Enable security auditing

This topic describes how to enable the auditing feature and set the storage location for auditing records.

In OceanBase Database, auditing-related operations are performed by the built-in ORAAUDITOR user. The password and privileges for this user are specified by the SYS user.

Procedure

1. Log in to the Oracle-compatible tenant as the SYS user and unlock the ORAAUDITOR user.

   obclient> ALTER USER ORAAUDITOR ACCOUNT UNLOCK;
   

   Note

   By default, the ORAAUDITOR user is created in OceanBase Database and is locked. You must unlock this user before enabling security auditing.

2. Set the login password for the ORAAUDITOR user.

   For security, the login password for the ORAAUDITOR user must be specified by the SYS user. If you need to change the password later, set a new one.

   obclient> ALTER USER ORAAUDITOR IDENTIFIED BY ******;
   

3. Grant privileges to the ORAAUDITOR user.

   By default, the ORAAUDITOR user has no privileges. To perform security auditing operations, grant the CREATE SESSION privilege to the ORAAUDITOR user using the GRANT statement. To allow the user to view auditing records, also grant the SELECT ANY DICTIONARY privilege.

   obclient> GRANT CREATE SESSION, SELECT ANY DICTIONARY TO ORAAUDITOR;
   

4. Enable the auditing feature and set the storage location for auditing records.

   Enable the auditing feature by setting the audit_trail parameter. The setting takes effect immediately. Valid values for this parameter are:

   • NONE: disables auditing (default value).

   • OS: writes auditing records to local disk files.

   • LOG: writes auditing records to the audit log. This value is supported starting from V4.4.2 BP2.

   • DB: writes auditing records to internal tables.

   • DB,EXTENDED / DB_EXTENDED: writes auditing records to internal tables and includes executed SQL statements.

   Example:

   obclient> ALTER SYSTEM SET audit_trail = 'DB,EXTENDED';
   

   For more information about the audit_trail parameter, see audit_trail.

   Note

   Auditing records can be written to internal tables, local disk files, or audit logs:

   • Disk files: Auditing records are asynchronously written to the /audit/ directory. The default file is /home/admin/oceanbase/audit/observer_xx_xxxxxx.aud.
   • Audit logs: Auditing records are written to audit log files. Management strategies such as log archiving, compression, rotation, cleanup, and encryption are supported. This feature is available starting with V4.4.2 BP2.
   • Internal tables: Audit information is written directly to system tables. The internal table __all_tenant_security_audit_record stores audit records. The internal table __all_virtual_audit_operation or __all_virtual_audit_action stores mappings between audit-related ID and Name fields.

Audit log encryption

When an Oracle-compatible tenant writes audit records to log files (audit_trail set to LOG), it supports storing archived logs on disk in plaintext or encrypted form. Encryption is implemented using the audit_log_encryption parameter and the audit functions AUDIT_LOG_ENCRYPTION_PASSWORD_SET() and AUDIT_LOG_ENCRYPTION_PASSWORD_GET(). For specific steps, see the configuration documentation at the end of this topic.

References

For more information about security auditing, see:

• Set and view auditing rules
• View auditing records
• Overview of audit functions