Enable security audit

This topic describes how to enable security audit and set the storage location for the audit records.

You can perform audit operations in OceanBase Database as the ORAAUDITOR user. The password and privileges of this user are specified by the SYS user.

Limitations

OceanBase Database supports security audit only in Oracle mode.

Procedure

1. Log on to an Oracle tenant as the sys user and unlock the ORAAUDITOR user.

   obclient> ALTER USER ORAAUDITOR ACCOUNT UNLOCK;
   

   Note:

   The ORAAUDITOR user is created in OceanBase Database by default. By default, this user is locked. You must unlock this user before you enable security audit.

2. Change the logon password of the ORAAUDITOR user.

   For security purposes, the password of the ORAAUDITOR user is specified by the sys user. You can change the password based on your business needs.

   obclient> ALTER USER ORAAUDITOR IDENTIFIED BY ******;
   

3. Grant privileges to the ORAAUDITOR user.

   By default, the ORAAUDITOR user is not granted any privileges. You must execute the GRANT statement to grant the CREATE SESSION privilege to the ORAAUDITOR user before you can perform audit operations. If you allow the ORAAUDITOR user to view audit records, grant the SELECT ANY DICTIONARY privilege to the user.

   obclient> GRANT CREATE SESSION, SELECT ANY DICTIONARY TO ORAAUDITOR;
   

4. Enable security audit and set the storage location for the audit records.

   You can set the audit_trail parameter to enable security audit. After it is set, the configuration immediately takes effect. Valid values of this parameter are:

   • NONE: disables security audit. This is the default value.

   • OS: writes audit records into a local disk file.

   • DB: writes audit records into an internal table.

   • DB,EXTENDED / DB_EXTENDED: writes audit records and executed SQL statements into an internal table.

   Example:

   obclient> ALTER SYSTEM SET audit_trail = 'DB,EXTENDED';
   

   For more information about the audit_trail parameter, see audit_trail.

   Note:

   You can choose an internal table or a local disk file to store the audit records.

   • If you choose to write audit records into a local disk file, the audit records are written into the < installation directory >/audit/ directory in asynchronous write mode. The default installation directory is /home/admin/oceanbase/audit/observer_xx_xxxxxx.aud.
   • If you choose to write audit records into an internal table, OceanBase Database automatically writes audit records into the system table. The internal table __all_tenant_security_audit_record stores the audit records. The internal table __all_virtual_audit_operation or __all_virtual_audit_action stores mappings of IDs and names related to the audit.

What to do next

You can set audit rules after you enable security audit. For more information about how to set audit rules, see Set and view audit rules.

References

For more information about audit operations, see the following topics:

• Set and view audit rules
• View audit records