Fine Grained Audit records to syslog

Hello experts,
I am working on Standard Auditing and Fine Grained Auditing on 11.2.0.3 databases on Red Hat x86_64.
I am trying to send Fine Grained Audit records to syslog as for my Standard Audit records with audit_trail set to OS, but can't find any appropriate option.
When I create FGA policies with the ADD_POLICY procedure of the DBMS_FGA package, the audit_trail parameter can only be set to DB or XML, as stated in [PL/SQL Packages and Types Reference|http://docs.oracle.com/cd/E11882_01/appdev.112/e25788/d_fga.htm#CDEIECAG].
Does somebody know if it is possible to send FGA audit records to syslog directly:
1. without using any additional product (e.g. Oracle Audit Vault)?
2. without doing manual extraction from fga_log$ or DBA_COMMON_AUDIT_TRAIL?
Thanks for any suggestion.

Hi,
Well, i did not used FGA yet.
I used audit_Trail=db and the query SELECT username,extended_timestamp,owner,obj_name,action_name,sql_text FROM dba_audit_trail WHERE to_char(extended_timestamp, 'DD/MM/RR') = to_char(SYSDATE - 1, 'DD/MM/RR') ORDER BY timestamp)
Then i wrote a procedure, and exported the results using utl_file .
And i scheduled this procedure to run daily.
It works pretty good, if you like the solution as ask for details.
Hope that helps,
Regards.

Similar Messages

Should I use the fine-grained auditing?

I need to record the changes (of data) made to serveral tables by users. For example, I have to check the before and after images of the changes and what kind of transactions they do to cause the changes. Sould I program the logging procedure in the application or should I use the fine-grained auditing function of oracle to do it. I am not sure what this built-in function can do for me. Can anyone give me some advice on this? Thks.
A beginner

Why Fine-Grained Auditing?
You may want to check standard auditing if it is suitable for you
http://download.oracle.com/docs/cd/B19306_01/network.102/b14266/cfgaudit.htm#BABCFIHB
I don't think you can get pre and post update values of the affected data with Auditing.
FGA is useful when you want to audit just a "subset" of the data in the table.
(for instance, audit everyone that wants to get all records from EMP table where SALARY > 100000)
Message was edited by:
tekicora

Fine-grained auditing

Is there any way to audit more than one table using fine-grained auditing in oracle 10.2.0.
Thnks in advance.

sonidba wrote:
Is there any way to audit more than one table using fine-grained auditing in oracle 10.2.0.
Thnks in advance.Read this
Re: use multiple tables in FGA Add_policy?

How to know if Fine Grain Auditing is used

I have to migrate a exsisting database to a new plattaform.The old database is a Enterprise Edition and the new must be a Standard Edition.
But first I must make sure that none of the functions of the Enterpise edition is being used.
How I can know if the database is using the Fine Grain Auditing?
thanks

Thank you. Furthermore you can find a lot of resource about it.
Regards
http://www.oracle.com/technetwork/database/security/index-083815.html

Fine grained auditing on table, but I don't want it on view

I have a table which contains sensitive information, and I want to audit all queries on it except the web account 'EJBUSER', so I created the below policy:
begin
dbms_fga.add_policy( policy_name => 'STAFF_LOGON_QRY_POLICY'',
object_schema => 'CPY',
object_name => 'STAFF_LOGON',
statement_types => 'SELECT',
audit_condition => 'SYS_CONTEXT(''USERENV'',''SESSION_USER'') != ''EJBUSER'' ');
end;
This does exactly what I want, but I also have a view off this STAFF_LOGON table (below) which users can query to see their own details.
create or replace view CPY.V_STAFF_LOGON
as
select * from cpy.staff_logon
where user_name = user;
When a user queries this view, it also writes an entry to the dba_fga_audit_trail, but I only want to see queries against the base table, not the view.
Is it possible to fga audit the base table only, and not the view?
Edited by: stuartu on Feb 17, 2010 11:36 AM
Edited by: stuartu on Feb 17, 2010 12:01 PM

But does this delete the whole account from the cloud, or just from my device. I must make sure my husband doesn't loose all his business contacts which are in the iCloud device. Thanks.

Fine Grained Auditing FGA - Which procedure or package caused the DML ?

