DBMS_FGA audit. DISABLE_POLICY

Similar Questions

• How not to export audit DBMS_FGA strategies

  Hello
  
  I have a few paintings with DBMS_FGA policies on them (because of AuditVault) who calls a user-defined audit function. When the export of the whole scheme, the policies if exported too, but not the audit works, since he created in another schema. The problem is that when I import the schema on a different database, I get the following error when you try to access the data in these tables:
  

  ORA-28112: failed to execute policy function 
  ORA-06512: at line 4 
  28112. 00000 -  "failed to execute policy function" 
  *Cause:    The policy function has one or more error during execution. 
  *Action:   Check the trace file and correct the errors. 

  This is because the audit function does not exist in this database. The problem is resolved if I drop policies after importation with for example:
  

  begin
    for rec in (select * from dba_audit_policies where object_schema = 'ACC') loop
    dbms_fga.drop_policy(object_schema => rec.object_schema,
                           object_name => rec.object_name,
                           policy_name => rec.policy_name);  
    end loop;
  end;
  /  

  Anyone know if it is possible to somehow do not export these policies so that runing the PL/SQL preceding crashes after that importation would be unnecessary?
  
  Thanks in advance.
  
  Kind regards
  Swear

  Hello

  All you need to do is add the exclusion filter.

  exclude the = fga_policy

  to your export or import command line. If you don't want them in the dumpfile, and then add it to the command expdp. If you like in the dumpfile but do not want to import, and then add it to the impdp command. If you add it at the same time, you will get an error during the import, saying he has no fga_policy in the dumpfile.

  In fact, it may not be fga_policy, but checking for her. I don't have a database that I can look at now, but if you look in your export log file, you should be able to see the type of object that you want to exclude. You looking for something like:

  SCHEMA_EXPORT /... / * POLICY *.

  I guess this would be it. To check, you can use

  Impdp sqlfile = my_file.sql directory... dumpfile...

  This will generate a file called my_file.sql and you might look to find the ddl or pl/sql you want to eliminate. Once you find it, watch until you see a line like SCHEMA_EXPORT... Then add the end of this line to with an exclude = to your export order.

  I hope this helps.

  Dean

  Published by: Dean WINS on January 15, 2010 13:04

• Audit of the Dominican Republic

  Hi gurus,
  
  I have activate standard and FGA to the primary database audit and audit records go to xml on disk.i files think that I need to set the correct audit_trail = xml, expanded on the site of Eve also? and also, do I have to check all the actions (statement, privilege) or they are applied as part of the recovery?
  
  Waiting for the reversal of roles will happen some time... so needs to check up to the backup site too.
  
  
  11.2.0.1 primary AIX 6.1
  
  Phsyical Standby (ADG) 11.2.0.1 AIX
  
  Please, any advice on would be very useful.
  
  Concerning

  It is my understanding.

  Happy to a test configuration for you.

  mseberg

  Test

  SQL > startup

  As a user BIGSHOW create a table and enter some data:

  CREATE TABLE emp (
   empno     NUMBER(4) NOT NULL,
   ename     VARCHAR2(10),
   job       VARCHAR2(9),
   mgr       NUMBER(4),
   sal       NUMBER(7,2),
   deptno    NUMBER(2)
  );
  
  INSERT INTO emp (empno, ename, sal) VALUES (9999, 'Tim', 10000);
  INSERT INTO emp (empno, ename, sal) VALUES (9999, 'Jim', 30500);
  INSERT INTO emp (empno, ename, sal) VALUES (9999, 'Larry', 50001);
  COMMIT;
  

  As SYS add an audit policy:

  BEGIN
    DBMS_FGA.add_policy(
      object_schema   => 'BIGSHOW',
      object_name     => 'EMP',
      policy_name     => 'SALARY_AUDIT',
      audit_condition => 'SAL > 30000',
      audit_column    => 'SAL');
  END;
  /
  

  BIGSHOW user do something to trigger the audit:

  SELECT sal FROM emp WHERE ename = 'Tim';
  SELECT sal FROM emp WHERE ename = 'Jim';
  SELECT sal FROM emp WHERE ename = 'Larry';
  

  As a SYS check audit policy:

  SELECT sql_text
  FROM   dba_fga_audit_trail;
  
  SQL_TEXT
  --------------------------------------------------------------------------------
  SELECT sal FROM emp WHERE ename = 'Jim'
  SELECT sal FROM emp WHERE ename = 'Larry'                                       
  
  2 rows selected.
  

