Oracle 11gR2 enables auditing of sys user actions
In oracle 11gR2, login audit information for sys users is recorded by default in the audit_file_dest directory, but the actions are not audited.
Enable auditing of sys user actions
SQL > alter system set audit_sys_operations=TRUE scope=spfile
System altered.
Because audit_sys_operations is a static parameter, the database needs to be rebuilt.
SQL > shutdown immediate
Database closed.
Database dismounted.
ORACLE instance shut down.
SQL > startup
SQL > show parameter audit
NAME TYPE VALUE
-
Audit_file_dest string / u01/app/oracle/admin/orcl/adu
Mp
Audit_sys_operations boolean TRUE
Audit_syslog_level string
Audit_trail string DB
Then delete a test user
SQL > drop user lineqi cascade
User dropped.
[oracle@orcl adump] $more orcl_ora_32424_20150418163852720955143795.aud
Audit file / u01/app/oracle/admin/orcl/adump/orcl_ora_32424_20150418163852720955143795.aud
Oracle Database 11g Enterprise Edition Release 11.2.0.4.0-64bit Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
ORACLE_HOME = / u01/app/oracle/product/11.2.0/dbhome_1
System name: Linux
Node name: orcl
Release: 2.6.32-358.el6.x86_64
Version: # 1 SMP Tue Jan 29 11:47:41 EST 2013
Machine: x86_64
VM name: VMWare Version: 6
Instance name: orcl
Redo thread mounted by this instance: 1
Oracle process number: 19
Unix process pid: 32424, p_w_picpath: oracle@orcl (TNS V1-V3)
Note: sys login record
Sat Apr 18 16:38:52 2015 + 08:00
LENGTH: '160'
ACTION: [7] 'CONNECT'
DATABASE USER: [1]'/'
PRIVILEGE: [6] 'SYSDBA'
CLIENT USER: [6] 'oracle'
CLIENT TERMINAL: [5] 'pts/0'
STATUS: [1]'0'
DBID: [10] '1405073182'
Sat Apr 18 16:38:57 2015 + 08:00
LENGTH: '173'
ACTION: [19] 'ALTER DATABASE OPEN'
DATABASE USER: [1]'/'
PRIVILEGE: [6] 'SYSDBA'
CLIENT USER: [6] 'oracle'
CLIENT TERMINAL: [5] 'pts/0'
STATUS: [1]'0'
DBID: [10] '1405073182'
Sat Apr 18 16:39:08 2015 + 08:00
LENGTH: '216'
ACTION: [60] 'BEGIN dbms_cmp_int.drop_cmp_by_cmpid (: sb1,: sb2,: sb3); END;'
DATABASE USER: [3] 'SYS'
PRIVILEGE: [6] 'SYSDBA'
CLIENT USER: [6] 'oracle'
CLIENT TERMINAL: [5] 'pts/0'
STATUS: [1]'0'
DBID: [10] '1405073182'
Note: records of sys operations
Sat Apr 18 16:39:15 2015 + 08:00
LENGTH: '178'
ACTION: [24] 'drop user lineqi cascade'
DATABASE USER: [1]'/'
PRIVILEGE: [6] 'SYSDBA'
CLIENT USER: [6] 'oracle'
CLIENT TERMINAL: [5] 'pts/0'
STATUS: [1]'0'
DBID: [10] '1405073182'
Sat Apr 18 16:39:25 2015 + 08:00
LENGTH: '1977'
ACTION: [43] 'select tablespace_name from dbA_tablespaces'
DATABASE USER: [1]'/'
PRIVILEGE: [6] 'SYSDBA'
CLIENT USER: [6] 'oracle'
CLIENT TERMINAL: [5] 'pts/0'
STATUS: [1]'0'
DBID: [10] '1405073182'
