0

I need to confirm that actions by privileged users are being audited. As far as I can tell from views such as dba_stmt_audit_opts, the statements by the privileged users I want to be audited are being audited indiscriminately, so that seems good.

I know that NOAUDIT can be used to stop auditing a statement for a specific user. How would I check whether someone in the past has done this for a privileged user?

  • 1
    Asking if someone in the past has issued a 'noaudit' is most likely the wrong question. What matters is what is being audited today vs what you want to audit. How you got to the current state is of little importance. – EdStevens Jun 25 '17 at 12:25
  • 1
    And, unless a DBA has granted audit to another user, you're asking if the DBA can be trusted, which opens a can of worms. Companies who cannot trust their staff implement things like Oracle Vault, to their possible detriment. – sandman Jun 27 '17 at 12:34
0

After reading some more on NOAUDIT, I think I understand my confusion. NOAUDIT does not necessarily cease auditing for a specific action-user pairing, but cancels a matching AUDIT statement. So NOAUDIT select table BY user1 would only cancel a previously made statement of AUDIT select table BY user1. If the AUIDT statement had never been made and all SELECT TABLE statements are already being audited, the NOAUDIT statement would have no effect.

The relevant documentation:

Use the NOAUDIT statement to stop auditing operations previously enabled by the AUDIT statement.

The NOAUDIT statement must have the same syntax as the previous AUDIT statement. Further, it reverses the effects only of that particular statement. For example, suppose one AUDIT statement A enables auditing for a specific user. A second statement B enables auditing for all users. A NOAUDIT statement C to disable auditing for all users reverses statement B. However, statement C leaves statement A in effect and continues to audit the user that statement A specified.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.