{"id":643,"date":"2011-11-10T11:55:46","date_gmt":"2011-11-10T08:55:46","guid":{"rendered":"http:\/\/blog.yavor.info\/?p=643"},"modified":"2012-02-05T10:38:36","modified_gmt":"2012-02-05T10:38:36","slug":"11g-no-more-audit-by-session","status":"publish","type":"post","link":"http:\/\/blog.yavor.info\/?p=643","title":{"rendered":"11g: no more &#8222;AUDIT &#8230; BY SESSION&#8220;"},"content":{"rendered":"<p>\u0422\u043e\u0432\u0430 \u0435 \u0435\u0434\u043d\u0430 \u0434\u0440\u0443\u0433\u0430 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0430 \u043c\u043e\u0442\u0438\u043a\u0430 \u043f\u0440\u0438 upgrade \u043e\u0442 10g \u043d\u0430 11g. \u041f\u043e \u0432\u0440\u0435\u043c\u0435 \u043d\u0430 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u0430\u043d\u0438\u0442\u0435 \u0442\u0435\u0441\u0442\u043e\u0432\u0435 \u0437\u0430\u0431\u0435\u043b\u044f\u0437\u0430\u0445\u043c\u0435, \u0447\u0435 audit trail \u0442\u0430\u0431\u043b\u0438\u0446\u0430\u0442\u0430 \u0441\u0435 \u0440\u0430\u0437\u0434\u0443\u0432\u0430 \u0441 \u0431\u044f\u0441\u043d\u0430 \u0441\u043a\u043e\u0440\u043e\u0441\u0442 \u0438 \u0435\u0434\u043d\u0430 \u0437\u0430\u0431\u0435\u043b\u0435\u0436\u0438\u043c\u0430 \u0447\u0430\u0441\u0442 \u043e\u0442 IO \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438\u0442\u0435 \u0441\u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u043f\u0438\u0441\u0430\u043d\u0435 \u0432 SYS.AUD$.<\/p>\n<p>\u041e\u0442\u043a\u0440\u0438\u0445\u043c\u0435 \u0441\u043b\u0435\u0434\u043d\u0430\u0442\u0430 \u043d\u043e\u0442\u0430 \u0432 Metalink:<br \/>\n<a href=\"https:\/\/support.oracle.com\/CSP\/ui\/flash.html#tab=KBHome(page=KBHome&#038;id=()),(page=KBNavigator&#038;id=(viewingMode=1143&#038;bmDocTitle=Huge\/Large\/Excessive%20Number%20Of%20Audit%20Records%20Are%20Being%20Generated%20In%20The%20Database&#038;from=BOOKMARK&#038;bmDocType=TROUBLESHOOTING&#038;bmDocDsrc=KB&#038;bmDocID=1171314.1))\" target=\"_blank\">Huge\/Large\/Excessive Number Of Audit Records Are Being Generated In The Database [ID 1171314.1]<\/a><\/p>\n<blockquote><p>\n1.) Starting with Oracle 11g the BY SESSION clause is obsolete. This is documented in the Database Security Guide :<\/p>\n<p>&#8220; The BY SESSION clause of the AUDIT statement now writes one audit record for every audited event. In previous releases, BY SESSION wrote one audit record for all SQL statements or operations of the same type that were executed on the same schema objects in the same user session. Now, both BY SESSION and BY ACCESS write one audit record for each audit operation. In addition, there are separate audit records for LOGON and LOGOFF events. &#8220;<\/p>\n<p>Because of the above change it is expected that the number of the audit records\/files will grow considerably.<br \/>\n&#8230;\n<\/p><\/blockquote>\n<p>\u0417\u0430\u0441\u0438\u043b\u0432\u0430\u0439\u043a\u0438 \u0441\u0435 \u043a\u044a\u043c \u0434\u043e\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u0446\u0438\u044f\u0442\u0430 \u043e\u0442\u043a\u0440\u0438\u0445 \u0441\u043b\u0435\u0434\u043d\u043e\u0442\u043e:<br \/>\n<a href=\"http:\/\/download.oracle.com\/docs\/cd\/B28359_01\/server.111\/b28286\/statements_4007.htm#SQLRF01107\" target=\"_blank\">Oracle\u00ae Database SQL Language Reference 11g Release 1 (11.1)<\/a><\/p>\n<blockquote><p>\n<strong>BY SESSION<\/strong><\/p>\n<p>In earlier releases, BY SESSION caused the database to write a single record for all SQL statements or operations of the same type executed on the same schema objects in the same session. Beginning with this release of Oracle Database, both BY SESSION and BY ACCESS cause Oracle Database to write one audit record for each audited statement and operation. BY SESSION continues to populate different values to the audit trail compared with BY ACCESS. If you specify neither clause, then BY SESSION is the default.