Hi All,
I'm using FGA at column level. I'm trying to figure out all PL/SQL Subprograms like procedures, functions, packages, etc, which issued the SQL_TEXT in the dba_fga_audit_trail view.
e.g.
begin
sys.dbms_fga.add_policy(
object_schema => 'SCOTT',
object_name => 'EMP',
policy_name => 'SCOTT_EMP_POLICY',
audit_condition => null,
audit_column => 'SALARY',
statement_types => 'UPDATE');
end;
The dba_fga_audit_trail view successfully displays all Update Statements in the SQL_TEXT column. However, as to which PL/SQL Subprogram it was issued from - this I don't know.
Is there any way to determine this? Maybe through another system view?
I tried replacing the SQL_TEXT with a lot of '%' for every space and every bind variable characters, so that I can do a LIKE in the DBA_SOURCE view, . . . but this didn't 100% worked.
Many Thanks,
Henry Wu

Hi,
Personnally i've never seen an automatic way for doing this...
What you cando (but it can be very fastidious) is to declare constants (or IDs) for your differents package/procedure/function names and add them to your different DMLs commands.
procedure TheProc is
CurrentProc constant varchar2(100):='TheProc';
begin
update mytable set .... , proc_name=CurrentProc
end;this is an old post but it might interrest you:
Get current procedure

Purging of Audit Records(FGA)

Hi,
I have enabled Fine Grain Auditing on production database with an DBMS_FGA.XML,DBMS_FGA.EXTENTED options.Files are getting generated in the ADUMP destination with XML format.I have purged all the XML audit files that are generated on 24-NOV-2010 from ADUMP destination.Even though when i have purged the files when i have queried the following query for the date 24-nov-2010 my query is still giving the results for the date 24-nov.
select sql_text ,object_name,db_user from v$xml_audit_trail where trunc(EXTENDED_TIMESTAMP)='24-NOV-2010'
According to my knowledge for the fine grain audting with the XML option when i have queried the V$XML_AUDIT_TRAIL dynamic view oracle will parse the XML files which are in adump dest and share the results.
Could you please assist me even though records for the date 24-nov not exists in adump destination how ORACLE is showing the contents in V$XML_AUDIT_TRAIL
Thanks in advance..
Regards,

which database version
Edited by: shaiffy on 25-Nov-2010 10:46 AM

Error in using fibne grained auditing

Hello,
I am trying to implement fine grained auditing on SAL column of my Employees table as I suspect that someone is updating values.
I am using the system user to implement this. But when I try to use the following syntax I am getting an error "ORA-00900: invalid SQL statement"
EXEC DBMS_FGA.ADD_POLICY(object_schema =>'hr',object_name =>'employees',policy_name =>'chk_pol',audit_condition =>'1=1',audit_column=>'salary');
Can anyone help me out in correcting this error.
Regards,
Faiz Qureshi
Email : [email protected]

begin
dbms_fga.add_policy
(object_schema => 'scott',
object_name => 'emp',
policy_name => 'chk_pol',
audit_condition => '1=1',
audit_column => 'sal');
end;
SQL> /
PL/SQL procedure successfully completed.
*I used sal column and emp as a table name.

Fine Grained Access ERROR on INSERT when generating unique keys

I'm using VPD/Fine Grained Access Control (FGAC) to implement security on my 9i backend. I created a security policy function that returns the predicate 'owner = USER'; - each of the tables has an additional column titled OWNER which contains the name of the logged-in user. Every time a user inserts a record, a BEFORE INSERT trigger fires (for every row) and inserts the USER name into the OWNER column. This is fairly straightforward and ensures that users can see only their rows. Using the DBMS_RLS.add_policy procedure, I attached the security policy to several tables and made it effective upon SELECT, UPDATE, INSERT, and DELETE statements.
However, the frontend Java application (custom-made) generates unique IDs (sequences are not used) by selecting max(ID)+1 from the primary key columns of the tables. The problem is that the predicate is appended to the SELECT max(ID)+1 query to limit the max(ID) to only those rows where 'owner = USER'. Therefore, the max(ID) generated is not the largest ID for the entire table, but only the largest among the USER rows.
So unless that USER happens to have the the largest ID in the whole table (and it has worked then), a primary-key violation error will be returned and the INSERT operation will be aborted.
How can I allow every USER to select from AND get the absolute largest ID from the PK column without allowing that user to select records that don't belong to him? If I had developed the application, I would have made use of sequences on the back-end to generate unique primary key IDs. Unfortunately, I don't have this option and must work with the application as is.
NOTE: the front-end Java application understands only the base table names, NOT Views created by me on the server. If the answer to this problem involves views, how can I make use of them on the backend when the front-end code does not recognize them?
Any help is greatly appreciated!
Michael

