Questions tagged [audit]
Database auditing involves observing a database so as to be aware of the actions of database users.
401
questions
0
votes
1
answer
13
views
Correlating SQL Audit transaction_id to LSN
I have a relatively simple question that is "Google resistant".
I have a SQL Database Audit spec that logs a transaction_id. I also have a Change Data Capture (CDC) spec that logs __$seqval (...
- 117
3
votes
1
answer
70
views
In SQL Server auditing, what is frame nest level?
In SQL Server, when function sys.fn_get_audit_file() returns info from audit files, it includes column additional_information. Per that column's documentation, it contains "one level of TSQL ...
- 31
0
votes
2
answers
93
views
SQL Server Audit log format changed in 2022?
I have an audit setup on various versions of SQL Server to dump their log files to a network share.
The server that reads the files (using sys.fn_get_audit_file) to gather the data from them is 2019.
...
- 31
0
votes
0
answers
24
views
SQLLocalDB audit to application/security log
Has anyone encountered an error that Sql Server LocalDb cannot start an audit aimed at the application log (or security log)?
it seems like problem only for the localdb instance.
sys....
0
votes
1
answer
64
views
class_type column of system function "sys.fn_get_audit_file" returns null
I implemented audit in SQL Server 2019. Also I have created a job to save audit records from file to a table.
According the microsoft document column class_type is NOT NULL. so in my table is NOT NULL ...
- 202
0
votes
0
answers
19
views
bypassing application controls from database
I'm currently doing an audit on oracle payables & CC&B and I noticed that the DBA team has full access on the database and with no audit trail enabled.
Is it possible to bypass the application ...
0
votes
0
answers
24
views
Finde the difference in UPDATE in PostgreSQL
I would like to determine the difference in an UPDATE that was carried out on a table DE_projects. So between old and new values. The aim is to monitor changes in the permissions column in the ...
- 1
0
votes
1
answer
62
views
SQL Server 2012 how to audit user's access to database tables and views?
We have a read-only login account that unfortunately was created without proper planning, and now users throughout the company are using this login to access tables and views in our database. The ...
- 295
0
votes
1
answer
41
views
Keeping track of client logged-in OS user when connecting to a database server
We are implementing a monitoring solution that keeps track of logins to SQL Server.
We need to capture the following event: a user logs in to a Windows client and from there logins to a remote SQL ...
- 210
0
votes
0
answers
38
views
Is there a way to disable mysql enterprise audit for a particular mysqldump/restore session
I am using mysql enterprise audit in our production, which is working perfectly fine. I have filter rule applied such that all table access queries are logged.
However while dumping or restoring a ...
0
votes
0
answers
27
views
Postgres Audit Logging
I have activated Postgres audit logging (edb audit) and can see its creating 2 file
e.g.
audit-2023-06-03_000000.csv
audit-2023-06-03_000001.csv
1st file having only one entry with "...
- 151
0
votes
0
answers
47
views
Can a user connected as sysdba always bypass auditing mechanisms?
Can a user connected as sysdba always bypass auditing mechanisms? What could be done to minimize (or prevent) auditing prevention?
- 131
0
votes
3
answers
419
views
Audit trigger to only track when specific columns change, and only log the old and new values for the changed columns
I have a table with 75 columns and need to track about 15 of those columns to log out the old and new values anytime the data in any of those 15 columns change (updates only, no inserts or deletes). ...
- 3
0
votes
0
answers
160
views
SQL Audit - Security Audit Log - Login Failures -
need some guidance please.
Encountering below message in a SQL Server (2016 & 2019) - Audit - Security Audit Log - Login Failure. The SQL Server Error Log does not show any Login Failures.
The ...
- 1
0
votes
1
answer
146
views
How can I audit actions done by my schema within my schema using Oracle Unified Auditing?
I want to be able to audit specific actions within my own schema (such as DDL, inserts, updates, anything I feel like). I am on Oracle 19C with mixed mode for auditing.
I have a user "SPLUNK"...
- 103
0
votes
0
answers
40
views
Azure SQL MI audit logging
Would like to list out all users logging in to a SQL MI instance.
Is this possible right out of the box or do I need to set up an Audit job?
Seems SQL MI is quite different than SQL DB when it comes ...
- 101
4
votes
1
answer
117
views
Official Source of What Time Zone an XEvent is Logged
I'm trying to prove that extended events (hence audits as well) are logged in UTC time zone and can't be changed but I can't find an official source. I've searched Microsoft's pages and SQL Server ...
