Oracle Database標準審計和細粒度審計功能
這篇文章主要簡單的討論一下Oracle的審計功能，包括粗粒度審計、細粒度審計（FGA）
一.粗粒度審計功能。
1.審計級別：
語句級審計（stmt）：表示只審計某種型別的SQL語句，不指定結構或物件。
許可權級審計（privs）：表示只審計執行相應動作的系統許可權的使用情況。
實體級審計（obj）：表示只對指定模式上的實體指定語句的審計。
根據使用者語句的執行結果，審計語句分為成功語句的審計（Whenever Successful）、不成功語句的審計（Whenever NOT Successful）以及無論成功與否都進行審計（預設情況）。
根據使用者語句的執行次數，審計又分為對某一使用者或全體使用者的會話（By Session）審計、對某一使用者或全體使用者存取方式（By Access）的審計。
某一使用者或全體使用者的會話審計表示使用者語句每執行一次就審計一次；某一使用者或全體使用者存取方式審計表示相同語句執行多次時，每執行一次就審計一次。
當資料庫的審計功能被啟動後，在使用者語句執行階段，系統會自動產生審計資訊。審計資訊中包括審計的操作、使用者執行的操作、操作日期、操作時間等資訊。
2.初始化引數：
audit_trail=none|false|db|true|os
none,false效果相同，db,true效果相同，os將結果存放到audit_dump_file引數對應的目錄下。
audit_sys_operations=false|true
是否啟動對sysdba,sysoper身份的使用者的審計。
3.語法：
audit stmt opts|privs opts|obj opts by users by session|access whenever [not] successful;
4.審計型別：
語句級審計
語句級審計表示只審計某種型別的SQL語句。可以審計某個使用者，也可以審計所有使用者的SQL語句。語句級審計的語法如下：
AUDIT SQL語句選項 [by 使用者名稱] [by session|access] [whenever [NOT] successful;
|
語句選項 |
被審計的語句 |
|
CLUSTER |
Create Cluster、Audit Cluster、 |
|
DATABASE LINK |
Create Database Link、Drop Database Link |
|
DIRECTORY |
Create Directory、Drop Directory |
|
INDEX |
Create Index、Alter Index、Drop Index |
|
PROCEDURE |
Create Function、Create Library、Create Package、Create Package Body、Create Procedure、Drop Function、Drop Library、Drop Package |
|
PROFILE |
Create Profile、Alter Profile、Drop Profile |
|
PUBLIC SYNONYM |
Create Public Synonym、Drop Public Synonym |
|
ROLE |
Create Role、Alter Role、Drop Role、Set Role |
|
ROLLBACK SEGMENT |
Create Rollback Segment、Alter Rollback Segment、Drop Rollback Segment |
|
SEQUENCE |
Create Sequence、Drop Sequence |
|
SESSION |
Connect、Disconnect |
|
SYNONYM |
Create Synonym、Drop Synonym |
|
SYSTEM AUDIT |
Audit、Noaudit |
|
SYSTEM GRANT |
Grant、Revoke |
|
TABLE |
Create Table、Drop Table、Truncate Table |
|
TABLESPACE |
Create Tablespace、Alter Tablespace、Drop Tablespace |
|
TRIGGER |
Create Trigger、Alter Trigger |
|
USERS |
Create User、Alter User、Drop User |
|
TYPE |
Create Type、Create Type Body、Alter Type、Drop Type、Drop Type Body |
|
VIEW |
Create View、Drop View |
|
ALTER SEQUENCE |
Alter Sequence |
|
ALTER TABLE |
Alter Table |
|
DELETE TABLE |
Delete from tables、views |
|
EXECUTE |
Execute Function、Library、Package |
|
GRANT SEQUENCE |
Grant privilege On sequence、Revoke privilege On sequence |
|
GRANT TABLE |
Grant privilege on table、Revoke privilege on table |
|
UPDATE TABLE |
Lock Table |
在使用時，不需要寫出全部的SQL語句，只要寫出語句的選項即可。
“by 使用者名稱”表示只審計指定使用者的SQL語句，不審計其他使用者。沒有指出使用者名稱時，則審計全體使用者。
audit table by scott; 表示scott使用者在執行Create Table、Drop Table、Truncate Table操作時將被審計。
audit table; 表示所有使用者執行該型別的語句都被審計。
“by session”表示按會話方式審計，在每個會話中，相同的語句只審計一次。這是系統預設的方式。
“by access”表示按存取方式審計，每一次語句都將審計。
“whenever successful”表示只審計成功語句。
“whenever not successful”表示只審計不成功語句。
audit table by scott by access;（審計scott使用者每一次對錶的CREATE、DROP、Truncate操作）。