first you could use default column values, not a trigger, which is more expensive.
if your apps already assumes full access to table to get max id ( another RT ), this is bad. Current RLS can not really help if you can not change the apps because of this flaw logic ( you can store the maxid anywhere, why scanning the whole table to find it )

The newest version of iTunes is awful when it comes to Cloud syncing-file management. I'm constantly frustrated with what iTunes 'chooses to eliminate from my mobile device and settings aren't fine-grained enough to allow for real user control.

I'm endlessly frustrated with iTunes Cloud syncing, something that was supposed to make lenjoying my music easier. I routinely find that, though itunes and podcasts have been split, iTunes arbitrairily removes music files or in progress podcast in favor of 'new' podcasts. The settings are just not fine-grained enough to allow true user control and so we are instead subjected to 'Apple knows best' protocols. I understand and appreciate the level of exacting control Apple excercises over their ecosystem, however, more and more often I see them tightening control over things that should be user control while dropping the ball on aesthetic desisions made in producing their own software (see the hideous pull down tab for iTunes to access Podcast, TV shows, Music, etc.
I would like to see features like those in Mail and the Podcasting apps implemented in iTunes afor the management of content on mobile devices, for instance it would be great to swipe to delete files that you know longer want on your device, at both the album and song level. Another issues is the new pushiness of iRadio and iTunes Store, the app now seems to default to the iRadio page (versus the last page Albums, songs, etc. that the user was navigating, or in the instance of the iTunes Store push, if I doon't have all the tracks of an album i own on my mobile device 'complete my album' takes you to iTunes store rather than showing the 'cloud' download icon next to missing tracks. These are the tactics I expect from Google, not Apple (pushing commerce over quality user experience).
Fix these things Apple, please.

While Installation of 11g database creation time error ORA-28056: Writing audit records to Windows Event Log failed Error

Hi Friends,
OS = Windows XP 3
Database = Oracle 11g R2 32 bit
Processor= intel p4 2.86 Ghz
Ram = 2 gb
Virtual memory = 4gb
I was able to install the oracle 11g successfully, but during installation at the time of database creation I got the following error many times and I ignored it many times... but at 55% finally My installation was hanged nothing was happening after it.....
ORA-28056: Writing audit records to Windows Event Log failed Error and at 55% my Installation got hung,,,, I end the installation and tried to create the database afterward by DBCA but same thing happened....
Please some one help me out, as i need to install on the same machine .....
Thanks and Regards

AAP wrote:
Thanks Now I am able to Create a database , but with one error,
When I created a database using DBCA, at the last stage I got this error,
Database Configuration Assistant : Warning
Enterprise Manager Configuration Failed due to the Following error Listener is not up or database service is not registered with it. Start the listener & Registered database service & run EM Configuration Assistant again....
But when I checked the listener was up.....
Now what was the problem, I am able to connect and work through sqlplus,
But I didnt got the link of EM and when try to create a new connection in sql developer it is giving error ( Status : failure - Test Failed the Network Adapter could not establish the connection )
Thanks & Regards
Creation of the dbcontrol requires a connection via the listener. When configuring the dbcontrol as part of database creation, it appears that the dbcontrol creation step runs before the dynamic registration of the databsase with the listener is complete. Now that the database itself is completed and enough time (really, just a minute or two) has passed to allow the instance to register, use dbca or emca to create the dbcontrol.
Are you able to get a sqlplus connection via the listener (sqlplus scott/tiger@orcl)? That needs to be the first order of business.

CRM 2011: when auditing is turned off, why do existing Audit records lose "New Value"?

