Oracle审计日志快速设置

ALTER SYSTEM SET AUDIT_FILE_DEST='/audit_logs' SCOPE=SPFILE;

chown -R oracle:dba /audit_logs

SELECT * FROM dba_audit_trail WHERE action_name LIKE '%SQL%' 
INTO OUTFILE '/your/path/to/file.csv' FIELDS TERMINATED BY ',' OPTIONALLY ENCLOSED BY '"';

sqlplus / as sysdba

SQL> SHOW PARAMETER AUDIT

NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
audit_file_dest                      string      /data/app/oracle/admin/orcl/ad
                                                 ump
audit_sys_operations                 boolean     FALSE
audit_syslog_level                   string
audit_trail                          string      DB

ALTER SYSTEM SET AUDIT_TRAIL='NONE' SCOPE=SPFILE;

SQL> shutdown immediate;
SQL> startup;

SQL> show parameter audit_trail

NAME TYPE VALUE

audit_trail string FALSE

SQL> alter system set audit_sys_operations=TRUE scope=spfile;--审计管理用户(以sysdba/sysoper角色登陆)
SQL> alter system set audit_trail=db,extended scope=spfile; -- 这是将审计数据放入数据库中
SQL> ALTER SYSTEM SET audit_trail='xml' SCOPE=spfile; -- 这是将审计数据放入xml文件中

查询目前的日志信息：select * FROM SYS.AUD$;
删除已有的审计信息：DELETE FROM SYS.AUD$;

truncate table SYS.AUD$;