system_protected_sys_variables

Description

system_protected_sys_variables specifies the list of locked system variables. Global system variables in this list cannot be modified by ordinary users.

Privilege requirements

• Query the parameter

  The sys tenant and all user tenants can use the SHOW PARAMETERS statement or the GV$OB_PARAMETERS view to query this parameter.

• Modify the parameter

  Only the sys tenant can modify this parameter. User tenants cannot modify this parameter.

Attributes

Considerations

• You can add the names of global system variables that you do not want ordinary users to modify to this parameter. After the names are added, ordinary users (including those with the Super privilege) cannot modify these system variables. Only the SYS (Oracle mode) or ROOT (MySQL mode) user can modify them.

• The value of this parameter is specified as follows:

  Separate the names of system variables with commas. The names of system variables are case-insensitive. Do not add spaces before or after commas. Do not start or end with a comma. The format is "para1" or "para1,...,paran"

  Valid examples:

  • "param1"
  • "param1,param2"
  • "param1,param2,param3"

  Invalid examples:

  • ","
  • "param1,"
  • "param1, param2" (space is added after the comma)
  • "param1,param2,"

Examples

Lock the ob_enable_sql_audit system variable to prevent ordinary users from modifying it.

obclient> ALTER SYSTEM SET system_protected_sys_variables = "ob_enable_sql_audit";

Lock the ob_enable_sql_audit and ob_sql_audit_percentage system variables.

obclient> ALTER SYSTEM SET system_protected_sys_variables = "ob_enable_sql_audit,ob_sql_audit_percentage";