Privilege Auditing - Oracle

Auditing system privileges using the AUDIT command has the same basic syntax as statement auditing, except that system privileges are specified in the sql_statement_clause  instead of statements.

For example, you may wish to grant theALTER TABLESPACEprivilege to all your DBAs but you want to generate an audit record when this happens. The command to enable auditing on this privilege looks similar to statement auditing:

SQL> audit alter tablespace by access whenever successful;
Audit succeeded.

Every time theALTER TABLESPACEprivilege is successfully used, a row is added toSYS.AUD$.

Special auditing is available to enable you to track system administrators’ use of theSYSDBAandSYSOPERprivileges. To enable this extra level of auditing, set the initialization parameterAUDIT_SYS_OPERATIONStoTRUE. The audit records are sent to the same location as the operating system audit records; therefore, this location is operating-system-dependent. All SQL statements executed while using one of these privileges, as well as any SQL statements executed as the userSYS, are sent to this operating system audit location.

Schema Object Auditing

Auditing access to various schema objects using the AUDIT command looks similar to statement and privilege auditing:

AUDIT command looks similar to statement and privilege auditing:Auditing access to various schema objects using the AUDIT command looks similar to statement and privilege auditing:

AUDIT schema_object_clause BY {SESSION | ACCESS}
     WHENEVER [NOT] SUCCESSFUL;

Theschema_object_clause specifies a type of object access and the object being accessed. You can audit 13 different types of operations on specific objects; they are listed in Table 31-15.

Table 31-15. Object Auditing Options  

If you wish to audit allINSERTandUPDATEcommands on theHR.JOBStable, regardless of who is doing the update, every time the action occurs, you can use theAUDITcommand as follows:

SQL> audit insert, update on hr.jobs by access whenever successful;
Audit successful.