  Make a newspaper order:

  SQL > alter system switch logfile;

  Modified system.

  Results

  I see only. XML on the primary side.

  I can't do the "SELECT sql_text FROM dba_fga_audit_trail;" on standby without getting ORA-01219 and I don't have the time for a failover.

  Published by: mseberg on Sep 22, 2011 14:38

  Even more

  OK, I had know if I made a move, then

  SQL> SELECT sql_text FROM   dba_fga_audit_trail;
  
  SQL_TEXT
  --------------------------------------------------------------------------------
  SELECT sal FROM emp WHERE ename = 'Jim'
  SELECT sal FROM emp WHERE ename = 'Larry'
  

  No XML file on the eve (new primary), but should as I do not change the spfile.

  So, it seems that the XML option may be what you want. So I was half good and evil half.

  Thank you for a very interesting question!

  mseberg

  Published by: mseberg on Sep 22, 2011 14:49

• Can we use FGA (Fine grain audit) edition standard oracle?

  Hi all
  
  I am looking for your help.
  
  I put audit_trail db setting and when I tried to add the policy by using BEGIN
  DBMS_FGA.add_policy... it shows ORA-00439: feature not enabled no: refined audit
  
  SQL > select version of $ v; *
  
  BANNER
  ----------------------------------------------------------------
  Oracle Database 10g Release 10.2.0.4.0 - Production 64-bit
  PL/SQL Release 10.2.0.4.0 - Production
  CORE 10.2.0.4.0 Production
  AMT for Linux: release 10.2.0.4.0 - Production
  NLSRTL Version 10.2.0.4.0 - Production
  
  
  SQL > select option $ v where PARAMETER in ('access control very specific', 'Fine grain audit'); *
  
  VALUE OF THE PARAMETER
  ---------------------------------------------------------------- ----------------------------------------------------------------
  FALSE fine-grained access control
  Grain end FALSE audit
  
  
  
  Thanks in advance :)
  
  Published by: Oracle_2410 on August 9, 2011 03:00
  
  Published by: Oracle_2410 on August 9, 2011 03:10
  
  Published by: Oracle_2410 on August 9, 2011 03:13

  You are right.

  The use of RLS is limited to tables of Portal metadata repository only when you use a standard edition.

  I deleted the event line, maybe you can do the same thing.

  Best regards

  mseberg

  Published by: mseberg on August 9, 2011 05:32

• the audit of a specific user for their session

  Is it possible to toggle the audit for a user in a way similar to the activation/deactivation of a role?
  
  What I'm trying to do is - to enable auditing for a user when they connect to an application (where his roles via an application based role - (identified by a package role) allows the application) and - when the user disconnects have audit automatically "disable."
  
  I don't know if this is possible. Idea/suggestions are greatly appreciated.
  
  Thank you!

  If I understand your question, you can use a fine grain for this audit. AFAIK, you can under certain conditions to audit using regular buildings. You can do something like...

  begin
    dbms_fga.add_policy(object_schema   => 'YOUR_USER',
                        object_name     => 'YOUR_TABLE',
                        policy_name     => 'YOUR_TABLE_AUDIT',
                        audit_condition => 'sys_context(''userenv'',''os_user'') = ''howards''',
                        audit_column    => 'YOUR_COLUMN');
  end;
  /
  

  This will create an audit record in dba_fga_audit_trail when the howards os_user selects the column of the specified table. If the same database user running the select when you are connected to os_user 'raymond', the selection will not be audited.

  Some sys_context parameters are easily spoofed, but the idea should hold true regardless of how you would rate the session.

