Auditing sys administrative users

By using standard auditing, operations performed against database objects by sys or users with sysdba and sysoper privileges are not audited. Only details about logon including the terminal and the date are audited by mandatory auditing. This recipe will show you how to enable the audit for sys users.

Getting ready

All steps will be performed on the HACKDB database.

How to do it...

1. In a separate terminal open /var/log/oracle_audit.log with the tail –f command. From a second terminal connect as sysdba and issue a count against the hr.employees table:

   SQL> conn / as sysdba  
   Connected.
   SQL> select count(*) from hr.employees;
     COUNT(*)
   ----------
          107
   

2. If you now look at /var/opt/oracle_audit.log you will see that nothing was recorded.

3. Connect as sysdba and modify audit_sys_operation to true as follows:

   SQL> alter system  set audit_sys_operations=true scope=spfile;
   

4. Bounce the database.

5. Connect as sysdba and reissue the count against hr.employees:

   SQL...