User Level Auditing

Question

Hi Expert,
we are required to enable auditing . we will enable it at DB level . but we wan to audit only one specific user not all. how we can achieve this

Answer 1

This is on my windows 11.2.0.1.0 sqlplus cut and paste.
C:\WINDOWS>sqlplus sys/girish as sysdba
SQL*Plus: Release 11.2.0.1.0 Production on Fri Nov 18 19:10:12 2011
Copyright (c) 1982, 2010, Oracle.  All rights reserved.
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
SQL> @getaud;
AUDIT STATEMENT
AUDIT ALTER ANY PROCEDURE  BY ACCESS ;
AUDIT ALTER ANY TABLE  BY ACCESS ;
AUDIT ALTER DATABASE  BY ACCESS ;
AUDIT ALTER PROFILE  BY ACCESS ;
AUDIT ALTER SYSTEM  BY ACCESS ;
AUDIT ALTER USER  BY ACCESS ;
AUDIT AUDIT SYSTEM  BY ACCESS ;
AUDIT CREATE ANY JOB  BY ACCESS ;
AUDIT CREATE ANY LIBRARY  BY ACCESS ;
AUDIT CREATE ANY PROCEDURE  BY ACCESS ;
AUDIT CREATE ANY TABLE  BY ACCESS ;
AUDIT STATEMENT
AUDIT CREATE EXTERNAL JOB  BY ACCESS ;
AUDIT CREATE PUBLIC DATABASE LINK  BY ACCESS ;
AUDIT CREATE SESSION  BY ACCESS ;
AUDIT CREATE USER  BY ACCESS ;
AUDIT DATABASE LINK  BY ACCESS ;
AUDIT DROP ANY PROCEDURE  BY ACCESS ;
AUDIT DROP ANY TABLE  BY ACCESS ;
AUDIT DROP PROFILE  BY ACCESS ;
AUDIT DROP USER  BY ACCESS ;
AUDIT EXEMPT ACCESS POLICY  BY ACCESS ;
AUDIT GRANT ANY OBJECT PRIVILEGE  BY ACCESS ;
AUDIT STATEMENT
AUDIT GRANT ANY PRIVILEGE  BY ACCESS ;
AUDIT GRANT ANY ROLE  BY ACCESS ;
AUDIT PROFILE  BY ACCESS ;
AUDIT PUBLIC SYNONYM  BY ACCESS ;
AUDIT ROLE  BY ACCESS ;
AUDIT SYSTEM AUDIT  BY ACCESS ;
AUDIT SYSTEM GRANT  BY ACCESS ;
29 rows selected.
SQL> audit select table by scott by access;
Audit succeeded.
SQL> @getaud;
AUDIT STATEMENT
AUDIT ALTER ANY PROCEDURE  BY ACCESS ;
AUDIT ALTER ANY TABLE  BY ACCESS ;
AUDIT ALTER DATABASE  BY ACCESS ;
AUDIT ALTER PROFILE  BY ACCESS ;
AUDIT ALTER SYSTEM  BY ACCESS ;
AUDIT ALTER USER  BY ACCESS ;
AUDIT AUDIT SYSTEM  BY ACCESS ;
AUDIT CREATE ANY JOB  BY ACCESS ;
AUDIT CREATE ANY LIBRARY  BY ACCESS ;
AUDIT CREATE ANY PROCEDURE  BY ACCESS ;
AUDIT CREATE ANY TABLE  BY ACCESS ;
AUDIT STATEMENT
AUDIT CREATE EXTERNAL JOB  BY ACCESS ;
AUDIT CREATE PUBLIC DATABASE LINK  BY ACCESS ;
AUDIT CREATE SESSION  BY ACCESS ;
AUDIT CREATE USER  BY ACCESS ;
AUDIT DATABASE LINK  BY ACCESS ;
AUDIT DROP ANY PROCEDURE  BY ACCESS ;
AUDIT DROP ANY TABLE  BY ACCESS ;
AUDIT DROP PROFILE  BY ACCESS ;
AUDIT DROP USER  BY ACCESS ;
AUDIT EXEMPT ACCESS POLICY  BY ACCESS ;
AUDIT GRANT ANY OBJECT PRIVILEGE  BY ACCESS ;
AUDIT STATEMENT
AUDIT GRANT ANY PRIVILEGE  BY ACCESS ;
AUDIT GRANT ANY ROLE  BY ACCESS ;
AUDIT PROFILE  BY ACCESS ;
AUDIT PUBLIC SYNONYM  BY ACCESS ;
AUDIT ROLE  BY ACCESS ;
AUDIT SELECT TABLE BY SCOTT BY ACCESS ;    <----------- New Row
AUDIT SYSTEM AUDIT  BY ACCESS ;
AUDIT SYSTEM GRANT  BY ACCESS ;
30 rows selected.
SQL> noaudit select table by scott;
Noaudit succeeded.
SQL> @getaud;
AUDIT STATEMENT
AUDIT ALTER ANY PROCEDURE  BY ACCESS ;
AUDIT ALTER ANY TABLE  BY ACCESS ;
AUDIT ALTER DATABASE  BY ACCESS ;
AUDIT ALTER PROFILE  BY ACCESS ;
AUDIT ALTER SYSTEM  BY ACCESS ;
AUDIT ALTER USER  BY ACCESS ;
AUDIT AUDIT SYSTEM  BY ACCESS ;
AUDIT CREATE ANY JOB  BY ACCESS ;
AUDIT CREATE ANY LIBRARY  BY ACCESS ;
AUDIT CREATE ANY PROCEDURE  BY ACCESS ;
AUDIT CREATE ANY TABLE  BY ACCESS ;
AUDIT STATEMENT
AUDIT CREATE EXTERNAL JOB  BY ACCESS ;
AUDIT CREATE PUBLIC DATABASE LINK  BY ACCESS ;
AUDIT CREATE SESSION  BY ACCESS ;
AUDIT CREATE USER  BY ACCESS ;
AUDIT DATABASE LINK  BY ACCESS ;
AUDIT DROP ANY PROCEDURE  BY ACCESS ;
