Using Standard Auditing to Monitor General Activities
Example 6–1 Checking the Current Value of the AUDIT_TRAIL Initialization Parameter SHOW PARAMETERS AUDIT_TRAIL NAME TYPE VALUE ------------------------------------ ----------- ------audit_trail string DB
Example 6–2 shows how to log onto SQL*Plus, enable the standard audit trail, and then restart the database instance. Example 6–2 Enabling the Standard Audit Trail sqlplus "SYS/AS SYSDBA" Enter password: password Connected. SQL> ALTER SYSTEM SET AUDIT_TRAIL=DB, EXTENDED SCOPE=SPFILE; System altered. SQL> CONNECT SYS/AS SYSOPER Enter password: password Connected. SQL> SHUTDOWN; Database closed. Database dismounted. ORACLE instance shut down. SQL> STARTUP; ORACLE instance started.
This examples uses the SCOPE clause because the database instance had been started using a server parameter file (SPFILE). Starting the database with a server parameter file is the preferred way of starting a database instance. See Oracle Database Administrator's Guide for information about creating configuring server parameter files. Table 6–3 lists the settings you can use for the AUDIT_TRAIL initialization parameter.
Table 6–3
AUDIT_TRAIL Parameter Settings
AUDIT_TRAIL Value Description DB
Enables database auditing and directs audit records to the database audit trail (the SYS.AUD$ table), except for records that are always written to the operating system audit trail. Use this setting for a general database for manageability. (This value is the default.) If the database was started in read-only mode with AUDIT_TRAIL set to DB, then Oracle Database internally sets AUDIT_TRAIL to OS. Check the alert log for details. See also "Managing the Database Audit Trail" on page 6-6.
6-14
Oracle Database Security Guide