ' drop user lineqi cascade '

DATABASE user:[1] '/'

PRIVILEGE: [6] ' SYSDBA '

CLIENT user:[6] ' Oracle '

CLIENT terminal:[5] ' pts/0 '

Status:[1] ' 0 '

DBID:[10] ' 1405073182 '

Sat APR 18 16:39:25 2015 +08:00

LENGTH: ' 197 '

ACTION: [+] ' select Tablespace_name from Dba_tablespaces '

DATABASE user:[1] '/'

PRIVILEGE: [6] ' SYSDBA '

CLIENT user:[6] ' Oracle '

CLIENT terminal:[5] ' pts/0 '

Status:[1] ' 0 '

DBID:[10] ' 1405073182 '

Oracle 11GR2 Enable auditing of SYS user action behavior