audit table by scott by session;（審計scott使用者對錶的CREATE、DROP、Truncate操作，相同的操作只記錄一次）。
audit session by tax02 by session whenever not successful;（審計tax02使用者嘗試連線資料庫，但不成功的資訊，相同的操作只記錄一次）。
audit session by tax01,tax02;（審計tax01，tax02使用者嘗試連線資料庫，成功的資訊，相同的操作只記錄一次）。
audit session whenever not successful;(審計嘗試連線資料庫，但不成功的資訊)。
如果要了解對於哪些使用者都進行了語句級審計及審計的選項，可以查詢資料字典DBA_STMT_AUDIT_OPTS，該資料字典要以sys使用者連線資料庫查詢。
當不再對使用者進行審計時，可以使用noaudit命令，把使用者進行的審計取消。
noaudit SQL語句或選項 [by 使用者名稱] [by session|access] [Whenever [NOT] Successful];
許可權級審計
許可權級審計表示只審計某一個系統許可權的使用情況。可以審計某個使用者所使用的系統許可權，也可以審計所有使用者使用的系統許可權。許可權級審計的語法如下：
Audit 許可權名稱 [by 使用者名稱] [by session|Access] [Whenever [NOT] Successful];
例如：
audit delete any table whenever not successful;（審計所有使用者不成功的DELETE ANY TABLE許可權使用情況）。
audit create table whenever not successful;（審計所有使用者不成功的CREATE TABLE許可權使用情況）。
audit alter any table,alter any procedure by scott by access whenever not successful;
audit create user by tax02 whenever not successful;
如果要了解對哪些使用者進行了許可權級審計及審計選項，可以查詢資料字典DBA_PRIV_AUDIT_OPTS，該資料字典必須以sys使用者連線資料庫進行查詢。
當不再對使用者的系統許可權進行審計時，可以使用noaudit命令取消對使用者所進行的審計。取消使用者許可權審計的命令如下：
noaudit 許可權名稱 [by 使用者名稱] [by session|access] [whenever [NOT] Successful];
例如：
noaudit alter any table,alter any procedure by scott by access whenever not successful;
noaudit create user by tax02 whenever not successful;
noaudit create table whenever not successful;
審計停止後，使用者所進行的操作將不再記錄。
實體級審計
實體審計用於監視所有使用者對某一指定使用者的表的存取狀況。實體級審計是不分審計物件的，資料庫管理員關心的重點是哪些使用者操作某一個指定使用者的表。實體級審計的語法如下：
audit 實體選項 on schema.實體名稱 [by session | access] [Whenever [NOT] Successful];
實體級審計中的實體選項及對實體操作的語句
|
型別 物件 |
TABLE |
VIEW |
SEQUENCE |
PROCEDURE |
SNAPSHOTS |
|
ALTER |
√ |
√ |
|||
|
DELETE |
√ |
√ |
|||
|
EXECUTE |
√ |
||||
|
INDEX |
√ |
||||
|
INSERT |
√ |
√ |
|||
|
REFERENCES |
√ |
||||
|
SELECT |
√ |
√ |
√ |
√ |
|
|
UPDATE |
√ |
√ |
audit delete on scott.emp by access whenever successful;（審計所有使用者對scott.emp表所有成功的DELETE操作，每次操作都會記錄）
audit delete on scott.dept by access whenever not successful;（審計所有使用者對scott.emp表所有不成功的DELETE操作，每次操作都會記錄）
audit select on sys.tab;（審計所有使用者對sys.tab表的SELECT操作，相同的操作只會記錄一次）
audit update on scott.dept;
audit update,delete on hr.employees by access whenever successful;
audit update,delete on hr.employees by user;（對user使用者對hr.employees的update,delete進行審計）
如果要了解對哪些使用者的實體進行了實體級審計及審計選項，可以查詢資料字典DBA_OBJ_AUDIT_OPTS，該資料字典必須以sys使用者連線資料庫進行查詢。例如對於使用者scott所進行的實體級審計資訊，可以使用以下命令：
select object_name,object_type,alt,aud,com,del,gra,ind,ins,loc,ren,sel,upd,ref,exe,cre,rea,wri from dba_obj_audit_opts where owner='SCOTT';
“-”表示沒有設定該選項的審計。
“S”表示使用by session選項進行審計。
“A”表示使用by access選項進行審計。
“/”表示使用過whenever successful、whenever not successful選項值。
使用noaudit命令取消對使用者實體所進行的審計。
例如：
noaudit delete on scott.emp by access whenever successful;
noaudit delete on scott.dept by access whenever not successful;
5.檢視審計結果：
dba_audit_trail;
DBA_AUDIT_TRAIL displays all standard audit trail entries.