Not sure if this is by design (if so, would love to know why!) or if this is a bug. Let's say I have auditing turned on for Accounts. I change the phone number in the Main Phone field from 555-1111 to 555-5555, and an audit record is
created showing the Old Value (555-1111) and New Value (555-5555). Great. Now I turn off auditing. The system goes back to the audit record that had previously been created, and modifies it so that it shows the Old Value (555-1111),
and inserts an icon into the New Value field indicating auditing was turned off. The tool tip for that icon states "Auditing was stopped and restarted. The new values for the fields that changed during this period cannot be identified or recorded."
First of all (minor picky issue) auditing hasn't been turned back on yet, despite what the tool tip says (says the same thing whether or not auditing is turned back on). But the real problem is
why the existing audit record's New Value would be removed... why would that happen?!? We're talking about a historical update. It really did change, and the system knew what it changed from/to, so why would the system remove that new value
from the audit record? Logically I would expect that any changes made
while auditing is off would not be logged, and that once auditing is turned back on, Old/New values would correspond to whatever was/is in the system at the time that any new audit record is created, so there may be a disconnect between an older audit
record and a new one (old record's New Value not matching the new record's Old Value, because changes were made while auditing was off). And it's quite apparent when auditing is turned off, because an audit record is created stating "Auditing Disabled".
Any ideas if there's a logical reason why it would do this, or if this is really a bug that Microsoft needs to fix? We have a client with a business need to periodically turn off auditing while integration updates run between CRM and another system
(otherwise hundreds of thousands of unnecessary audit records would be created). But if they're going to lose audit data every time they disable auditing, the auditing is worthless.

We wouldn't ever temporarily turn auditing off on purpose... it's happening when we import managed solutions. We have vendors with managed solutions that contain system entities such as Contacts. When importing their solution, it momentarily
turns auditing off on those entities. The only evidence of this is audit records indicating "Entity Audit Stopped", and of course the loss of all the most recent "new value" on all audit records. The interesting (?) parts of this are:
1. When importing the managed solution, the recommended option to keep all existing customizations is selected. I would think this would include the audit settings on the entity, but apparently not (sort of... see #2).
2. As soon as the managed solution is imported, in addition to creating an "Entity Audit Stopped" audit record on relevant entities and wiping out new values, it apparently turns auditing back on, yet there's no record of this (in customizations, the entity
still (or once again) indicates auditing is enabled; but on records for that entity, there is no "Entity Audit Enabled" record.
So, now it's on to working with the vendors, to dig into their managed solutions and see if there's a way to prevent this!

How to pass the context from Portal to Database for fine grain access?

Hi,
I am developing an omniportlet and I need to pass on the context of the logged in user to the database so that when the user tries to access data in the omniportlet, he can see data relevant to him only. Does anyone know how to do that?
I have set up a light weight user scott and also has a schema in the database by the same name (scott)..
what I am trying is when the user logs in as scott in the portal site and runs an omniportlet, he should be dynamically be logged in to scott the schema so that the data visible to him can be restricted. Same should happen for other users as well.
Does anyone know in which table in the PORTAL schema is this connection information stored, so that I can override it using some API..?
Thanks,
Abhi

I had tried sending the user_name in the sql and that works fine. but my requirement is that the user should login to his schema and only his schema directly and automatically.. such that even if an omniportlet is created using some default schema, when user logs in he can access only the schema meant for him..
e.g. While running the omniportlet when logged-in as user scott, he should be logged-in to scott schema in the database, so that the fine grain access can be enabled ..
Edited by: user6386347 on Mar 12, 2009 12:15 PM

