A Auditing Oracle Database Vault

Oracle Database Vault Policy Audit Events

Oracle Database Vault uses audit events to track configuration activities.

These activities are as follows:

• Realm Audit. You can audit both successful and failed actions, based on the auditing option that you set when you created the realm. The exception to this is actions performed by the schema owner.

• Rule Set Audit. Audits the rule set processing results. You can audit both successful and failed processing. Realm authorizations can be managed using rule sets. You can audit the rule set processing results. Factor assignments and secure application roles audits can be managed using a rule set.

• Factor Audit. You can audit both successful and failed factor processing. For failed factor processing, you can audit on all or any of the following events: Retrieval Error, Retrieval Null, Validation Error, Validation False, Trust Level Null, or Trust Level Less Than Zero.

• Oracle Label Security Session Initialization Failed. Audits instances where the Oracle Label Security session fails to initialize.

• Oracle Label Security Attempt to Upgrade Session Label Failed. Audits instances where the Oracle Label Security component prevents a session from setting a label that exceeds the maximum session label.

Format of the Oracle Database Vault DVSYS.AUDIT_TRAIL$ Audit Trail Records

If you choose not to use unified auditing, then Oracle Database Vault will write audit records to the AUDIT_TRAIL$ table, which is in the DVSYS schema.

These audit records are not part of the Oracle Database audit trail, and how auditing is enabled in the database has no effect how Oracle Database Vault collects its audit data in the AUDIT_TRAIL$ table. In fact, even if auditing has been disabled in Oracle Database, then the Oracle Database Vault audit functionality continues to write to the AUDIT_TRAIL$ table.

Users who have been granted the DV_OWNER, DV_ADMIN, DV_SECANALYST or DV_MONITOR role can directly query the DVYS.AUDIT_TRAIL$ table.

Table A-1 describes the format of the audit trail, which you must understand if you plan to create custom reports that use the AUDIT_TRAIL$ table.

About Archiving and Purging the Oracle Database Vault Audit Trail

In a non-unified auditing environment, you can create an archive of the Oracle Database Vault audit trail by exporting the AUDIT_TRAIL$ system table, which is owned by DVSYS, to a dump file.

You should periodically archive and then purge the audit trail to prevent it from growing too large.

If you choose to migrate to unified auditing, then use this procedure to archive and purge the Database Vault audit trail records after you complete the migration. When unified auditing begins to collect records, then the new records will be available for viewing from the UNIFIED_AUDIT_TRAIL, SYS.DV$CONFIGURATION_AUDIT, and SYS.DV$ENFORCEMENT_AUDIT data dictionary views.

Archiving the Oracle Database Vault Audit Trail

You can use SQL*Plus and Oracle Data Pump to archive the Oracle Database Vault audit trail.

1. Log into the database instance as user SYS with the SYSDBA administrative privilege.

   sqlplus sys as sysdba
   Enter password: password
   

2. Ensure that the user who will perform archiving has the appropriate privileges.

   For example:

   GRANT CREATE ANY DIRECTORY, EXP_FULL_DATABASE, UNLIMITED TABLESPACE TO psmith;
   

3. Connect as a user who has been granted the DV_OWNER or DV_AUDIT_CLEANUP role.

   For example:

   connect ebrown
   Enter password: password
   

4. Archive the Oracle Database Vault audit trail into a new table in an appropriate schema.

   For example:

   CREATE TABLE psmith.dv_audit_trail nologging \
   AS SELECT * FROM DVSYS.AUDIT_TRAIL$;
   

5. If the schema is already protected by a realm, then ensure that you or the user performing the export operation has been granted the appropriate authorization to use Oracle Data Pump in a Database Vault environment.

   For example, to authorize user psmith to perform Data Pump operations on his own schema:

   EXEC DBMS_MACADM.AUTHORIZE_DATAPUMP_USER('PSMITH', 'PSMITH');
   

6. Connect as the Data Pump user.

   For example:

   CONNECT psmith
   Enter password: password
   

7. Create a directory for the Database Vault audit trail.

   CREATE DIRECTORY dv_audit_dir AS 'dv_audit_trail_directory';
   

8. Exit SQL*Plus.

   EXIT
   

9. Using Data Pump, export the Database Vault audit trail into the directory object that you just created.

   expdp psmith directory=dv_audit_dir tables=psmith.dv_audit_trail \
   dumpfile=dv_audit.dmp log=dv_audit_exp.log
   

10. Connect to SQL*Plus as a user who has been granted the DV_OWNER role.

    sqlplus ebrown
    Enter password: password
    

11. If you have not done so, then create a realm around the schema that now contains the Database Vault audit trail.

    1. Create the realm. For example:

       BEGIN
        DBMS_MACADM.CREATE_REALM(
         realm_name    => 'DV Audit Trail Realm', 
         description   => 'Realm to protect the DV audit trail', 
         enabled       => DBMS_MACUTL.G_YES, 
         audit_options => DBMS_MACUTL.G_REALM_AUDIT_FAIL + DBMS_MACUTL.G_REALM_AUDIT_SUCCESS,
         realm_type    => 1);
       END; 
       /
       

    2. Add the schema that contains to audit trail to this realm. For example:

       BEGIN
        DBMS_MACADM.ADD_OBJECT_TO_REALM(
         realm_name   => 'DV Audit Trail Realm', 
         object_owner => 'psmith', 
         object_name  => '%', 
         object_type  => '%'); 
       END;
       /
       

    3. Authorize a trusted user for this realm.

       BEGIN
        DBMS_MACADM.ADD_AUTH_TO_REALM(
         realm_name  => 'DV Audit Trail Realm', 
         grantee     => 'PSMITH',
         auth_options => DBMS_MACUTL.G_REALM_AUTH_OWNER);
       END;
       /
       

Purging the Oracle Database Vault Audit Trail

You can purge the Oracle Database Vault audit trail in SQL*Plus.

1. Log into the database instance as a user who has been granted the DV_OWNER role or the DV_AUDIT_CLEANUP role.

   For example:

   sqlplus psmith
   Enter password: password
   

   Note that the DV_OWNER and DV_AUDIT_CLEANUP roles do not allow their grantees to truncate the DVSYS.AUDIT_TRAIL$ system table.

   You can query the DBA_ROLE_PRIVS data dictionary view to find the roles that have been granted to a user.

2. Purge the Database Vault audit trail.

   DELETE FROM DVSYS.AUDIT_TRAIL$;