我以只读模式打开oracle数据库只是为了测试溢出文件,此外我在操作选择表上创建了简单的统一审核策略,问题是当我选择表时不会生成溢出文件。 (在读写模式下此策略有效)
一般信息
启用统一审核
启用统一审核策略
SELECT * FROM AUDIT_UNIFIED_ENABLED_POLICIES WHERE POLICY_NAME = 'TEST';
USER_NAME|POLICY_NAME|ENABLED_OPT|SUCCESS|FAILURE|
---------+-----------+-----------+-------+-------+
ALL USERS|TEST |BY |YES |YES |
SELECT POLICY_NAME, AUDIT_OPTION, AUDIT_OPTION_TYPE, OBJECT_SCHEMA, OBJECT_NAME, OBJECT_TYPE, AUDIT_UNIFIED_POLICIES WHERE POLICY_NAME = 'TEST';
POLICY_NAME|AUDIT_OPTION|AUDIT_OPTION_TYPE|OBJECT_SCHEMA|OBJECT_NAME|OBJECT_TYPE|
-----------+------------+-----------------+-------------+-----------+-----------+
TEST |SELECT |OBJECT ACTION |KAMRAN |T1 |TABLE |
SQL> SELECT OPEN_MODE FROM V$DATABASE;
OPEN_MODE
--------------------
READ ONLY
SQL> show parameter audit
NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
audit_file_dest string /u01/app/oracle/admin/ORCL/adu
mp
audit_sys_operations boolean TRUE
audit_syslog_level string
audit_trail string OS
unified_audit_sga_queue_size integer 1048576
SQL>
生成溢出文件。
即使你设置了'audit_file_dest',如果数据库是只读的,那么你会在$ORACLE_BASE/audit/$ORACLE_SID中找到统一的审计记录