• DBMS_FGA.add_policy... How to handle multiple tables and multiple users

  Dear all,
  
  My database is 11 GR 1 material and Linux is the platform.
  
  I have over 50 very important tables and about 15 users database.
  
  I want to implement an audit fine-grained on these important tables.
  
  This is how I will implement:
  
  SQL > START
  () DBMS_FGA.add_policy
  object_schema = > 'Scott ',.
  object_name = > "SAL."
  POLICY_NAME = > "SALARY_CHK_AUDIT"
  audit_condition = > NULL,
  handler_schema = > 'imran.
  statement_types = > 'SELECT, INSERT, UPDATE, DELETE.
  audit_column = > NULL);
  END;
  /
  
  What is I have several tables of several users and object_schema in handler_schema.
  
  I hope I'm able to clear my question, doubts please let me know.
  
  Best regards, Imran

  Hello

  object_schema - the schema of the object to be audited. (If the value is NULL, the schema of the current user is supposed).
  in case if you want to audit for multiple users - then make a test taking a value null and test access important tables - where relevant audit records are generated according to your requirement or not. I have not tested... try it

  -Pavan Kumar N

• DBMS_FGA & DML statements

  Hello
  
  
  I was able to set up and configure FGA in my database and get my SQLs get connected in DBA_FGA_AUDIT_TRAIL. However my requirement is to put the DML statements from the front of the table triggers.
  When I run an insert/update/delete statement against a table say i.e. EMP.  I would llike to see education performed in the front insert/update / deletion of the respective table triggers.  But even after configuration FGA i.e of Audit policy for the EMP table I am unable to get all records if inserted in DBA_FGA_AUDIT_TRAIL when I ask this view BEFORE the trigger Update of the table
  
  How to get my DML statement or clause of the DML where atleast in my before triggers. Please help in this regard.
  
  I went through the links and documents below, but none of that speaks my requirment.
  
  The notes that I have visited.
  
  http://download.Oracle.com/docs/CD/B19306_01/network.102/b14266/cfgaudit.htm#i1011302
  
  Metalink notes
  
  10g: Fine grain auditing (Doc ID 266896.1()
  How to use DBMS_FGA with a complex audit_condition (include/exclude multiple users) (Doc ID 832856.1()
  
  Thanks in advance

  I make my own comments of Nicolas - it doesn't make much sense to check if an UPDATE statement updates of each row in the table.

  If you don't want to verify such a thing (it being understood that it is almost certainly a bad idea), the classical approach would be to have
  -A BEFORE level trigger UPDATE statement which has initialized a collection
  -A BEFORE the UPDATE to the row-level trigger who populated the collection (i.e. Add the primary key for each update of the collection line)
  -AFTER level trigger UPDATE statement which compared the number of rows affected number of rows in the table

  If you want to get the SQL statement that caused an audit event to end grain, you are probably looking for

  SYS_CONTEXT( 'USERENV', 'CURRENT_SQL')
  

  But trying to use it to determine if each row is updated in the way you mentioned sounds even worse than three trigger approach.

  Justin

• DBMS_FGA in Oracle 9i

  Hi all
  
  It is possible to audit INSERT, UPDATE, DELETE in 9i uses DBMS_FGA package? I am not able to find references.
  
  Appreciate your response.
  
  Thank you and best regards,
  Senana

  Nope. SELECT only is audited, here below the example I wrote some time back:
  Re: How to check the SELECT statement without using the database auditing feature?

  Nicolas.

• Auditing (FGA) action "procedure".

  Hi all!
  
  I'll put in place an audit fine-grained in our test database.
  
  I did it for all the tables, no problem.
  
  But I can't understand how to procedures. I want the process of verification and packages in our database to get information, those that are carried out by our application.
  
  Someone knows how to set up an audit of the procedure/package?
  
