OCP 1Z0 052 39
39. Which two statements are true about standard database auditing? (Choose two.)
A.DDL statements can be audited.
B.Statements that refer to stand-alone procedure can be audited.
C.Operations by the users logged on as SYSDBA cannot be audited.
D.Only one audit record is ever created for a session per audited statement even though it is executed more than once.
Answer: AB
D 多次执行，多次记录
C
A.DDL statements can be audited.
B.Statements that refer to stand-alone procedure can be audited.
C.Operations by the users logged on as SYSDBA cannot be audited.
D.Only one audit record is ever created for a session per audited statement even though it is executed more than once.
Answer: AB
A B
object Specify the name of the object to be audited. The object must be a table, view, sequence, stored procedure, function, package, materialized view, mining model, or library.ddl 审计前面已有案例
下面是proc的审计
SQL> CREATE OR REPLACE PROCEDURE p_showdate AS
2 BEGIN
3 dbms_output.put_line(to_char(SYSDATE, 'yyyy-mm-dd hh24:mi:ss'));
4 END;
5 /
Procedure created
Executed in 0.359 seconds
SQL> audit execute on p_showdate;
Audit succeeded
SQL> set serveroutput on
SQL> exec p_showdate;
2014-06-11 15:58:17
PL/SQL procedure successfully completed
SQL>
SQL> SELECT TIMESTAMP, owner, obj_name, sql_text
2 FROM dba_audit_trail
3 WHERE username = 'TEST'
4 AND obj_name = upper('p_showdate');
TIMESTAMP OWNER OBJ_NAME SQL_TEXT
----------- ------ ---------- --------------------------------------------------
2014-06-11 TEST P_SHOWDATE begin p_showdate; end;
D 多次执行，多次记录
SQL> exec p_showdate;
2014-06-11 16:00:13
PL/SQL procedure successfully completed
Executed in 0 seconds
SQL> exec p_showdate;
2014-06-11 16:00:14
PL/SQL procedure successfully completed
Executed in 0 seconds
SQL>
SQL> SELECT TIMESTAMP, owner, obj_name, sql_text
2 FROM dba_audit_trail
3 WHERE username = 'TEST'
4 AND obj_name = upper('p_showdate');
TIMESTAMP OWNER OBJ_NAME SQL_TEXT
----------- ------ ---------- --------------------------------------------------
2014-06-11 TEST P_SHOWDATE begin p_showdate; end;
2014-06-11 TEST P_SHOWDATE begin p_showdate; end;
2014-06-11 TEST P_SHOWDATE begin p_showdate; end;
3 rows selected
C
<span style="font-family: Tahoma, sans-serif; ">SQL> alter system set AUDIT_SYS_OPERATIONS=TRUE scope=spfile;</span>
System altered.
SQL> startup force;
ORACLE instance started.
Total System Global Area 778387456 bytes
Fixed Size 1405452 bytes
Variable Size 285216244 bytes
Database Buffers 486539264 bytes
Redo Buffers 5226496 bytes
Database mounted.
Database opened.
SQL> exit
Disconnected from Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
G:\Tools\Console2>sqlplus sys/ofbiz as sysdba
SQL*Plus: Release 11.2.0.4.0 Production on Wed Jun 11 16:21:03 2014
Copyright (c) 1982, 2013, Oracle. All rights reserved.
Connected to:
Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
SQL> SELECT sessionid,t.action,t.comment_text,sql_text
2 FROM dba_audit_trail t
3 /
SESSIONID ACTION COMMENT_TEXT SQL_TEXT
---------- ---------- -------------------------------------------------------------------------------- --------------------------------------------------
120014 49 alter system set AUDIT_SYS_OPERATIONS=TRUE
130012 100 Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=192.168
130013 100 Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=192.168
130014 100 Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=192.168
4 rows selected