Enable security auditing

This topic describes how to enable the auditing feature and set the storage location for audit records.

In OceanBase Database, auditing-related operations are typically performed by the built-in ORAAUDITOR user. The password and privileges of this user are specified by the SYS user.

Procedure

1. Log in to the Oracle-compatible tenant as the SYS user and unlock the ORAAUDITOR user.

   obclient> ALTER USER ORAAUDITOR ACCOUNT UNLOCK;
   

   Note

   The ORAAUDITOR user is created by default in OceanBase Database. This user is locked by default and must be enabled before you can use auditing.

2. Change the login password of the ORAAUDITOR user.

   For security reasons, the login password of the ORAAUDITOR user must be specified by the SYS user. If you need to change the password later, you can specify a new one.

   obclient> ALTER USER ORAAUDITOR IDENTIFIED BY ******;
   

3. Grant privileges to the ORAAUDITOR user.

   The ORAAUDITOR user has no privileges by default. To perform auditing-related operations, you must grant the CREATE SESSION privilege to the ORAAUDITOR user using the GRANT statement. If you want to allow the ORAAUDITOR user to view audit records, you must also grant the SELECT ANY DICTIONARY privilege.

   obclient> GRANT CREATE SESSION, SELECT ANY DICTIONARY TO ORAAUDITOR;
   

4. Enable the auditing feature and set the storage location for audit records.

   You can enable the auditing feature by configuring the audit_trail parameter. The change takes effect immediately after the successful execution of the command. The possible values of this parameter are as follows:

   • NONE: Disable auditing. This is the default value.

   • OS: Write audit records to local disk files.

   • LOG: Write audit records to the audit log.

   • DB: Write audit records to internal tables.

   • DB,EXTENDED / DB_EXTENDED: Write audit records to internal tables and include the executed SQL statements in the records.

   Example:

   obclient> ALTER SYSTEM SET audit_trail = 'DB,EXTENDED';
   

   For more information about the audit_trail parameter, see audit_trail.

   Note

   Audit records can be written to internal tables, local disk files, or audit logs:

   • Write to disk files: Records are asynchronously written to the /audit/ directory, with the default file being /home/admin/oceanbase/audit/observer_xx_xxxxxx.aud.
   • Write to audit logs: Audit records are written to audit log files. Management strategies such as log archiving, compression, rotation, cleanup, and encryption are supported. This feature is available starting from V4.6.1.
   • Write to internal tables: Audit information is directly written to system tables. The internal table __all_tenant_security_audit_record stores audit records; the internal tables __all_virtual_audit_operation or __all_virtual_audit_action store the mapping between audit-related ID and Name.

Audit log encryption

When an Oracle-compatible tenant writes audit records to log files (audit_trail set to LOG), it supports storing archived logs on disk in plaintext or encrypted format. Encryption is implemented using the audit_log_encryption parameter and the audit functions AUDIT_LOG_ENCRYPTION_PASSWORD_SET() and AUDIT_LOG_ENCRYPTION_PASSWORD_GET(). For specific steps, see the configuration documentation at the end of this topic.

References

For more operations related to security auditing, see:

• Set and view audit rules
• View audit records
• Overview of audit functions