Enable security audit

This topic describes how to enable security audit and set the storage location for audit records.

You can perform audit operations in OceanBase Database as the ORAAUDITOR user. The password and privileges of this user are specified by the SYS user.

Limitations

Currently, only the Oracle mode of OceanBase Database supports the security audit feature.

Procedure

1. Log on to an Oracle tenant as the sys user and unlock the ORAAUDITOR user.

   obclient> ALTER USER ORAAUDITOR ACCOUNT UNLOCK;
   

   Note

   OceanBase Database automatically creates the ORAAUDITOR user. This user is locked by default and needs to be unlocked before you enable security audit.

2. Change the logon password of the ORAAUDITOR user.

   For security purposes, the password of the ORAAUDITOR user is specified by the sys user. You can change the password based on your business needs.

   obclient> ALTER USER ORAAUDITOR IDENTIFIED BY ******;
   

3. Grant privileges to the ORAAUDITOR user.

   By default, the ORAAUDITOR user is not granted any privileges. You must execute the GRANT statement to grant the CREATE SESSION privilege to the ORAAUDITOR user before you can perform audit operations. If you allow the ORAAUDITOR user to view audit records, grant the SELECT ANY DICTIONARY privilege to the user.

   obclient> GRANT CREATE SESSION, SELECT ANY DICTIONARY TO ORAAUDITOR;
   

4. Enable security audit and set the storage location for audit records.

   The security audit feature is controlled by the audit_trail parameter. The configuration takes effect immediately after this parameter is set. The valid values of this parameter are as follows:

   • NONE: disables security audit. This is the default value.

   • OS: writes audit records to local disk files.

   • DB: writes audit records to internal tables.

   • DB,EXTENDED / DB_EXTENDED: writes audit records (including executed SQL statements) to internal tables.

   Here is an example:

   obclient> ALTER SYSTEM SET audit_trail = 'DB,EXTENDED';
   

   For more information about the audit_trail parameter, see audit_trail.

   Note

   You can choose an internal table or a local disk file to store the audit records.

   • If you choose to write audit records into a local disk file, the audit records are written into /audit/ under the installation directory in asynchronous write mode. The default path of the file is /home/admin/oceanbase/audit/observer_xx_xxxxxx.aud.
   • If you choose to write audit records into an internal table, OceanBase Database automatically writes audit records into the system table. The internal table __all_tenant_security_audit_record stores the audit records. The internal table __all_virtual_audit_operation or __all_virtual_audit_action stores mappings of IDs and names related to the audit.

What to do next

You can set audit rules after you enable security audit. For more information about how to set audit rules, see Set and view audit rules.

References

For more information about audit operations, see the following topics:

• Set and view audit rules
• View audit records