\n<\/p><\/blockquote>\n<p>\u041d\u0430 \u043f\u0440\u0430\u043a\u0442\u0438\u043a\u0430 \u0441\u044a\u0449\u043e\u0442\u043e \u043f\u0438\u0448\u0435 \u0438 \u0432 <a href=\"http:\/\/download.oracle.com\/docs\/cd\/E11882_01\/server.112\/e26088\/statements_4007.htm#SQLRF01107\" target=\"_blank\">Oracle\u00ae Database SQL Language Reference 11g Release 2 (11.2)<\/a><\/p>\n<p>\u041e\u0449\u0435 \u043f\u043e-\u043d\u0435\u044f\u0441\u043d\u043e \u0435 \u043d\u0430\u043f\u0438\u0441\u0430\u043d\u043e\u0442\u043e \u0432 <a href=\"http:\/\/download.oracle.com\/docs\/cd\/E11882_01\/network.112\/e16543\/auditing.htm#BCGHCAED\" target=\"_blank\">Oracle\u00ae Database Security Guide 11g Release 2 (11.2)<\/a><\/p>\n<blockquote><p>\n<strong>Benefits of Using the BY ACCESS Clause in the AUDIT Statement<\/strong><\/p>\n<p>By default, Oracle Database writes a new audit record for every audited event, using the BY ACCESS clause functionality. To use this functionality, either include BY ACCESS in the AUDIT statement, or if you want, you can omit it because it is the default. (As of Oracle Database 11g Release 2 (11.2.0.2), the BY ACCESS clause is the default setting.)<\/p>\n<p>Oracle recommends that you audit BY ACCESS and not BY SESSION in your AUDIT statements. The benefits of using the BY ACCESS clause in the AUDIT statement are as follows:<br \/>\n&#8230;\n<\/p><\/blockquote>\n<p>\u0427\u0435\u0441\u0442\u043d\u043e \u0432\u0438 \u043a\u0430\u0437\u0432\u0430\u043c, \u0442\u0438\u044f \u043d\u0435\u0449\u0430 \u043c\u0438 \u0437\u0432\u0443\u0447\u0430\u0442 \u043a\u0430\u0442\u043e <em>&#8222;\u042a\u044a\u044a\u044a&#8230; \u0431\u0435 \u043d\u0435\u0449\u043e \u0441\u0435 \u043f\u043e\u0432\u0440\u0435\u0434\u0438 \u0442\u043e\u044f BY SESSION, \u0430\u043c\u0430 \u0443\u0441\u043f\u044f\u0445\u043c\u0435 \u0434\u0430 \u0433\u043e \u043f\u043e\u0437\u0430\u043a\u0440\u0435\u043f\u0438\u043c, \u043c\u0430\u043a\u0430\u0440 \u0447\u0435 \u0432\u0435\u0447\u0435 \u0440\u0430\u0431\u043e\u0442\u0438 \u043f\u043e\u0447\u0442\u0438 \u043a\u0430\u0442\u043e BY ACCESS&#8220;<\/em><\/p>\n<p>\u0422\u0440\u044f\u0431\u0432\u0430\u0448\u0435 \u0434\u0430 \u043f\u0440\u0435\u0434\u0435\u0444\u0438\u043d\u0438\u0440\u0430\u043c\u0435 audit \u043f\u043e\u043b\u0438\u0442\u0438\u043a\u0430\u0442\u0430 \u0441\u0438 \u043f\u0440\u0435\u0434\u0438 upgrade-a. \u0417\u0430 \u0449\u0430\u0441\u0442\u0438\u0435 \u043f\u043e\u0432\u0435\u0447\u0435\u0442\u043e <code>noaudit<\/code> \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438 \u0441\u0442\u0430\u0432\u0430\u0442 online. \u0415\u0434\u0438\u043d\u0441\u0442\u0432\u0435\u043d\u043e <code>noaudit execute<\/code> \u043f\u0440\u0430\u0432\u0438 \u0433\u0430\u0434\u043d\u0438 \u0437\u0430\u043a\u043b\u044e\u0447\u0432\u0430\u043d\u0438\u044f \u0438 \u0442\u0440\u044f\u0431\u0432\u0430\u0448\u0435 \u0434\u0430 \u0433\u043e \u043f\u0440\u0430\u0432\u0438\u043c \u043f\u043e \u0432\u0440\u0435\u043c\u0435 \u043d\u0430 downtime. <\/p>\n<p>\u0415\u0442\u043e \u0438 \u0435\u0434\u043d\u043e \u043f\u043e\u043b\u0435\u0437\u043d\u043e query \u043f\u043e \u0432\u044a\u043f\u0440\u043e\u0441\u0430:<\/p>\n<pre class=\"brush:sql\">\r\nselect 'noaudit select on ' || owner || '.' || object_name || ' WHENEVER SUCCESSFUL;'\r\n  from DBA_OBJ_AUDIT_OPTS\r\n where sel like 'S\/%'\r\n   and owner in ('...application schemas...')\r\n   and object_name not in ('...exclusions...')\r\nunion all\r\nselect 'noaudit execute on ' || owner || '.' || object_name || ' WHENEVER SUCCESSFUL;'\r\n  from DBA_OBJ_AUDIT_OPTS\r\n where exe like 'S\/%'\r\n   and owner in ('...application schemas...')\r\n   and object_name not in ('...exclusions...')\r\nunion all\r\nselect 'noaudit update on ' || owner || '.' || object_name || ' WHENEVER SUCCESSFUL;'\r\n  from DBA_OBJ_AUDIT_OPTS\r\n where upd like 'S\/%'\r\n   and owner in ('...application schemas...')