Function-based index error due to fine-grained security

Hi, i'm working on Oracle version 9.2.0.5.
I'm trying to create a function-based index but i'm getting an error due to fine-grained security. I checked resource_view but if i'm not wrong I should have all necessary roles. I also added xdbadmin to this user to be sure.
I tried also to alter my session but it didn't worked.
Connected to Oracle9i Enterprise Edition Release 9.2.0.5.0
Connected as test_ste
SQL>
SQL> create index fbidx_schede_xml
2 on schede_progetti_xml p
3 (p.PROGETTO.extract('/Project/Elenco_unita/Unita/Responsabile/Cognome/text()').getStringVal());
create index fbidx_schede_xml
on schede_progetti_xml p
(p.PROGETTO.extract('/Project/Elenco_unita/Unita/Responsabile/Cognome/text()').getStringVal())
ORA-28133: full table access is restricted by fine-grained security
ORA-06512: at "SYS.XMLTYPE", line 0
ORA-06512: at line 1
SQL>
SQL> alter session set query_rewrite_enabled = true;
Session altered
SQL> alter session set query_rewrite_integrity = trusted;
Session altered
SQL> create index fbidx_schede_xml
2 on schede_progetti_xml p
3 (p.PROGETTO.extract('/Project/Elenco_unita/Unita/Responsabile/Cognome/text()').getStringVal());
create index fbidx_schede_xml
on schede_progetti_xml p
(p.PROGETTO.extract('/Project/Elenco_unita/Unita/Responsabile/Cognome/text()').getStringVal())
ORA-28133: full table access is restricted by fine-grained security
ORA-06512: at "SYS.XMLTYPE", line 0
ORA-06512: at line 1
SQL> select * from user_role_privs;
USERNAME                       GRANTED_ROLE                   ADMIN_OPTION DEFAULT_ROLE OS_GRANTED
TEST_STE                      CONNECT                        NO           YES          NO
TEST_STE                      CTXAPP                         NO           YES          NO
TEST_STE                      RESOURCE                       NO           YES          NO
TEST_STE                      XDBADMIN                       NO           YES          NO
SQL> This are ACL on my schema:
<ACL>
    <acl description="Private:All privileges to OWNER only and not accessible to others" xmlns="http://xmlns.oracle.com/xdb/acl.xsd" xmlns:dav="DAV:"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xmlns.oracle.com/xdb/acl.xsd                           http://xmlns.oracle.com/xdb/acl.xsd">
      <ace>
        <principal>dav:owner</principal>
        <grant>true</grant>
        <privilege>
          <all/>
        </privilege>
      </ace>
    </acl>
</ACL>I tried to create a similar function-based index on Oracle 10.2.0.3 without any problem and without touching any ACL, is an Oracle 9.2.0.5 problem?
Thanks for your attention.

I didn't really (production wise)work yet with VPD. I know a lot is based on DBMS_RLS and I guess (IF it is VPD related) it should be to hard to find in the doc's how you could check what is beyond your privileges. As a DBA I noticed that even the dba account SYSTEM isn't always allow to export the full content for the tables anymore.
There is a privilege that grants you all access that you need, despite the fact that you are not allowed to read certain rows from a table. Look it up.
In all, as I said, it looks like account is not allowed to see all data from a table. In that respect it sounds logical that you also are, in that case, not allowed to build a function based index on that data

Fine-Grained Password Policy problem

Hi All,
I'm testing a Fine-Grained Password Policy for a group of users.
I created a test PSO using ASDI Edit and applied the PSO to a global security group.
Test user has been added to this group.
The PSO settings include "Enforce password history: 5"
The user has changed the password.
After 24h when I logged in as the user and changed the password - for example: Password1.
After another 24 hours I changed the password to Password2.
One day later I've been asked to change the password again.
In theory I shouldn't be able to use any of the 5 previous passwords (password history = 5) but when I entered Password1 it was accepted.
Do you know where can be the problem ?
System info: Windows Server 2008 R2 (forest/domain level is also 2008)
Regards,
Marcin

This is very interesting. I don't have any lab to repro though... So I can't look at it closer.
From an LDAP perspective, when you change your password on AD, you have to comply with the password history policy. This requirement is send by the server to the client thanks to the supported control: LDAP_SERVER_POLICY_HINTS_OID that you can see just by
looking at the RootDSE of one of your DC (http://msdn.microsoft.com/en-us/library/cc223320.aspx Used with an LDAP operation to enforce password history policies during password set). I am
aware of issues with AD-LDS not honoring it, but not AD... I am not sure if the situation described with FIM here matches your issue:
http://support.microsoft.com/kb/2443871 in this article:
"The "Enforce password history" and "Minimum password age" Group Policy settings do not work when you reset the password for a Windows Server 2008 R2-based or a Windows Server 2008-based computer."
But it would mean that it also affects users not having a FGGP (because this isn't specific to FGGP), ad the minimum password age as well. If you have a chance to try this in a lab, let us now... In the mean time, if you can share logs or code from your
app? Like the section that does the password change?
Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

Fine Grained Audit records to syslog

Similar Messages

Maybe you are looking for