HANA审计策略

参考《SAP_HANA_Administration_Guide_en.pdf》  8.3章节 Auditing Activity in the SAP HANA Database

• Activate and Configure Auditing | Create an Audit Policy

You have the system privilege AUDIT ADMIN

 

• If necessary, specify the target object(s) to be audited.

You must specify a target object if the actions to be audited involve data manipulation, for example, the actions SELECT, INSERT, UPDATE, DELETE, and EXECUTE. The actions in the policy will only be audited when they are performed on the specified object or objects.

When specifying target objects, note the following:

○ You can only enter schemas, tables, views, procedures, and functions.

○ The target object must be valid for all actions in the policy.

○ An object does not have to exist before it can be named as the target object of an audit policy. However, if the object does not exist, it cannot be audited by the audit policy. When an object with the specified name is subsequently created, the audit policy will apply for the object, assuming it is of a type that can be audited and the audited action applies to that object type. For example, if the audited action is EXECUTE, the subsequently created object must be a procedure.

• Audit Trail Targets
• Syslog

The syslog is a secure storage location for the audit trail because not even the database administrator can access or change it. There are also numerous storage possibilities for the syslog, including storing it on other systems. In addition, the syslog is the default log daemon in UNIX systems. The syslog therefore provides a high degree of flexibility and security, as well as integration into a larger system landscape. For more information about how to configure syslog, refer to the documentation of your operating system.

• Internal database table:

Audit entries are only accessible through the public system view AUDIT_LOG. Only SELECT operations can be performed on this view by users with the system privilege AUDIT OPERATOR or AUDIT ADMIN.

• CSV text file

the option exists to store the audit trail in a CSV text file. This should only be used for test purposes in non-production systems. A separate CSV file is created for every service that executes SQL

Caution!!!

You must not use a CSV text file for a production system as it has severe restrictions.

• CLEAR  THE TABLE

 You have the system privilege AUDIT OPERATOR

1. ALTER SYSTEM CLEAR AUDIT LOG UNTIL '2017-11-07 15:00:00'

1. If the table has grown so large that there is not enough memory available to delete old entries as described here, you can use the SQL command ALTER SYSTEM CLEAR AUDIT LOG ALL to completely empty the table