Oracle 11g Anti-hacker's Cookbook

Auditing sys administrative users

By using standard auditing, operations performed against database objects by sys or users with sysdba and sysoper privileges are not audited. Only details about logon including the terminal and the date are audited by mandatory auditing. This recipe will show you how to enable the audit for sys users.

Getting ready

All steps will be performed on the HACKDB database.

How to do it...

1. In a separate terminal open /var/log/oracle_audit.log with the tail –f command. From a second terminal connect as sysdba and issue a count against the hr.employees table:

   SQL> conn / as sysdba  
   Connected.
   SQL> select count(*) from hr.employees;
     COUNT(*)
   ----------
          107
   

2. If you now look at /var/opt/oracle_audit.log you will see that nothing ...