Auditing usage of ApEx applications and data

Question

Hi there,
I am new to the Oracle forums and asking this question not as a DBA but from a systems security angle...
I am using ApEx to deliver business applications to my user community and I need to know collect audit trail information on system usage. I'd like to obtain information such as:
- which user made a database change, or accessed particular database records
- if a user has tried to access information that they have no rights to see
- if a DBA has created new users or changed access privileges
and so on...
My interest is in finding out firstly if it can be done and, secondly, how it can be achieved and recorded for analysis.
Grateful for any advice!
Many thanks,
HoinviP

Answer 1

We've turned on fine grained audting (FGA) and the coolest part is that oracle automatically picks up the apex application level user name and puts it in the FGA log. I expected our audit logs to have a whole lot of "apex_public_user" or the workspace schema name in the user field, but when you've got a non-public app, the end user's ID gets captured. Just as it should be.
Our app has two layers of auditing. The vendor delivered application level audit logs so that critical application level events are captured. This is just part of the code overhead of the application. In addition we turned on Oracle FGA so that we know every DDL/DML operation that occurs against our most sensitive tables.
The short answer is that if FGA doesn't get you what you want, you'll have to build your own auditing into your app. There is no magic checkbox or setting that will add auditing to your app, though FGA goes a long way if set up properly.
Inside our apex app, our developer put a process on every page that displays sensitive information. The process calls a stored procedure with the user's name, the sensitive field name, its value and the primary key of the record displayed. The process has the same authorization scheme as the sensitive fields. So, if the sensitive data field is displayed, the process is run, if the user cannot see the field, no audit process is run. It actually works pretty well.
We've also written additional Apex Apps that analyze the application level audit logs so that we can track who is looking at what and when. Very useful.