Oracle审计失败的用户登陆(Oracle audit)(二)
audit_trail='DB' scope=spfile;
goex_admin@SYBO2SZ> alter system set audit_file_dest='/u02/database/SYBO2SZ/audit' scope=spfile;
goex_admin@SYBO2SZ> audit session whenever not successful;
goex_admin@SYBO2SZ> conn / as sysdba
sys@SYBO2SZ> shutdown immediate;
sys@SYBO2SZ> startup
sys@SYBO2SZ> ho ls /u02/database/SYBO2SZ/audit
C:\Users\robinson.cheng>sqlplus scott/wrongpwd@sybo2sz --尝试使用错误的密码从客户端来登陆
sys@SYBO2SZ> select userid, userhost, terminal from aud$ where returncode=1017;
USERID USERHOST TERMINAL
------------------------------ ------------------------------ ------------------------------
SCOTT TRADESZ\DEVELOPERPC01 DEVELOPERPC01
SCOTT TRADESZ\DEVELOPERPC01 DEVELOPERPC01
SCOTT TRADESZ\DEVELOPERPC01 DEVELOPERPC01
USR2 SZDB pts/1
USR2 SZDB pts/1
--有关具体的审计生成的OS文件参考接下来的演示
4、演示配置审计登陆失败(oracle 11g)
[sql]
--Oracle 11g下，缺省已经开启了审计功能，也就是说如果审计失败的登陆帐户，无须单独执行audit session whenever not successful;
sys@USBO> select * from v$version where rownum<2;
BANNER
-------------------------------------------------------------------------------------------------------
Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production
sys@USBO> show parameter audit
NAME TYPE VALUE
------------------------------------ --------------------------------- ------------------------------
audit_file_dest string /u03/database/usbo/adump
audit_sys_operations boolean FALSE
audit_syslog_level string
audit_trail string DB
--下面是审计产生的文件
sys@USBO> ho ls -hltr /u03/database/usbo/adump |tail -2
-rw-r----- 1 oracle asmadmin 758 Oct 21 16:29 usbo_ora_4502_1.aud
-rw-r----- 1 oracle asmadmin 763 Oct 21 16:49 usbo_ora_5652_1.aud
--使用系统用户登陆
C:\Users\robinson.cheng>sqlplus sys/oracle@usbo as sysdba
sys@USBO> ho ls -hltr /u03/database/usbo/adump |tail -2
-rw-r----- 1 oracle asmadmin 763 Oct 21 16:49 usbo_ora_5652_1.aud
-rw-r----- 1 oracle asmadmin 773 Oct 22 15:41 usbo_ora_13497_1.aud
--系统用户登陆被审计，审计文件中给出了比较详细的描述
sys@USBO> ho more /u03/database/usbo/adump/usbo_ora_13497_1.aud
Audit file /u03/database/usbo/adump/usbo_ora_13497_1.aud
Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production
With the Partitioning, Real Application Clusters, OLAP, Data Mining
and Real Application Testing options
ORACLE_HOME = /u01/app/oracle/db_1
System name:
Linux
Node name: linux1.orasrv.com
Release: 2.6.18-194.el5PAE
Version: #1 SMP Mon Mar 29 20:19:03 EDT 2010
Machine: i686
Instance name: usbo
Redo thread mounted by this instance: 1
Oracle process number: 31
Unix process pid: 13497, image: oracle@linux1.orasrv.com
Tue Oct 22 15:41:45 2013 +08:00
LENGTH : '180'
ACTION :[7] 'CONNECT'
DATABASE USER:[3] 'sys'
PRIVILEGE :[6] 'SYSDBA'
CLIENT USER:[14] 'Robinson.Cheng'
CLIENT TE