Pete Finnigan's Oracle Security Forum


    
      
        Pete Finnigan's Oracle Security Forum
        (http://www.petefinnigan.com/forum/yabb/YaBB.cgi)
      

        Oracle Security >> Oracle Security >> Auditing alter statments
        
(Message started by: Pete Finnigan on Jun 26^th, 2006, 11:57pm)

Title: Auditing alter statments
Post by Pete Finnigan on Jun 26^th, 2006, 11:57pm

I'm been trying to audit alter statements on application schema owner accounts but apparently i couldn't get it to work. i tried "audit alter session by username" and as the user, i altered session's workarea_size_policy to manual. Shouldn't i expect to see a trail logged in aud$ for the alter session.

audit_trail is set to DB, 10gR1.

Any pointers in appreicated.

Thanks,
Stalin

Title: Re: Auditing alter statments
Post by Pete Finnigan on Jun 27^th, 2006, 4:23am

"audit alter session by username"
This will create an audit record where the ALTER SESSION privilege is used.
However most of the ALTER SESSION commands don't actually need the ALTER SESSION privilege. In fact the 10GR2 doc states :
"To enable and disable the SQL trace facility, you must have ALTER SESSION system privilege."
You need it for ALTER SESSION SET EVENTS....

Everything else seems pretty much fair game.