Friday, November 16, 2007

Auditing ALTER SYSTEM commands

Wonder, who is changing the system date? Who is changing the parameter? Who is giving all those ALTER SYSTEM commands which are causing havoc for others?

The simplest solution of the problem is, "DO NOT PROVIDE PASSWORD OF DBA USER TO A PERSON WHO IS NOT A DBA". Looks simple, right? Wrong. In developement environments it is not possible to restrict the access of DBA user to 1 or 2 persons. And it is very difficult to track someone who is giving ALTER SYSTEM commands. Triggers will not work.

These commands can not be stopped, but at least can be monitored. To monitor this, you need to start the AUDITing. Again, this can hit the performance, so use it when it is really really important.

First step is to start auditing for the database. To start auditing, follow these steps:

1. Set parameter audit_trail=db,extended in the spfile.
2. Connect to SYS user and execute the following script
        $ORACLE_HOME/rdbms/admin/cataudit.sql
3. Auditing can be started for a user
        a.) for a particular command he fires (whenever the command is successful or not successful)
            AUDIT ALTER SYSTEM BY abc WHENEVER SUCCESSFUL;
            AUDIT ALTER SYSTEM BY abc WHENEVER NOT SUCCESSFUL;
        b.) for ALL the commands fired by him
            AUDIT ALL BY abc BY ACCESS;
4. shutdown the database
5. startup the database

That's it. Now you can monitor any command fired by the user. Details can be checked in DBA_AUDIT_STATEMENT view. This view will give you the user name, operating system user name, host name, terminal, timestamp and SQL text with all the other information.

So folks, try it and let me know how many users you have caught red handed when they were doing any harm to your database.

45 comments:

AB said...

Gud one!!!

Dharmesh Mehta said...

Hi,

This seems to me as a nice solution to catch people :) I was wondering if the operating system event viewer also logged this or not? Possibly you can catch from there too if it did.

Archana P. Pandey said...

You were too fast in reading the blog... :)

No, these commands will not be logged in Windows Event Viewer because the SYSTEM here means the Oracle system and not the server it is installed in. The ALTER SYSTEM command changes the configurations of the oracle instance and database.

Venkat said...

>>Wonder, who is changing the system date?

that would need audit on OS and not database.

Unknown said...

Can we do same thing for user account for invalid logins. We have set FAILED_LOGIN_ATTEMPTS value is 4, user trying to login with invalid password for 4 times and account got locked. Now i want to trace who is trying for invlaid logins.

Anonymous said...

Who knows where to download XRumer 5.0 Palladium?
Help, please. All recommend this program to effectively advertise on the Internet, this is the best program!

Anonymous said...

I want not concur on it. I assume precise post. Especially the designation attracted me to review the sound story.

Anonymous said...

Genial fill someone in on and this fill someone in on helped me alot in my college assignement. Thank you for your information.

Anonymous said...

Opulently I to but I contemplate the post should acquire more info then it has.

Anonymous said...

Someone deleted several links from filebase.to and rapidshare servers.

From now, we will use www.tinyurlalternative.com as our main [url=http://www.tinyurlalternative.com]url shortener[/url], so every link will be there and visible for everyone.

You can pick out from several great [url=http://kfc.ms]short url[/url] address like:

kfc.ms easysharelink.info jumpme.info megauploadlink.info megavideolink.info mygamelink.info myrapidsharelink.info mytorrentlink.info myurlshortener.com mywarezlink.info urlredirect.info urlshrinker.info weblinkshortener.com youtubelink.info and many others.

They include over 60 different ready domains and the [url=http://myurlshortener.com]url shortener[/url] service work properly for free without any registration needed.

So we assume it is good notion and suggest you to use [url=http://urlredirect.info]url redirect[/url] service too!

Thank you.

Anonymous said...

Making money on the internet is easy in the underground world of [URL=http://www.www.blackhatmoneymaker.com]blackhat tools[/URL], Don’t feel silly if you haven’t heard of it before. Blackhat marketing uses not-so-popular or not-so-known ways to produce an income online.

Anonymous said...

Making money on the internet is easy in the underground world of [URL=http://www.www.blackhatmoneymaker.com]blackhat marketing[/URL], Don’t feel silly if you don't know what blackhat is. Blackhat marketing uses not-so-popular or not-so-known methods to build an income online.

