Enable security audit

This topic describes how to enable security audit and set the storage location for audit records.

The audit operations in OceanBase Database are generally performed by ORAAUDITOR, whose password and privileges are specified by the sys user.

Limitations

Currently, only the Oracle mode of OceanBase Database supports the security audit feature.

Procedure

1. Log on to an Oracle tenant as the sys user and unlock the ORAAUDITOR user.

   obclient> ALTER USER ORAAUDITOR ACCOUNT UNLOCK;
   

   Note

   OceanBase Database automatically creates the ORAAUDITOR user. This user is locked by default and needs to be unlocked before you enable security audit.

2. Change the logon password of the ORAAUDITOR user.

   For security purposes, the logon password of the ORAAUDITOR user needs to be specified by the sys user. If you need to change the password later, simply specify a new password.

   obclient> ALTER USER ORAAUDITOR IDENTIFIED BY ******;
   

3. Grant privileges to the ORAAUDITOR user.

   By default, the ORAAUDITOR user has no privileges. To perform security audit operations, this user needs to be granted the CREATE SESSION privilege using the GRANT statement. If you want the ORAAUDITOR user to be able to view audit records, you also need to grant the SELECT ANY DICTIONARY privilege to the user.

   obclient> GRANT CREATE SESSION, SELECT ANY DICTIONARY TO ORAAUDITOR;
   

4. Enable security audit and set the storage location for audit records.

   The security audit feature is controlled by the audit_trail parameter. The configuration takes effect immediately after this parameter is set. The valid values of this parameter are as follows:

   • NONE: disables security audit. This is the default value.

   • OS: writes audit records to local disk files.

   • DB: writes audit records to internal tables.

   • DB,EXTENDED / DB_EXTENDED: writes audit records (including executed SQL statements) to internal tables.

   Here is an example:

   obclient> ALTER SYSTEM SET audit_trail = 'DB,EXTENDED';
   

   For more information about the audit_trail parameter, see audit_trail.

   Note

   Audit records support two methods of storage:

   • Writing to local disk files: Audit records are asynchronously written to /audit/ , by default located at /home/admin/oceanbase/audit/observer_xx_xxxxxx.aud.
   • Writing to internal tables: Audit records are directly written to system tables. The internal table __all_tenant_security_audit_record stores the audit records, while the internal table __all_virtual_audit_operation or __all_virtual_audit_action stores the mappings of audit-related IDs and Names.

What to do next

Set audit rules after you enable security audit. For information about how to set audit rules, see Set and view audit rules.

References

For more information about audit operations, see the following topics:

• Set and view audit rules
• View audit records