1) The document discusses Oracle database auditing features before and after version 12.1. It describes migrating the audit trail to the unified audit trail and using the SYS.UNIFIED_AUDIT_TRAIL table. 2) It provides steps to configure syslog auditing on Linux for Oracle database audit records. Procedures are created to output messages to syslog and call it from a fine-grained auditing policy handler. 3) An example fine-grained auditing policy is created to audit access to the SECDEMO.CUSTOMER table and call the syslog handler for non-application users.

1. 2017.01.17 - JPOUG in 15 minutes #3
Michitoshi Yoshida
(@miyosh0008)

2. Oracle DB

3. before 12.1
FGA_LOGS$
AUDIT_FILE_DEST
AUD$
AUDIT_FILE_DEST
syslog
AUDIT_FILE_DEST
DB
DB
DBA
DB
AUDIT_TRAIL
AUDIT_SYS_OPERATIONS
AUDIT_SYSLOG_LEVEL
DBMS_FGA
OS
OS
OS
OS
orz

4. from 12.1
DBA
DB
DBMS_FGA
SYS.UNIFIED_AUDIT_TRAIL
DB

5. •
➡
➡
※ immediate write mode
➡ DataPump : SQL*Loader
RMAN
•
➡
➡ syslog OS

6. 1.
#
$ cd $ORACLE_HOME/rdbms/lib
$ make -f ins_rdbms.mk uniaud_on ioracle
--
SQL> select value from v$option WHERE parameter=‘Unified Auditing’;
VALUE
-----------
TRUE

7. 2. : SYSAUX
--
-- ※
SQL> alter user AUDSYS quota unlimited on AUDITTBS;
SQL> begin
DBMS_AUDIT_MGMT.SET_AUDIT_TRAIL_LOCATION (
AUDIT_TRAIL_TYPE => DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED,
AUDIT_TRAIL_LOCATION_VALUE => ‘AUDITTBS’
);
end;
/

8. 3.
-- AUDIT_ADMIN
-- -
-- -
-- -
SQL> create user AUDITADMIN identified by **********;
SQL> grant CREATE SESSION,AUDIT_ADMIN to AUDITADMIN;
-- AUDIT_VIEWER
-- -
SQL> create user AUDITVIEWER identified by **********;
SQL> grant CREATE SESSION,AUDIT_VIEWER to AUDITVIEWER;

9. •
→
•
➡ sys system
➡

10. • ORA_SECURECONFIG
• ORA_LOGON_FAILURES
46
EXECUTE
on
SYS.DBMS_RLS DROP
DIRECTORY CREATE
ANY
JOB DROP
PUBLIC
SYNONYM
ALTER
DATABASE
LINK DROP
PLUGGABLE
DATABASE CREATE
ANY
LIBRARY DROP
USER
ALTER
PLUGGABLE
DATABASE DROP
PROFILE CREATE
ANY
PROCEDURE EXEMPT
ACCESS
POLICY
ALTER
PROFILE DROP
ROLE CREATE
ANY
SQL
TRANSLATION
PROFILE EXEMPT
REDACTION
POLICY
ALTER
ROLE SET
ROLE CREATE
ANY
TABLE GRANT
ANY
OBJECT
PRIVILEGE
ALTER
USER ADMINISTER
KEY
MANAGEMENT CREATE
EXTERNAL
JOB GRANT
ANY
PRIVILEGE
CREATE
DATABASE
LINK ALTER
ANY
PROCEDURE CREATE
PUBLIC
SYNONYM GRANT
ANY
ROLE
CREATE
DIRECTORY ALTER
ANY
SQL
TRANSLATION
PROFILE CREATE
SQL
TRANSLATION
PROFILE LOGMINING
CREATE
PLUGGABLE
DATABASE ALTER
ANY
TABLE CREATE
USER PURGE
DBA_RECYCLEBIN
CREATE
PROFILE ALTER
DATABASE DROP
ANY
PROCEDURE TRANSLATE
ANY
SQL
CREATE
ROLE ALTER
SYSTEM DROP
ANY
SQL
TRANSLATION
PROFILE
DROP
DATABASE
LINK AUDIT
SYSTEM DROP
ANY
TABLE

11. --
SQL> create audit policy NONAPP_ACCESS_CUSTOMER
actions
ALL ON SECDEMO.CUSTOMER
when
'SYS_CONTEXT(''USERENV'',''SESSION_USER'') <> ''SECDEMO''
or SYS_CONTEXT(''USERENV'',''IP_ADDRESS'') <> ''192.168.114.233'''
evaluate per statement
;
--
SQL> audit policy NONAPP_ACCESS_CUSTOMER;

