Showing posts with label Audit. Show all posts
Showing posts with label Audit. Show all posts

Sunday, September 14, 2014

Moving Audit table AUD$ to its own tablespace



   select owner, tablespace_name from dba_tables where table_name='AUD$';
   
   CREATE SMALLFILE TABLESPACE SCOTT_AUDIT 
   DATAFILE SIZE 100M 
   AUTOEXTEND ON
   NEXT 100K 
   MAXSIZE UNLIMITED 
   LOGGING EXTENT MANAGEMENT LOCAL UNIFORM SIZE 128K
   SEGMENT SPACE MANAGEMENT AUTO  DEFAULT COMPRESS FOR OLTP;
   
   create table audx tablespace SCOTT_AUDIT
      storage (initial 50k next 50k pctincrease 0)
         as select * from aud$ where 1 = 2 ;
   
   rename AUD$ to AUD$_drop ;
   rename audx to aud$ ;
   create index i_aud1
     on aud$(sessionid, ses$tid)
       tablespace SCOTT_AUDIT storage(initial 50k next 50k pctincrease 0) ;
   
   drop table AUD$_drop ;
   purge dba_recyclebin;
   select owner, tablespace_name from dba_tables where table_name='AUD$';
   
   set audit_trail=NONE in init.ora and create spfile 
   
   -- production only
   sqlplus / as sysdba
   audit dba;
   
   select bytes from dba_segments where segment_name='AUD$'
   select bytes from dba_segments where segment_name='AUD$_drop';
   select count(1) from aud$;
   
   These views will show you what auditing is configured:
      Select * from dba_priv_audit_opts;
      Select * from dba_stmt_audit_opts;
      Select * from dba_obj_audit_opts;

Managing Aud$

show parameter audit

-- check tablespaces

SELECT table_name, tablespace_name
FROM   dba_tables
WHERE  table_name IN ('AUD$', 'FGA_LOG$')
ORDER BY table_name;

-- when last deleted
SELECT * FROM dba_audit_mgmt_last_arch_ts;

-- total # of records
SELECT COUNT(*) FROM aud$;

SCOTT_AUDIT is tablespace name

-- change for AUD$
BEGIN
  DBMS_AUDIT_MGMT.set_audit_trail_location(
    audit_trail_type           => DBMS_AUDIT_MGMT.AUDIT_TRAIL_AUD_STD,
    audit_trail_location_value => 'SCOTT_AUDIT');
END;
/

-- change for FGA_LOG$
BEGIN
  DBMS_AUDIT_MGMT.set_audit_trail_location(
    audit_trail_type           => DBMS_AUDIT_MGMT.AUDIT_TRAIL_FGA_STD,
    audit_trail_location_value => 'SCOTT_AUDIT');
END;
/

-- both in single step
BEGIN
  DBMS_AUDIT_MGMT.set_audit_trail_location(
    audit_trail_type           => DBMS_AUDIT_MGMT.AUDIT_TRAIL_DB_STD,
    audit_trail_location_value => 'SCOTT_AUDIT');
END;
/


-- Controlling the Size and Age of the OS Audit Trail

COLUMN parameter_name FORMAT A30
COLUMN parameter_value FORMAT A20
COLUMN audit_trail FORMAT A20

SELECT * FROM   dba_audit_mgmt_config_params

-- Purging Audit Trail Records

COLUMN parameter_name FORMAT A30
COLUMN parameter_value FORMAT A20
COLUMN audit_trail FORMAT A20

SELECT * FROM dba_audit_mgmt_config_params;

BEGIN
  DBMS_AUDIT_MGMT.init_cleanup(
    audit_trail_type         => DBMS_AUDIT_MGMT.AUDIT_TRAIL_ALL,
    default_cleanup_interval => 12 /* hours */);
END;
/

SET SERVEROUTPUT ON
BEGIN
  IF DBMS_AUDIT_MGMT.is_cleanup_initialized(DBMS_AUDIT_MGMT.AUDIT_TRAIL_AUD_STD) THEN
    DBMS_OUTPUT.put_line('YES');
  ELSE
    DBMS_OUTPUT.put_line('NO');
  END IF;
END;
/

-- how much data you wish to purge
COLUMN audit_trail FORMAT A20
COLUMN last_archive_ts FORMAT A40

SELECT * FROM dba_audit_mgmt_last_arch_ts;

-- to deleted manualy, must run DBMS_AUDIT_MGMT.init_cleanup before this
BEGIN
  DBMS_AUDIT_MGMT.clean_audit_trail(
   audit_trail_type        => DBMS_AUDIT_MGMT.AUDIT_TRAIL_AUD_STD,
   use_last_arch_timestamp => FALSE);
END;
/