oracle数据库审计(五)

2014-11-24 12:51:07 · 作者: · 浏览: 2
dit_trail where owner='SCOTT' ORDER BY TIMESTAMP DESC;

OS_USERNAME USERNAME TIMESTAMP OBJ_NAME ACTION_NAME AUDIT_OPTION SQL_TEXT SQL_BIND
-------------------- ---------- --------- --------------- ---------------------------- -------------------- ------------------------------ ------------------------------
oracle SCOTT 15-DEC-13 DEPT SELECT select * from dept
oracle SCOTT 15-DEC-13 EMP SELECT
oracle SCOTT 15-DEC-13 DEPT SELECT

SQL> select * from dept where deptno=10;

DEPTNO DNAME LOC
---------- -------------- -------------
10 ACCOUNTING NEW YORK

SQL> select os_username,username,timestamp,obj_name,ACTION_NAME,audit_option,sql_text,sql_bind from dba_audit_trail where owner='SCOTT' ORDER BY TIMESTAMP DESC;

OS_USERNAME USERNAME TIMESTAMP OBJ_NAME ACTION_NAME AUDIT_OPTION SQL_TEXT SQL_BIND
-------------------- ---------- --------- --------------- ---------------------------- -------------------- ------------------------------ ------------------------------
oracle SCOTT 15-DEC-13 DEPT SELECT select * from dept where deptn
o=10

oracle SCOTT 15-DEC-13 DEPT SELECT select * from dept
oracle SCOTT 15-DEC-13 EMP SELECT
oracle SCOTT 15-DEC-13 DEPT SELECT

SQL> var n:=10
SQL> select os_username,username,timestamp,obj_name,ACTION_NAME,audit_option,sql_text,sql_bind from dba_audit_trail where owner='SCOTT' ORDER BY TIMESTAMP DESC;

OS_USERNAME USERNAME TIMESTAMP OBJ_NAME ACTION_NAME AUDIT_OPTION SQL_TEXT SQL_BIND
-------------------- ---------- --------- --------------- ---------------------------- -------------------- ------------------------------ ------------------------------
oracle SCOTT 15-DEC-13 DEPT SELECT select * from dept where deptn #1(0):
o=(:n)

oracle SCOTT 15-DEC-13 DEPT SELECT select * from dept where deptn
o=10

oracle SCOTT 15-DEC-13 DEPT SELECT select * from dept
oracle SCOTT 15-DEC-13 EMP SELECT
oracle SCOTT 15-DEC-13 DEPT SELECT

SQL>
对于数据库的审计视图可以进行查看:
SQL> col object_name for a50
SQL> r
1* select object_name,object_type from dba_objects where object_name like '%AUDIT%' and object_type in ('TABLE','VIEW')

OBJECT_NAME OBJECT_TYPE
-------------------------------------------------- -------------------
AUDIT$ TABLE
STMT_AUDIT_OPTION_MAP TABLE
V_$XML_AUDIT_TRAIL VIEW
GV_$XML_AUDIT_TRAIL VIEW
AUDIT_ACTIONS TABLE
ALL_DEF_AUDIT_OPTS VIEW
USER_OBJ_AUDIT_OPTS VIEW
DBA_OBJ_AUDIT_OPTS VIEW
DBA_STMT_AUDIT_OPTS VIEW
DBA_PRIV_AUDIT_OPTS VIEW
DBA_AUDIT_TRAIL VIEW

OBJECT_NAME OBJECT_TYPE
-------------------------------------------------- -------------------
USER_AUDIT_TRAIL VIEW
DBA_AUDIT_SESSION VIEW
USER_AUDIT_SESSION VIEW
DBA_AUDIT_STATEMENT VIEW
USER_AUDIT_STATEMENT VIEW
DBA_AUDIT_OBJECT VIEW
USER_AUDIT_OBJECT VIEW
DBA_AUDIT_EXISTS VIEW
SM$AUDIT_CONFIG VIEW
DBA_AUDIT_POLICIES VIEW
DBA_AUDIT_POLICY_COLUMNS VIEW

OBJECT_NAME OBJECT_TYPE
-------------------------------------------------- -------------------
ALL_AUDIT_POLICIES VIEW
ALL_AUDIT_POLICY_COLUMNS VIEW
USER_AUDIT_POLICIES VIEW
USER_AUDIT_POLICY_COLUMNS VIEW
DBA_FGA_AUDIT_TRAIL VIEW
DBA_COMMON_AUDIT_TRAIL VIEW
DBA_AUDIT_MGMT_CONFIG_PARAMS VIEW
DBA_AUDIT_MGMT_LAST_ARCH_TS VIEW
DBA_AUDIT_MGMT_CLEANUP_JOBS VIEW
DBA_AUDIT_MGMT_CLEAN_EVENTS VIEW
REPCAT$_AUDIT_ATTRIBUTE TABLE

OBJECT_NAME OBJECT_TYPE
-------------------------------------------------- -------------------
DBA_REPAUDIT_ATT