A Auditing Oracle Database Vault

Oracle Database Vault Specific Audit Events

This section contains:

• Oracle Database Vault Audit Events

• Format of the Oracle Database Vault Audit Trail

Archiving and Purging the Oracle Database Vault Audit Trail

You can create an archive of the Oracle Database Vault audit trail by exporting the AUDIT_TRAIL$ system table, which is owned by DVSYS, to a dump file. You should periodically archive and then purge the audit trail to prevent it from growing too large.

To archive and purge the Oracle Database Vault audit trail:

1. Ensure that you or the user performing the export operation has been granted the appropriate authorization.

   See "Using Oracle Data Pump in an Oracle Database Vault Environment" for more information.

2. Disable Oracle Database Vault.

   See "Step 1: Disable Oracle Database Vault".

3. At the operating system command prompt, create a directory for the Oracle Database Vault audit trail, for example, in $ORACLE_BASE/admin/$DB_UNIQUE_NAME/dvaudit.

   You may want to keep this directory in the same location as the operating system audit trail directories for Oracle Database, which by default is in the $ORACLE_BASE/admin/$DB_UNIQUE_NAME/adump directory. In SQL*Plus, you can check the location of the audit trail directory as follows:

   SHOW PARAMETER AUDIT_FILE_DEST
   

   Output similar to the following appears:

   NAME                 TYPE     VALUE
   -------------------  -------  ---------------------------------------
   audit_file_dest      string   /opt/oracle/app/oracle/admin/orcl/adump
   

4. In SQL*Plus, create a directory object in which to generate the Oracle Database Vault audit trail. To do so, connect as SYS or as any user who has the CREATE ANY DIRECTORY privilege.

   For example:

   CREATE DIRECTORY dv_audit_dir AS '/opt/oracle/app/oracle/admin/orcl/dvaudit';
   

   Enclose the directory path in single quotation marks, not double quotation marks.

5. In SQL*Plus, grant read and write privileges on the directory object to user DVSYS.

   For example:

   GRANT READ, WRITE ON DIRECTORY dvaudit TO dvsys; 
   

6. At the operating system command prompt, enter a command similar to the following to export the DVSYS.AUDIT_TRAIL$ audit table into a new dump file.

   EXPDP DVSYS
   Enter password: password
   DIRECTORY=dvaudit \
   TABLES=DVSYS.AUDIT_TRAIL$ \
   QUERY=DVSYS.AUDIT_TRAIL$:"WHERE timestamp < 2007-04-03:19:34:59" 
   DUMPFILE=dv_audit_031607.dmp
   

   In this specification:

   • DIRECTORY: Enter the directory object that you created in Step 5. Ensure that that the user who is running EXPDP (DVSYS in this example) has read and write permissions on this directory object. If you created the directory object, then you automatically have read and write permissions on it.

   • TABLES: Enter DVSYS.AUDIT_TRAIL$, the name of the audit trail table.

   • QUERY: Optional. This setting writes a subset of the audit table contents to the dump file, in this case, audit records that are less than the timestamp column value of 2007-04-03:19:34:59.

   • DUMPFILE: Enter the name of the dump file that you want to create. The default extension is .dmp, but you can use any extension. Ensure that the file name you specify is unique.

7. In SQL*Plus, purge the Oracle Database Vault audit trail table, now that you have archived it.

   For example, if you archived all audit trail records that are less than the timestamp column value of 2007-04-03:19:34:59, enter the following statement:

   DELETE FROM DVSYS.AUDIT_TRAIL$ WHERE TIMESTAMP < 2007-04-03:19:34:59;
   

   To completely purge the audit trail and remove the extents allocated to the audit trail table, enter the following statement:

   TRUNCATE TABLE DVSYS.AUDIT_TRAIL$;
   

8. Exit SQL*Plus.

9. Re-enable Oracle Database Vault.

   See "Step 3: Enable Oracle Database Vault".

Oracle Database Audit Settings Created for Oracle Database Vault

When you install Oracle Database Vault, it creates several AUDIT settings in the database. However, in order for these audit settings to take place, auditing must be enabled in this database. You can check if auditing is enabled by using the SHOW PARAMETER command to find the value of the AUDIT_TRAIL initialization parameter. By default, auditing is disabled in Oracle Database.

If the AUDIT_TRAIL parameter is set to NONE, then auditing is not enabled, so you must set AUDIT_TRAIL. For detailed information about the AUDIT_TRAIL parameter settings, see Oracle Database Security Guide and Oracle Database Reference.

Table A-2 lists the AUDIT settings that Oracle Database Vault adds to the database.