  --------------------------
  This is the syntax for implementing audit table.
  Run DBMS_FGA. () ADD_POLICY
  object_schema = > 'TRA '.
  object_name = > "PERS."
  POLICY_NAME = > "PERS."
  statement_types = > "SELECT, INSERT, UPDATE, DELETE");

  Try with procedure_name AUDIT EXECUTE ON BY SESSION

• the audit as output require without verification

  Hello
  
  I use oracle 10g on windows server 2003 and I want to put my more executable applications in the library cache to improve performance. If find two ways to do this.
  
  1 user session.) follow-up
  2. fine-grained auditing)
  
  I can't use tracing because he can't give me output like
  

  SELECT sql_text
  FROM   dba_fga_audit_trail;
  
  SQL_TEXT
  ------------------------------------------
  SELECT sal FROM emp WHERE ename = 'Larry'
  
  1 row selected.

  set auditing refined.
  
  but I can't use refined audit because I have 320 tables so I need add_policy as
  

  BEGIN
    DBMS_FGA.add_policy(
      object_schema   => 'AUDIT_TEST',
      object_name     => 'EMP',
      policy_name     => 'SALARY_CHK_AUDIT',
      audit_condition => 'SAL > 50000',
      audit_column    => 'SAL');
  END;
  /

  What is difficult.
  
  So I need a solution that give me audit refined as output, but without application of policies.
  
  Thank you
  Umesh

  I think that I do not have the right requirement: your "most of executable applications" are already in the library cache, aren't they? You can retrieve with
  such an assertion

  SQL> select SQL_TEXT from v$sqlarea where executions>10000;
  

  Kind regards
  Uwe

  http://uhesse.WordPress.com

• Card Pay Apple needs to audit

  Now, I had my checked by phone three times by my financial institution debit card.  Whenever I have restore my phone or in this case, I had the iPhone 7 and its saying my card needs to be retested.  This is in addition to needing another check when I added Apple pay to my Apple Watch.  Is it normal that Apple to require verification of the same map several times when adding the map to another device?

  DUKE of DOUGLAS wrote:

  .. Is it normal that Apple to require verification of the same map several times when adding the map to another device?

  Hello

  Your card issuer (rather than Apple) decides if a check is required when you add your card to a new device (or when adding of this return to a device, it has already been disposed of).

  It can help to consider the audit as a reassuring security measure, rather than a disadvantage.

• Yesterday, I paid $29.99 thinking I was getting Grime Fighter, as I have some dirt, but he tells me that I don't have this feature, why the audit!

  Yesterday, I paid $29.99 thinking I was getting Grime Fighter, as I have some dirt, but he tells me that I don't have this feature, why the audit! What are the characteristics of fact fees cover $29.99

  Do you mean that Avast program: https://www.avast.com/en-us/grimefighter

  We can not probably help you with that here on the Firefox support site, but Avast has a page of support here: https://www.avast.com/en-us/support#grimefighter

• Devices on all my iCloud preferences says "this device can be used to receive codes of audit ID Apple." How can I change this if at least one, if not several, can receive the verification code?

  Devices on all my iCloud preferences says "this device can be used to receive codes of audit ID Apple." How can I change this if at least one, if not several, can receive the verification code?

  Try to go here and see if you can add them to your Apple ID.

• What is the audit file system 8 exit code?

  Disk utility > first aid

  What is the audit file system 8 exit code?

  Thank you.

  Disk utility local SSD and the disagree recovery Partition

  IR.1819660 / http://forums.macrumors.com/threads/File-System-Check-Exit-code-8-Disk-wont-repa

• How can I turn off step 2 audit on Thunderbird

  I have tried and tried for hours remove the 2 step of my computer checking. Every time I open my email I put my password and then a minute later, I get the message "the user password is sent * my user name * has failed." Mail server * server name * responded: authentication failed. "Then it asks me to enter a new password or retry. But, by clicking on the option will just cause the whole thing to be repeated. I'm sick and tired of not being able to get my messages on my computer and right and get rid of the stage 2 audit. And, please, I'm not a computer person, I need instructions STEP by STEP on how to do it.

  Well, I told my friend about it and they just thought of it. Somehow the password has been set to one I had there a long time and changes so it is fixed.