\r\n   and object_name not in ('...exclusions...')\r\nunion all\r\nselect 'noaudit insert on ' || owner || '.' || object_name || ' WHENEVER SUCCESSFUL;'\r\n  from DBA_OBJ_AUDIT_OPTS\r\n where ins like 'S\/%'\r\n   and owner in ('...application schemas...')\r\n   and object_name not in ('...exclusions...')\r\nunion all\r\nselect 'noaudit delete on ' || owner || '.' || object_name || ' WHENEVER SUCCESSFUL;'\r\n  from DBA_OBJ_AUDIT_OPTS\r\n where del like 'S\/%'\r\n   and owner in ('...application schemas...')\r\n   and object_name not in ('...exclusions...')\r\n<\/pre>\n<p>\u0418 \u043e\u0449\u0435 \u043d\u0435\u0449\u043e \u043c\u043d\u043e\u0433\u043e \u0432\u0430\u0436\u043d\u043e: \u043d\u0435 \u0437\u0430\u0431\u0440\u0430\u0432\u044f\u0439\u0442\u0435 \u0434\u0430 \u0441\u0438 \u043f\u0440\u0435\u0433\u043b\u0435\u0434\u0430\u0442\u0435 \u043a\u0430\u043a\u0432\u043e \u043f\u0438\u0448\u0435 \u0432 <code>ALL_DEF_AUDIT_OPTS<\/code> <strong>\u043f\u0440\u0435\u0434\u0438<\/strong> upgrade. \u0418\u043d\u0430\u0447\u0435 catupgrd \u0449\u0435 \u0432\u0438 \u0441\u044a\u0437\u0434\u0430\u0434\u0435 \u0445\u0438\u043b\u044f\u0434\u0430 \u0445\u0438\u043b\u044f\u0434\u0438 \u043e\u0431\u0435\u043a\u0442\u0430 \u0441 \u043a\u043e\u0444\u0442\u0438 auditing.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u0422\u043e\u0432\u0430 \u0435 \u0435\u0434\u043d\u0430 \u0434\u0440\u0443\u0433\u0430 \u0438\u043d\u0442\u0435\u0440\u0435\u0441\u043d\u0430 \u043c\u043e\u0442\u0438\u043a\u0430 \u043f\u0440\u0438 upgrade \u043e\u0442 10g \u043d\u0430 11g. \u041f\u043e \u0432\u0440\u0435\u043c\u0435 \u043d\u0430 \u0430\u0432\u0442\u043e\u043c\u0430\u0442\u0438\u0437\u0438\u0440\u0430\u043d\u0438\u0442\u0435 \u0442\u0435\u0441\u0442\u043e\u0432\u0435 \u0437\u0430\u0431\u0435\u043b\u044f\u0437\u0430\u0445\u043c\u0435, \u0447\u0435 audit trail \u0442\u0430\u0431\u043b\u0438\u0446\u0430\u0442\u0430 \u0441\u0435 \u0440\u0430\u0437\u0434\u0443\u0432\u0430 \u0441 \u0431\u044f\u0441\u043d\u0430 \u0441\u043a\u043e\u0440\u043e\u0441\u0442 \u0438 \u0435\u0434\u043d\u0430 \u0437\u0430\u0431\u0435\u043b\u0435\u0436\u0438\u043c\u0430 \u0447\u0430\u0441\u0442 \u043e\u0442 IO \u043e\u043f\u0435\u0440\u0430\u0446\u0438\u0438\u0442\u0435 \u0441\u0430 \u0438\u043c\u0435\u043d\u043d\u043e \u043f\u0438\u0441\u0430\u043d\u0435 \u0432 SYS.AUD$. \u041e\u0442\u043a\u0440\u0438\u0445\u043c\u0435 \u0441\u043b\u0435\u0434\u043d\u0430\u0442\u0430 \u043d\u043e\u0442\u0430 \u0432 Metalink: Huge\/Large\/Excessive Number Of Audit Records Are Being Generated In The Database <a href='http:\/\/blog.yavor.info\/?p=643' class='excerpt-more'>[&#8230;]<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":[],"categories":[1],"tags":[],"jetpack_featured_media_url":"","_links":{"self":[{"href":"http:\/\/blog.yavor.info\/index.php?rest_route=\/wp\/v2\/posts\/643"}],"collection":[{"href":"http:\/\/blog.yavor.info\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blog.yavor.info\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blog.yavor.info\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/blog.yavor.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=643"}],"version-history":[{"count":9,"href":"http:\/\/blog.yavor.info\/index.php?rest_route=\/wp\/v2\/posts\/643\/revisions"}],"predecessor-version":[{"id":706,"href":"http:\/\/blog.yavor.info\/index.php?rest_route=\/wp\/v2\/posts\/643\/revisions\/706"}],"wp:attachment":[{"href":"http:\/\/blog.yavor.info\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=643"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blog.yavor.info\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=643"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blog.yavor.info\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=643"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}