Pete Finnigan's Oracle Security Weblog

I found a good question posted on comp.databases.oracle.server today by Daniel Morgan. He has just inherited a 7.3.3 database on Solaris (Not current version) and wanted to know how to audit connections and actions as SYS, SYSTEM and INTERNAL to meet requirements of Sarbanes-Oxley.

A number of people have posted so far to the thread. This question is interesting as the version of Oracle is before Fine Grained Audit and Row Level security, system triggers, auditing of SYS operations and any other useful feature that could be used to audit these users actions.

My contribution to the thread was this:

"Hi Daniel,

I can think of one way, which is not particularly practical. You could
sniff the network traffic to the server and extract the SQL, DDL and
connections to and from it. To do so you would need to sit directly in
front of the server hosting the database. You would need to extract the
time, user and the SQL from the packets and ideally store them in
another database for querying. You could use a packet sniffer or
possibly SQL*Net trace on the server.

Don't forget about SQL*net logs and the listener log to get connections.

There are commercial products available that already do this. I don't
know the licence costs of them. There is Chakra from OR Solutions,
Guardium SQL Guard from Guardium, Entregra for Oracle from Lumigent,
Zeus Extensible Traffic Manager from Zeus technology and also Integrigy
and Application security Inc are both about to release IDS / firewall
type products which slightly less fill the bill. There are links to all
of these on my tools page in the commercial section - see
/tools.htm

A possible other way would be to poll the SGA and extract the SQL, but
this method could "lose" SQL if you do not poll fast enough and also
would hurt the database. It is possible to do the same by reading the
SGA directly with C programs. Writing a program to just extract SQL
would not be that difficult. There are commercial tuning products that
do this (access the SGA directly) but whether you can stream the SQL out
of them or not, i am not sure. There are some papers on direct SGA
access on my site at /other.htm - I also
talked about the same in my Oracle security web log recently -
see /weblog/entries/index.htm

hope this helps a bit,

kind regards

Pete"