How to create audit triggers and run it dynamically?

Question

DECLARE
V_CRT VARCHAR2(4000);
V_DRP VARCHAR2(200);
BEGIN
FOR tab_rec IN (SELECT TABLE_NAME FROM USER_tabLES WHERE TABLE_NAME NOT LIKE '%TMP' AND TABLE_NAME NOT LIKE '%BAK' AND TABLE_NAME NOT LIKE 'MV_%') loop
v_DRP := 'DROP TABLE AUD_'||tab_rec.tABLE_name ||';' || CHR(13);
v_crt := ' CREATE TABLE AUD_'||tab_rec.tABLE_name
||'( ACTION VARCHAR2(1) ,
CONSTRAINT AUD_'||SUBSTR(TAB_REC.TABLE_NAME, 1,11)||substr(tab_rec.table_name,length(tab_rec.table_name)-4,5)||'_CHKACTION CHECK (ACTION IN (''I'',''U'',''D'')),
ISSUE_TIMESTAMP TIMESTAMP DEFAULT SYSDATE,
ISSUE_USER VARCHAR2(30),
ISSUE_HOST VARCHAR2(40),
FOR col_rec IN (SELECT column_name,data_type,data_length,data_precision,data_scale FROM user_tab_cols WHERE table_name = tab_rec.table_name ORDER BY column_id)
loop
IF col_rec.data_type = 'VARCHAR2' THEN
v_crt := v_crt || col_rec.column_name || ' '|| col_rec.data_type||'('||col_rec.data_length||'),'||chr(13)||' ';
ELSIF col_rec.data_type = 'NUMBER' THEN
v_crt := v_crt || col_rec.column_name || ' '||col_rec.data_type;
IF col_rec.data_precision IS NOT NULL THEN
v_crt:= v_crt||'('||col_rec.data_precision||','||col_rec.data_scale||'),'||chr(13)||' ';
ELSE
v_crt:= v_crt||','||chr(13)||' ';
END IF;
ELSE
v_crt := v_crt || col_rec.column_name || ' '||col_rec.data_type||','||chr(13)||' ';
END IF;
END loop;
v_crt := rtrim(v_crt);
v_crt := substr(v_crt,1,LENGTH(v_crt)-2)||');';
DBMS_OUTPUT.PUT_LINE(v_crt);
v_crt:= '';
END LOOP;
END;
The audit tables are named same as the table prefixed with AUD_. The audit table has two columns ACTION and ISSUE_TIMESTAMP more than the main tables.
This anonymous block creates the triggers in the table which has audit tables dynamically.
The user data is not maintained here in this code.
This code runs.
DECLARE
v_output1 VARCHAR2(5000);
v_insert VARCHAR2(4000);
v_delete VARCHAR2(4000);
v_update VARCHAR2(4000);
v_cols VARCHAR2(1000);
v_columns VARCHAR2(2000)DEFAULT '';
v_columns_new VARCHAR2(2000) DEFAULT '';
v_columns_old VARCHAR2(2000) DEFAULT '';
v_tab1 VARCHAR2(30) DEFAULT ' ';
v_tab2 VARCHAR2(30) DEFAULT ' ';
v_tab3 VARCHAR2(30) DEFAULT ' ';
v_schema varchar2(30) default 'schema'; --
v_user_id VARCHAR2(30); -- not used in this program
v_host VARCHAR2(30);
BEGIN
/* The audit tables are created with table name prefixed with AUD and columns ACTION AND ISSUE DATE, ISSUE_USER,ISSUE_HOST added.*/
FOR rec IN
(SELECT tname FROM tab WHERE tname LIKE 'AUD%'
LOOP
v_columns := '';
v_columns_new := '';
v_columns_old := '';
v_output1 := 'CREATE OR REPLACE TRIGGER '
||v_schema||'.' ||rec.tname ||'_TRIG ' || chr(13)
||' AFTER ' || chr(13)
||' INSERT OR '|| chr(13)
||' UPDATE OR '|| chr(13)
||' DELETE ON '|| chr(13)
||v_schema||'.'
|| substr(rec.tname,5)
|| chr(13)
||' FOR EACH ROW '
||chr(13)
||' BEGIN ' || chr(13);
FOR colrec IN
(SELECT column_name
FROM user_tab_cols
WHERE table_name = rec.tname
AND column_name NOT IN ('ACTION','ISSUE_TIMESTAMP','ISSUE_USER','ISSUE_HOST')
LOOP
v_columns := v_columns||v_tab3||colrec.column_name ||','||chr(13);
v_columns_new := v_columns_new ||v_tab3||':new.'||colrec.column_name ||','||chr(13) ;
v_columns_old := v_columns_old ||v_tab3||':old.'||colrec.column_name ||','||chr(13) ;
END LOOP;
v_columns := SUBSTR(v_columns ,1,LENGTH(v_columns ) -2);
v_columns_new := SUBSTR(v_columns_new,1,LENGTH(v_columns_new)-2);
v_columns_old := SUBSTR(v_columns_old,1,LENGTH(v_columns_old)-2);
v_insert := v_tab1||'IF INSERTING THEN ' || chr(13)
||v_tab2||'INSERT INTO '||v_schema||'.' ||rec.tname|| chr(13)
|| v_tab2||' ( '||chr(13)
|| v_tab3||'ACTION,'||chr(13)
|| v_tab3||'ISSUE_TIMESTAMP,' ||chr(13)
|| v_tab3||'ISSUE_USER,'||chr(13)
|| v_tab3||'ISSUE_HOST,'||chr(13)
||v_columns ||chr(13) ||v_tab2||')' || chr(13)
||v_tab2||' VALUES ' ||chr(13)
||v_tab2||' (' ||chr(13)
||v_tab3||'''I'''||','||chr(13)
||v_tab3||'SYSTIMESTAMP'||','||chr(13)
||v_tab3||'USER'||','||chr(13)
||v_tab3||'sys_context('||'''USERENV'''||','||'''HOST'''||'),'||chr(13)
||v_columns_new ||v_tab2||');' ||chr(13)
||v_tab1||'END IF;'
|| CHR(13);
v_delete := v_tab1||'IF DELETING THEN ' || chr(13)
||v_tab2||'INSERT INTO '||v_schema||'.' ||rec.tname|| chr(13)
||v_tab2|| '( '||chr(13)
|| v_tab3||'ACTION,'||chr(13)
|| v_tab3||'ISSUE_TIMESTAMP,' ||chr(13)
|| v_tab3||'ISSUE_USER,'||chr(13)
|| v_tab3||'ISSUE_HOST,'||chr(13)
||v_columns ||chr(13)
||v_tab2||')' || chr(13)
||v_tab2||' VALUES ' ||chr(13)
||v_tab2||' (' ||chr(13)
||v_tab3||'''D'''||','||chr(13)
||v_tab3||'SYSTIMESTAMP'||','||chr(13)
||v_tab3||'USER'||','||chr(13)
||v_tab3||'sys_context('||'''USERENV'''||','||'''HOST'''||'),'||chr(13)
||v_columns_old
||v_tab2||');' ||chr(13)
||v_tab1
||'END IF;' ||CHR(13);
v_update := v_tab1||'IF UPDATING THEN ' || chr(13)
||v_tab2||'INSERT INTO '||v_schema||'.' ||rec.tname|| chr(13)
||v_tab2|| '( '||chr(13)
||v_tab3|| 'ACTION,'||chr(13)
||v_tab3|| 'ISSUE_TIMESTAMP,' ||chr(13)
||v_tab3||'ISSUE_USER,'||chr(13)
||v_tab3||'ISSUE_HOST,'||chr(13)
||v_columns ||chr(13)
||v_tab2||')' || chr(13)
||v_tab2||' VALUES ' ||chr(13)
||v_tab2||' (' ||chr(13)
||v_tab3||'''U'''||','||chr(13)
||v_tab3||'SYSTIMESTAMP'||','||chr(13)
||v_tab3||'USER'||','||chr(13)
||v_tab3||'sys_context('||'''USERENV'''||','||'''HOST'''||'),'||chr(13)
||v_columns_new
||v_tab2||');' ||chr(13)
||v_tab1||'END IF;'|| chr(13) ;
-- v_output1 := v_output1 || v_insert || v_update|| v_delete ||CHR(13)||'END;';
--EXECUTE IMMEDIATE v_output1;
-- v_output1 := v_output1 || chr(13)||'/';
dbms_output.put_line(v_output1); generate script
dbms_output.put_line(v_output1);
dbms_output.put_line(v_insert);
dbms_output.put_line(v_update);
dbms_output.put_line(v_delete);
dbms_output.put_line('END;');
dbms_output.put_line('/');
END LOOP;
END;
show errors;
Edited by: ranjus on Oct 17, 2012 3:33 PM