dba_audit_session;
DBA_AUDIT_SESSION displays all audit trail records concerning CONNECT and DISCONNECT.
dba_audit_object;
DBA_AUDIT_OBJECT displays audit trail records for all objects in the database.
6.檢視建立了哪些審計：
dba_obj_audit_opts;（實體級審計）
dba_priv_audit_opts;（許可權級審計）
dba_stmt_audit_opts;（語句級審計）
7.取消審計(將原有的audit語句的audit換成noaudit執行即可)：
noaudit all;
noaudit all privileges;
noaudit update,delete on table_name [by username];
8.刪除審計記錄：
delete from sys.aud$ where timestamp#<sysdate-100;
二.細粒度審計（FGA）功能。
細粒度的審計使用DBMS_FGA包完成配置和管理工作。細粒度審計除了審計功能外，還可用於繫結變數值的捕獲，下面簡單討論一下DBMS_FGA包的使用：
SQL> desc dbms_fga
PROCEDURE ADD_POLICY
Argument Name Type In/Out Default?
------------------------------ ----------------------- ------ --------
OBJECT_SCHEMA VARCHAR2 IN DEFAULT
OBJECT_NAME VARCHAR2 IN
POLICY_NAME VARCHAR2 IN
AUDIT_CONDITION VARCHAR2 IN DEFAULT
AUDIT_COLUMN VARCHAR2 IN DEFAULT
HANDLER_SCHEMA VARCHAR2 IN DEFAULT
HANDLER_MODULE VARCHAR2 IN DEFAULT
ENABLE BOOLEAN IN DEFAULT
STATEMENT_TYPES VARCHAR2 IN DEFAULT
AUDIT_TRAIL BINARY_INTEGER IN DEFAULT
AUDIT_COLUMN_OPTS BINARY_INTEGER IN DEFAULT
PROCEDURE DISABLE_POLICY
Argument Name Type In/Out Default?
------------------------------ ----------------------- ------ --------
OBJECT_SCHEMA VARCHAR2 IN DEFAULT
OBJECT_NAME VARCHAR2 IN
POLICY_NAME VARCHAR2 IN
PROCEDURE DROP_POLICY
Argument Name Type In/Out Default?
------------------------------ ----------------------- ------ --------
OBJECT_SCHEMA VARCHAR2 IN DEFAULT
OBJECT_NAME VARCHAR2 IN
POLICY_NAME VARCHAR2 IN
PROCEDURE ENABLE_POLICY
Argument Name Type In/Out Default?