14. SQL
UNIFIED_AUDIT_TRAIL
: Oracle EM Cloud Control

15. ※
Enterprise Edition

16. —
•
→
Oracle® Database 12c 1 (12.1)
http://docs.oracle.com/cd/E57425_01/121/DBSEG/audit_config.htm#GUID-
AAE7D86F-4C64-402A-9D3E-BE7D13196E22

17. DB
DoS
syslog
syslog

18. • SECDEMO CUSTOMER
•
• syslog

19. syslog 1/4
1. syslog
# Oracle DB C RHEL/Oracle Linux 6
$ vi $ORACLE_HOME/hs/admin/extproc.ora
SET EXTPROC_DLLS=
!!!
SET EXTPROC_DLLS=DLL:/lib64/libc.so.6
— syslog
SQL> create or replace library libc as
'/lib64/libc.so.6';
/
SQL> create or replace procedure output_syslog (priority binary_integer, message varchar2) is
external
library libc
name "syslog"
language C
calling standard C
parameters(
priority
, message string
);
/

20. syslog 2/4
2. syslog
-- syslog
SQL> create or replace procedure fga_warn_syslog (
object_schema varchar2 ,
object_name varchar2 ,
policy_name varchar2
)
is
LOG_WARNING constant binary_integer := 4;
MSG VARCHAR2(4000);
begin
MSG := 'Oracle Audit Trail ';
MSG := MSG || 'DB_NAME="' || sys_context('USERENV','DB_NAME') || '", ';
MSG := MSG || 'SESSION_USER="' || sys_context('USERENV','SESSION_USER') || '", ';
MSG := MSG || 'CLIENT_IDENTIFIER="' || sys_context('USERENV','CLIENT_IDENTIFIER') || '", ';
MSG := MSG || 'HOST="' || sys_context('USERENV','HOST') || '", ';
MSG := MSG || 'MODULE="' || sys_context('USERENV','MODULE') || '", ';
MSG := MSG || 'OS_USER="' || sys_context('USERENV','OS_USER') || '", ';
MSG := MSG || 'CURRENT_SQL="' || sys_context('USERENV','CURRENT_SQL') || ‘“‘;
-- output_syslog syslog
output_syslog(LOG_WARNING, MSG);
end;
/

21. syslog 3/4
3. Optional
--
SQL> create or replace function audit_secdemo_is_nonapp
return number
as
begin
--
-- 1. : system
-- 2. : DB
-- 3.
if sys_context('USERENV','SESSION_USER') <> 'SECDEMO'
or sys_context('USERENV','HOST') <> 'olvsecdap1.intellilink.co.jp'
or sys_context('USERENV','IP_ADDRESS') <> '192.168.114.233'
or sys_context('USERENV','CLIENT_IDENTIFIER') is null
then return 1;
else return 0;
end if;
end;
/

22. syslog 4/4
4.
-- SECDEMO.CUSTOMER
SQL> begin
DBMS_FGA.ADD_POLICY (
object_schema => ‘SECDEMO’,
object_name => ‘CUSTOMER’,
statement_types => ‘SELECT, UPDATE, DELETE’
policy_name => ‘SECDEMO_CUSTOMER_NONAP_ACCESS’,
audit_condition => ‘audit_secdemo_is_nonapp=1’,
handler_module => ‘fga_warn_syslog’,
enable => TRUE
);
end;
/

23. system CUSTOMER
# tail -n 1 /var/log/messages
Jan 14 20:17:33 olvdapd01 extproc: Oracle Audit Trail
DB_NAME="orcl1", SESSION_USER="SYSTEM",
CLIENT_IDENTIFIER="", HOST="olvdapd01.intellilink.co.jp",
MODULE="SQL*Plus", OS_USER="oracle", CURRENT_SQL="select *
from CUSTOMER where ROWNUM <= 10”

26. BI

27. https://github.com/airbnb/superset
Airbnb OSS BI
• Python Web pip
→ PC OK
• MySQL Oracle
•

28. 1.
• Oracle InstantClient (http://www.slideshare.net/MichitoshiYoshida1/dba-
oracle-database) ※ 20
• cx_Oracle (pip install cx_Oracle)
• superset (http://airbnb.io/superset/installation.html)
2.
Sources > Databases > Add
Oracle URI: oracle://<user>:<password>@<host>:<port>/<service>
: oracle://auditviewer:welcome1@192.168.56.101:1521/orcl1
3.
4. Slice
5. →

29. DB
Distribution - Bar Chart
Table ViewFilter

30. m(_ _)m