Answer 1

Thank you so much for your suggestions.
I went through the link you suggested.
I wondered why DBA requested me to create triggers when such easy option was available to them. And I found the reason why triggers for audit.
When Triggers Are Necessary
Avoiding False Positives. Audit trails are generated through autonomous transactions from the original transactions. Hence they are committed even if the original transactions are rolled back.
Here is a simple example to illustrate the point. Assume that we have set up auditing for UPDATEs on table CLASS. A user issues a statement to update a data value from 20 to 10 and then rolls it back as shown below.
update class set size = 10 where class_id = 123;
rollback
Now the value of the column SIZE will be 20, not 10, as if the user never did anything. However, the audit trail will capture the change, even if it's rolled back. This may be undesirable in some cases, especially if there are lots of rollbacks by users. In such a case, you may have to use the trigger to capture only committed changes. If there were a trigger on the table CLASS to insert records into the user defined audit trail, upon rollback the audit trails would have been rolled back too
Capturing Before-change Values. Oracle-provided audit trails do not show the values before and after the change. For instance, the above change will create an audit record that shows the statement and the SCN number at the change, but not the value before the change (20). The value can be obtained from the SCN number using flashback query, but it depends on the information being available in the undo segments. If the information is not captured within the limit specified by the undo_retention period, the prior values can never be retrieved. Using a trigger guarantees that the values are captured without dependence on the undo_retention period, and may prove useful at times. Under these two circumstances you may decide to continue using triggers to record the audit trails at a granular detail.