------------------------------ ----------------------- ------ --------
OBJECT_SCHEMA VARCHAR2 IN DEFAULT
OBJECT_NAME VARCHAR2 IN
POLICY_NAME VARCHAR2 IN
ENABLE BOOLEAN IN DEFAULT
從上面的結構很容易看出，DBMS_FGA包主要包括ADD_POLICY，ENABLE_POLICY，DISABLE_POLICY，和DROP_POLICY這4個儲存過程。其中ADD_POLICY是最常用也是最DBMS_FGA包中最複雜的過程，參考下面的內容順序ADD_POLICY儲存過程中引數的含義：
Table 40-2 ADD_POLICY Procedure Parameters
| Parameter | Description | Default Value |
|---|---|---|
|
object_schema |
The schema of the object to be audited. (If NULL, the current log-on user schema is assumed.) |
NULL |
|
object_name |
The name of the object to be audited. |
- |
|
policy_name |
The unique name of the policy. |
- |
|
audit_condition |
A condition in a row that indicates a monitoring condition. NULL is allowed and acts as TRUE. |
NULL |
|
audit_column |
The columns to be checked for access. These can include hidden columns. The default, NULL, causes audit if any column is accessed or affected. |
NULL |
|
handler_schema |
The schema that contains the event handler. The default, NULL, causes the current schema to be used. |
NULL |
|
handler_module |
The function name of the event handler; includes the package name if necessary. This function is invoked only after the first row that matches the audit condition in the query is processed. If the procedure fails with an exception, the user SQL statement will fail as well. |
NULL |
|
enable |
Enables the policy if TRUE, which is the default. |
TRUE |
|
statement_types |
The SQL statement types to which this policy is applicable: INSERT, UPDATE, DELETE, or SELECT only. |
SELECT |
|
audit_trail |
Destination (DB or XML) of fine grained audit records. Also specifies whether to populate LSQLTEXT and LSQLBIND in fga_log$. |
DB+EXTENDED |
|
audit_column_opts |
Establishes whether a statement is audited when the query references any column specified in the audit_column parameter or only when all such columns are referenced. <<<< 值有DBMS_FGA.ALL_COLUMNS和DBMS_FGA.ANY_COLUMNS，表示audit_column設定中是滿足所有欄位捕獲還是滿足一個欄位捕獲。 |
ANY_COLUMNS |
使用過程應該注意以下內容：
Usage Notes
-
If object_schema is not specified, the current log-on user schema is assumed.
-
An FGA policy should not be applied to out-of-line columns such as LOB columns.
-
Each audit policy is applied to the query individually. However, at most one audit record may be generated for each policy, no matter how many rows being returned satisfy that policy's audit_condition. In other words, whenever any number of rows being returned satisfy an audit condition defined on the table, a single audit record will be generated for each such policy.
-
If a table with an FGA policy defined on it receives a Fast Path insert or a vectored update, the hint is automatically disabled before any such operations. Disabling the hint allows auditing to occur according to the policy's terms. (One example of a Fast Path insert is the statement INSERT-WITH-APPEND-hint.)
-
The audit_condition must be a boolean expression that can be evaluated using the values in the row being inserted, updated, or deleted. This condition can be NULL (or omitted), which is interpreted as TRUE, but it cannot contain the following elements:
-
Subqueries or sequences
-
Any direct use of SYSDATE, UID, USER or USERENV functions. However, a user-defined function and other SQL functions can use these functions to return the desired information.
-
Any use of the pseudo columns LEVEL, PRIOR, or ROWNUM.
Specifying an audit condition of "1=1" to force auditing of all specified statements ("statement_types") affecting the specified column ("audit_column") is no longer needed to achieve this purpose. NULL will cause audit even if no rows were processed, so that all actions on a table with this policy are audited.
-
-
The audit function (handler_module) is an alerting mechanism for the administrator. The required interface for such a function is as follows:
PROCEDURE ( object_schema VARCHAR2, object_name VARCHAR2, policy_name VARCHAR2 ) AS ...
where fname is the name of the procedure, object_schema is the name of the schema of the table audited, object_name is the name of the table to be audited, and policy_name is the name of the policy being enforced. The audit function will be executed with the function owner's privilege.
-
The audit_trail parameter specifies both where the fine-grained audit trail will be written and whether it is to include the query's SQL Text and SQL Bind variable information (typically in columns named LSQLTEXT and LSQLBIND):
-
If audit_trail includes XML, then fine-grained audit records are written to XML-format operating system files stored in the directory specified by an AUDIT_FILE_DEST statement in SQL. (The default AUDIT_FILE_DEST is $ORACLE_BASE/admin/$DB_UNIQUE_NAME/adump on Unix-based systems, and $ORACLE_BASE\admin\$DB_UNIQUE_NAME\adump on Windows systems.)