AUDIT DROP ANY TABLE  BY ACCESS ;
AUDIT DROP PROFILE  BY ACCESS ;
AUDIT DROP USER  BY ACCESS ;
AUDIT EXEMPT ACCESS POLICY  BY ACCESS ;
AUDIT GRANT ANY OBJECT PRIVILEGE  BY ACCESS ;
AUDIT STATEMENT
AUDIT GRANT ANY PRIVILEGE  BY ACCESS ;
AUDIT GRANT ANY ROLE  BY ACCESS ;
AUDIT PROFILE  BY ACCESS ;
AUDIT PUBLIC SYNONYM  BY ACCESS ;
AUDIT ROLE  BY ACCESS ;
AUDIT SYSTEM AUDIT  BY ACCESS ;
AUDIT SYSTEM GRANT  BY ACCESS ;
29 rows selected.
SQL>Now your question :
Allright is i want to audit scott user's all activities ,DDL,DML ,Select logon login every thing then what shoul i do.So, just use audit statement with by clause and run above getaud script to see its impact.
here it is my getaud.sql which i obtained from [ http://www.myoraclesupports.com/content/script-generate-audit-and-noaudit-statements-current-audit-settings ] link.
select 'AUDIT '||m.name||decode(u.name,'PUBLIC',' ',' BY '||u.name)||
decode(nvl(a.success,0) + (10 * nvl(a.failure,0)),
1,' BY SESSION WHENEVER SUCCESSFUL ',
2,' BY ACCESS WHENEVER SUCCESSFUL ',
10,' BY SESSION WHENEVER NOT SUCCESSFUL ',
11,' BY SESSION ', -- default
20, ' BY ACCESS WHENEVER NOT SUCCESSFUL ',
22, ' BY ACCESS',' /* not possible */ ')||' ;'
"AUDIT STATEMENT"
FROM sys.audit$ a, sys.user$ u, sys.stmt_audit_option_map m
WHERE a.user# = u.user# AND a.option# = m.option#
and bitand(m.property, 1) != 1 and a.proxy# is null
and a.user# > 0
UNION
select 'AUDIT '||m.name||decode(u1.name,'PUBLIC',' ',' BY '||u1.name)||
' ON BEHALF OF '|| decode(u2.name,'SYS','ANY',u2.name)||
decode(nvl(a.success,0) + (10 * nvl(a.failure,0)),
1,' WHENEVER SUCCESSFUL ',
2,' WHENEVER SUCCESSFUL ',
10,' WHENEVER NOT SUCCESSFUL ',
11,' ', -- default
20, ' WHENEVER NOT SUCCESSFUL ',
22, ' ',' /* not possible */ ')||';'
"AUDIT STATEMENT"
FROM sys.audit$ a, sys.user$ u1, sys.user$ u2, sys.stmt_audit_option_map m
WHERE a.user# = u2.user# AND a.option# = m.option# and a.proxy# = u1.user#
and bitand(m.property, 1) != 1 and a.proxy# is not null
UNION
select 'AUDIT '||p.name||decode(u.name,'PUBLIC',' ',' BY '||u.name)||
decode(nvl(a.success,0) + (10 * nvl(a.failure,0)),
1,' BY SESSION WHENEVER SUCCESSFUL ',
2,' BY ACCESS WHENEVER SUCCESSFUL ',
10,' BY SESSION WHENEVER NOT SUCCESSFUL ',
11,' BY SESSION ', -- default
20, ' BY ACCESS WHENEVER NOT SUCCESSFUL ',
22, ' BY ACCESS',' /* not possible */ ')||' ;'
"AUDIT STATEMENT"
FROM sys.audit$ a, sys.user$ u, sys.system_privilege_map p
WHERE a.user# = u.user# AND a.option# = -p.privilege
and bitand(p.property, 1) != 1 and a.proxy# is null
and a.user# > 0
UNION
select 'AUDIT '||p.name||decode(u1.name,'PUBLIC',' ',' BY '||u1.name)||
' ON BEHALF OF '|| decode(u2.name,'SYS','ANY',u2.name)||
decode(nvl(a.success,0) + (10 * nvl(a.failure,0)),
1,' WHENEVER SUCCESSFUL ',
2,' WHENEVER SUCCESSFUL ',
10,' WHENEVER NOT SUCCESSFUL ',
11,' ', -- default
20, ' WHENEVER NOT SUCCESSFUL ',
22, ' ',' /* not possible */ ')||';'
"AUDIT STATEMENT"
FROM sys.audit$ a, sys.user$ u1, sys.user$ u2, sys.system_privilege_map p
WHERE a.user# = u2.user# AND a.option# = -p.privilege and a.proxy# = u1.user#
and bitand(p.property, 1) != 1 and a.proxy# is not null
/Regards
Girish Sharma
Edited by: Girish Sharma on Nov 18, 2011 7:18 PM
Just edited that bold fonts are not visible in code tags.
Edited by: Girish Sharma on Nov 18, 2011 7:22 PM
Another editing that "< >" are not visible, so i put it into code tags.
Edited by: Girish Sharma on Nov 18, 2011 7:24 PM
Please use and a.user# less than and greater than sign before 0; i mean not equal to...