Anonymous said...

http://www.pornvideoonline.info/

www.pornvideodownload.info

http://www.pornvideotorrent.info

http://www.gaypornonline.info/

http://www.teenpornonline.info/

www.freepornvideosonline.info

http://www.bestpornvideo.info/

[url=http://www.pornvideoonline.info]Porn video online[/url]
[url=http://www.pornvideodownload.info]Porn video download[/url]
[url=http://www.pornvideotorrent.info]Porn video torrent[/url]
[url=http://www.gaypornonline.info]Gay porn online[/url]
[url=http://www.teenpornonline.info]Teen porn online[/url]
[url=http://www.freepornvideosonline.info]Free porn videos online[/url]
[url=http://www.bestpornvideo.info]Best porn video[/url]

Anonymous said...

Hi
Very nice and intrestingss story.

Anonymous said...

earn money http://www.333eur.com

Anonymous said...

resource to [b]buy software for windows[/b] are available at:

buy software for windows
[url=http://www.buysoftwareforwindows.com]buy software for windows[/url]

[url=http://www.buysoftwareforwindows.com/products/buy-youtube-video-buyer/productpage.php]buy youtube video buyer[/url]

buy dvd to mp3 converter

Anonymous said...

url to [b]software downloads[/b] is reachable here:

Windows YouTube downloader
[url=http://www.1800soft.com]Windows YouTube downloader[/url]

betting software
[url=http://www.betextremesoft.com]betting software[/url]

buy software for windows
[url=http://www.buysoftwareforwindows.com]buy software for windows[/url]

download software for windows
[url=http://www.downloadsoftwareforwindows.com]download software for windows[/url]

Download Youtube Videos
[url=http://www.downloadyoutubevideos.co.uk]Download Youtube Videos[/url]

FLV to AVI converter
[url=http://www.flvtoavi.co.uk]FLV to AVI[/url]

DVD ripper
[url=http://www.flvtodvd.com]DVD ripper[/url]

Video converter
[url=http://www.hollydollyvideo.com]Video converter[/url]

Home video converter software
[url=http://www.homevideopage.com]Home video software[/url]

Poker software
[url=http://www.pokerwinningvideo.com]Poker video software[/url]

Shark Video Downloader
[url=http://www.sharkvideopage.com]Shark Video Downloader software[/url]

Simplest YouTube Internet Video Downloader
[url=http://www.simplestutils.com]Watermark Software[/url]

Popular screensavers
[url=http://www.popularscreensaverpage.com]Popular Screensaver[/url]

Hyper YouTube Magic Tool XXX
[url=http://www.andromedaapps.com]Hyper YouTube Magic Tool XXX[/url]

Free FLV converter
[url=http://www.cassiopeiasoft.com]Free FLV converter[/url]

Working YouTube downloader
[url=http://www.pegasusapps.com]Working YouTube downloader[/url]

Anonymous said...

Start a handyman business

Anonymous said...

Corona Furniture is the best!!

Anonymous said...

Bonjour,
je suis nouveau ici j'aime vous lire ;)
je voulais vous remercier pour votre super site internet !
Bonne continuation
----
Nicolaseo, Rien de mieux que le referencement naturel.

Anonymous said...

side effects of clomid 50 mg | clomid medication - where to buy clomid, best days to take clomid for twins

Anonymous said...

order xanax xanax-effects.com - buy xanax online

Anonymous said...

cycle clomid | where to buy clomid - purchase clomid online, how effective is clomid

Anonymous said...

starting clomid without period | ordering clomid online - buy clomid and nolvadex online, clomid for short luteal phase

Anonymous said...

clomid male fertility | http://buy-clomid-in-usa.webs.com/#54962 - clomid 150, clomid and ovidrel success rates

Anonymous said...

top [url=http://www.001casino.com/]online casino[/url] brake the latest [url=http://www.casinolasvegass.com/]online casinos[/url] unshackled no consign bonus at the best [url=http://www.baywatchcasino.com/]spare casino games
[/url].

Anonymous said...

[url=http://inchinaledlightmanufacturer.com ]led light manufacturer [/url]"Good gracious, Alf!" stairs, and Mrs. The path to the file didn't know before that it http://inchinaledlightmanufacturer.com led manufacturer in usa led light manufacturer At the death of Chosroes the crown was assumed without dispute or

Anonymous said...

how can i get clomid | http://buyclomidcheap.webs.com/#83883 - where to buy clomid for pct, clomid drug classification

Anonymous said...

how to make clomid work better | purchase clomid without prescription - buy clomid cheap online, clomid 150mg success rate

Anonymous said...

clomid and metformin success rates | [url=http://purchaseclomid.jimdo.com/#49433]clomid buy online no prescription[/url] - clomid without a prescription, ajrz success rate of iui with clomid

Anonymous said...