-
If audit_trail includes DB instead, then the audit records are written to the SYS.FGA_LOG$ table in the database.
-
If audit_trail includes EXTENDED, then the query's SQL Text and SQL Bind variable information are included in the audit trail.
-
For example:
-
Setting audit_trail to DBMS_FGA.DB sends the audit trail to the SYS.FGA_LOG$ table in the database and omits SQL Text and SQL Bind.
-
Setting audit_trail to DBMS_FGA.DB + DBMS_FGA.EXTENDED sends the audit trail to the SYS.FGA_LOG$ table in the database and includes SQL Text and SQL Bind.
-
Setting audit_trail to DBMS_FGA.XML writes the audit trail in XML files sent to the operating system and omits SQL Text and SQL Bind.
-
Setting audit_trail to DBMS_FGA.XML + DBMS_FGA.EXTENDED writes the audit trail in XML files sent to the operating system and includes SQL Text and SQL Bind.
-
The audit_trail parameter appears in the ALL_AUDIT_POLICIES view.
-
-
You can change the operating system destination using the following command:
ALTER SYSTEM SET AUDIT_FILE_DEST = '' DEFERRED
-
On many platforms, XML audit files are named _.xml, for example, ora_2111.xml, or s002_11.xml. On Windows, the XML audit files are named _.xml (or _ProcessId>.xml if the process is not running as a thread).
-
The audit_column_opts parameter establishes whether a statement is audited
-
when the query references any column specified in the audit_column parameter (audit_column_opts = DBMS_FGA.ANY_COLUMNS), or
-
only when all such columns are referenced (audit_column_opts = DBMS_FGA.ALL_COLUMNS).
The default is DBMS_FGA.ANY_COLUMNS.
The ALL_AUDIT_POLICIES view also shows audit_column_opts.
-
-
When audit_column_opts is set to DBMS_FGA.ALL_COLUMNS, a SQL statement is audited only when all the columns mentioned in audit_column have been explicitly referenced in the statement. And these columns must be referenced in the same SQL-statement or in the sub-select.
Also, all these columns must refer to a single table/view or alias.
Thus, if a SQL statement selects the columns from different table aliases, the statement will not be audited.
下面介紹幾個最常用的初始化引數和檢視：
1).SYS.FGA_LOG$：如果audit_trail引數包含DB，那麼審計記錄會被記錄在FGA_LOG$表中。
2).AUDIT_FILE_DEST初始化引數：設定審計作業系統檔案的存放位置。
3).V$XML_AUDIT_TRAIL：如果audit_trail引數包含XML，那麼審計記錄會記錄在AUDIT_FILE_DEST初始化引數指定的目的地下的XML檔案中，Oracle會讀取這些XML檔案，生成V$XML_AUDIT_TRAIL動態效能檢視，方便DBA檢視審計詳細資訊。
4).DBA_AUDIT_POLICIES：詳細記錄了審計配置的策略資訊。
5).DBA_FGA_AUDIT_TRAIL：檢視到審計的SQL語句和繫結變數。
6).DBA_COMMON_AUDIT_TRAIL：包含V$XML_AUDIT_TRAIL動態效能檢視的內容，是標準和細粒度審計記錄。
注意：
啟用細粒度的審計功能不需要設定資料庫的AUDIT_TRAIL初始化引數，只需要設定DBMS_FGA.ADD_POLICY儲存過程中的AUDIT_TRAIL引數或使用預設值即可。
參考文章：《【實驗】【審計】【FGA】使用Oracle的審計功能監控資料庫中的可疑操作》：http://space.itpub.net/519536/viewspace-613323
三.Oracle資料對SYS使用者的審計以及11g預設開啟的審計功能。
參考文章：
《Oracle 11gR2 Database和ASM預設的審計策略和相關操作》：http://space.itpub.net/23135684/viewspace-723442
--end--