Enable security auditing

This topic describes how to enable the auditing feature and set the storage location for auditing records.

In OceanBase Database, auditing-related operations are performed by the built-in ORAAUDITOR user. The password and privileges for this user are specified by the SYS user.

Procedure

1. Log in to the Oracle-compatible tenant as the SYS user and unlock the ORAAUDITOR user.

   obclient> ALTER USER ORAAUDITOR ACCOUNT UNLOCK;
   

   Note

   By default, the ORAAUDITOR user is created in OceanBase Database and is locked. You must unlock this user before enabling security auditing.

2. Set the login password for the ORAAUDITOR user.

   For security, the login password for the ORAAUDITOR user must be specified by the SYS user. If you need to change the password later, set a new one.

   obclient> ALTER USER ORAAUDITOR IDENTIFIED BY ******;
   

3. Grant privileges to the ORAAUDITOR user.

   By default, the ORAAUDITOR user has no privileges. To perform security auditing operations, grant the CREATE SESSION privilege to the ORAAUDITOR user using the GRANT statement. To allow the user to view auditing records, also grant the SELECT ANY DICTIONARY privilege.

   obclient> GRANT CREATE SESSION, SELECT ANY DICTIONARY TO ORAAUDITOR;
   

4. Enable the auditing feature and set the storage location for auditing records.

   Enable the auditing feature by setting the audit_trail parameter. The setting takes effect immediately. Valid values for this parameter are:

   • NONE: disables auditing (default value).

   • OS: writes auditing records to local disk files.

   • DB: writes auditing records to internal tables.

   • DB,EXTENDED / DB_EXTENDED: writes auditing records to internal tables and includes executed SQL statements.

   Example:

   obclient> ALTER SYSTEM SET audit_trail = 'DB,EXTENDED';
   

   For more information about the audit_trail parameter, see audit_trail.

   Note

   Auditing records can be written to internal tables or local disk files:

   • Disk files: Auditing records are asynchronously written to the /audit/ directory. The default file is /home/admin/oceanbase/audit/observer_xx_xxxxxx.aud.
   • Internal tables: Audit information is written directly to system tables. The internal table __all_tenant_security_audit_record stores audit records. The internal tables __all_virtual_audit_operation and __all_virtual_audit_action store mappings between audit-related ID and Name fields.

What to do next

After enabling security auditing, you can set specific security auditing rules. For more information, see Set and view auditing rules.

References

For more information about security auditing, see:

• Set and view auditing rules
• View auditing records