AUDIT_LOG_ENCRYPTION_PASSWORD_GET

Purpose

This function returns the encryption password for an archived file based on the pwd_id (encryption key identifier) in the archived audit log file name. The password is used for offline decryption, forensic analysis, or integration with external tools in a controlled environment.

Syntax

AUDIT_LOG_ENCRYPTION_PASSWORD_GET(pwd_id);

Privilege requirements

You must have the SUPER privilege to use this function.

Description

Parameters

• pwd_id: An integer that indicates the key identifier after the .enc. segment in the encrypted archive file name, such as 1001. If this parameter is omitted, the password corresponding to the latest pwd_id is returned.

Limitations

• Similar to other audit functions: it must be used directly and exclusively as an output column in a SELECT statement, and cannot be used in subqueries.
• This function applies only to scenarios where audit records are written to disk files (audit_trail is LOG).

Return value

The function returns a string.

• When the query is successful, returns the password corresponding to pwd_id.
• When a query fails, the SELECT statement may still execute successfully, but the function returns an error message.

Examples

Get the encryption password of the latest archived log:

SELECT AUDIT_LOG_ENCRYPTION_PASSWORD_GET() FROM DUAL;

Assume an archive file is named audit.log.20231031080646317.enc.1001. In this case, you can pass 1001 as the pwd_id (please replace it with the identifier parsed from your actual file name):

SELECT AUDIT_LOG_ENCRYPTION_PASSWORD_GET(1001) FROM DUAL;

The return result is as follows (the actual key content is omitted):

+-------------------------------------------+
| AUDIT_LOG_ENCRYPTION_PASSWORD_GET(1001)   |
+-------------------------------------------+
| <password>                                    |
+-------------------------------------------+
1 row in set

References

• AUDIT_LOG_ENCRYPTION_PASSWORD_SET
• Set and view audit rules