Magnificent beat ! I wish to apprentice while you amend your website,
how can i subscribe for a blog website? The account aided me a acceptable deal.
I had been tiny bit acquainted of this your broadcast offered bright clear concept

Also visit my web site :: plus de retweet

Anonymous said...

Thank you for sharing your info. I truly appreciate your efforts and I am waiting for your next write ups thanks once again.


Also visit my webpage: http://www.youtube.com/watch?v=ddcKJDTQ7zI

Anonymous said...

I like what you guys are up too. Τhis
tyрe of clеver ωork and сoνerage!
Keep up the vеrу good works guys I've incorporated you guys to our blogroll.

Feel free to surf to my web site; payday loans

Anonymous said...

Hаve you evеr thοught about аdԁing a little bit
more than just youг aгtiсles? I meаn, what
уou say іѕ valuable аnd all. Howеver
just іmagine if уou aԁded ѕomе great graрhіcs οr vіdeos to
giνe your posts more, "pop"! Your cοntеnt is eхcellent but with pics
аnd videoѕ, this blog сould undeniably be one of the moѕt bеneficial in its
field. Ѕuрeгb blоg!

Ηere is my site payday loans

Anonymous said...

Hi, i think that i saw you visited my blog sο i came to “return
the fаνor”.I am аttempting tο find
things to improνe my wеb sitе!I ѕuppοse
its οk to use a feω of your ideas!!

Hеre is my page: payday loans

Anonymous said...

I think that is among the most significant information
for me. And i am satisfied studying your article. However wanna commentary
on some basic issues, The web site style is perfect, the articles
is actually excellent : D. Excellent activity, cheers

Stop by my site raspberry Ketones Reviews

Anonymous said...

I think that is among the most significant information for me.
And i am satisfied studying your article. However wanna commentary on some basic issues,
The web site style is perfect, the articles is actually excellent : D.

Excellent activity, cheers

Here is my website :: raspberry Ketones Reviews

Anonymous said...

I do not even knοw how I ended up herе, but I thought this pоst wаs good.

I do not κnow who you are but certainlу yοu are going tо a famouѕ blоggeг
if you aгe not alгeаdy
;) Cheers!

Feеl free to visit my wеb site ...

Same Day Payday Loans

Anonymous said...

Ηello therе, Υоu've done an excellent job. I will definitely digg it and personally recommend to my friends. I'm confident they'll be benefited from this web site.

Feel free to surf to my page ... payday loans

Anonymous said...

these opinions. get out of these kinds of sites. The formula supermarket during pharmaceutical products in Spain after the treatment of erectile dysfunction (the medications included were Viagra, Levitra and Cialis) was valued at about $5.1 billion in http://amoxil4sale.net|Amoxicillin If Viagra is associated with selected recreational medicines this amiable of as marijuana or cocaine, or merged with other erectile dysfunction treatments such as Cialis or Levitra, it may experience to a handful of undoubted complications. This involves improved http://doxycycline4sale.net|doxycycline hyclate

Anonymous said...

be harder to reach the effect. http://valtrex4sale.net|buy valtrex someone is concerned help. Of passage, you need to voice to your doctor involving the cost of any medication, consistent Viagra, when it is being prescribed to you. The following points, however, pass on boost you downgrade your medical bills. http://tadalafil4sale.net|tadalafil for sale

Anonymous said...

balloon which gets bigger on being vain, penis also starts to get sort out as the blood circulates from arteries to penis. In all this, Viagra acts as a catalyst to perform penile erection and helps you to transfuse your genes into women's cadaver http://viagra-on.net|buy viagra pills http://viagraonusa.net|viagra online delivery in india

Anonymous said...

The consumption of generic Viagra enables diverse men suffering from ED to come back to sexual excitement. Libidinous arousal is the response to sexual stimuli that increases the blood flow in the penis area making intercourse relaxing and pleasurable. http://viagra-on.net|viagraonusa.net http://viagraonusa.net|buy viagra pills

Anonymous said...

patented drugs. http://cialisonlinetrustph.net|buy cialis online europe http://cialis-online-trust-pharm.net|how to order cialis online no prescription

Anonymous said...

exist commendation, especially in the simultaneous pecuniary ambiance where the mass of lenders are unwilling to provender loans altogether, never pay no attention to to a herself with a bumbling creditation http://paydayloans1st.co.uk|Payday Loans are of two types - at one of the payday loans are is where you force to fax the documents required and other lone is payday loans no fax. Payday loans no fax allows us to credit http://paydayfirstuk.co.uk|payday loans 1st that the borrower has fulfilled every criteria stated nearby the lend provider, the no check up on payday loan would be approved in no time. The borrower purpose command the credit proceeds credited