0

I have an Oracle Database which includes many users and some of them have DBA roles. The thing is, DBA's shouldn't delete any records from SYS.AUD$ table. Is there a way that i can achieve this?

3
  • 1
    Simple answer: revoke the DBA role from these users. Oct 26 at 13:02
  • Thanks but i need an alternative. Can i exclude from accessing specific schema? DBA roles shouldn't manipulate data in SYS directly. Oct 26 at 13:07
  • in Oracle 11g you cannot stop someone with full DBA privileges from manipulating the audit trail. You can audit the audit trail itself so you'll know if anyone has been naughty, or send audit records to file system files so that a database user can't delete them directly.
    – pmdba
    Oct 26 at 22:44

1 Answer 1

3

I have an Oracle Database which includes many users and some of them have DBA roles.

Are they DBAs?
DBAs know better than to "muck about" with the Audit Trail.
If they're not DBAs, then they should not have this Role. Period.

Always keep the biggest and best tools for yourself - so that you can clean up the mess that other people / processes make!

I would suggest immediately starting work on finding another way of providing what these Users [think they] want.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.