- 47
0
votes
0
answers
240
views
SqlServer User and IP address auditing using Triggers + SESSION_CONTEXT – is this thread safe?
Problem
We use a combination of triggers and values set in SESSION_CONTEXT to implement dta change auditing on our SqlServer database.
Unfortunately, we have started to notice that the username and Ip ...
0
votes
0
answers
66
views
Oracle Unified Trail exclude specific DDL
I have enabled audit on Oracle database (12.1) and every minute we create/exchange partitions so this
ALTER TABLE SCHEMA.MINUTE_CUBE EXCHANGE PARTITION ...
spams into audit_trail_unified tables. I ...
- 421
0
votes
0
answers
59
views
SQL Server audit per day
I need, for regulation reasons, to create a SQL Server audit files to monitor database actions.
I want to somehow create a file per day so I can ship the file to Azure storage.
I know the audit files ...
- 1
0
votes
0
answers
1k
views
Unified Audit record write to audit trail table failed with Unified audit disabled!
on a production database I keep on observing the following error:
2022-08-15T16:58:36.196692+02:00
Unified Audit record write to audit trail table failed due to ORA-4031. Writing the record to OS ...
- 9
0
votes
1
answer
1k
views
Is it possible to set Audit_trail parameter to both DB and OS in Oracle database
In Oracle database ,we can direct audit records to either db , os or in xml file by using the below command:
ALTER SYSTEM SET AUDIT_TRAIL= DB SCOPE=SPFILE;
But is it possible to direct audit records ...
- 1
0
votes
0
answers
99
views
How to find statement causing "The user does not have permission to perform this action." in Azure SQL Database?
I ran a Kusto query:
AzureDiagnostics
| where TimeGenerated > ago(1d)
| where Category == "Errors" and error_number_d == 297
| summarize count(), min(TimeGenerated), max(TimeGenerated) ...
- 2,149
0
votes
0
answers
312
views
MySQL 5.7 (5.7.38): install audit plugin
To get a audit trail of users/hosts they're connecting to a MySQL server, I would like to install an audit plugin. I read a lot about the MariaDB server_audit
plugin. However, when I try to install ...
- 1
0
votes
0
answers
135
views
How to filter out some database roles from sql server login audit?
I have in place a Server audit that collects logins.
Every 5 minutes I import that data into a table in another instace where I build and send by email a small report. That's fine but i need to set up ...
- 4,155
0
votes
1
answer
21
views
Built in audit tracking database
I remember reading a blog post last year about a database with built in audit tracking, being able to get a version of any table at a point in time without any custom work needing to be done. Maybe it ...
- 107
1
vote
1
answer
209
views
Create Audit Trail from SQL CDC
I have a few tables on which I have enabled CDC. As each row in CDC table contains all the columns regardless if they were changed or not, so it becomes difficult to figure out only the changed data. ...
- 21
1
vote
1
answer
126
views
Can one log manual data changes to an Azure SQL table using Set-AzSqlDatabaseAudit?
This is a follow-on question to Logging just one table in an Azure SQL Database
It is possible to connect to my Azure SQL Server database using SSMS (Microsoft SQL Server Management Studio), and an ...
- 205
1
vote
1
answer
423
views
Logging just one table in an Azure SQL Database
Our company is ISO27001 certified. As such, it is required for us to log database events.
We are taking an incremental approach, and first starting with logging events just on one table.
This ...
- 205
0
votes
1
answer
608
views
What could be the reason for this invalid objects after trying to upgrade?
We recently wanted to upgrade our Database but didnt get to do it as we got a lot of Audit specific invalid objects, after looking online for ressources we couldnt find anything specific reason for ...
- 1
3
votes
0
answers
73
views
Double registration when using select into
SQL Server 2019 CU15, Database Audit:
When auditing a SELECT on a database, everything looks fine,
but if I SELECT INTO a #myTempDB, I get double registration in the AUDIT LOG.
I created a test ...
1
vote
2
answers
1k
views
Reading SQL Server .sqlaudit Files Stored in S3
I set up an audit in SQL Server that saves audit logs (.sqlaudit files) to RDS, which we then copy over to S3 using a standard process. All of the documentation I can find on reading these audit files ...
0
votes
0
answers
193
views
How do i disable Oracle Unified Auditing for RMAN?
I currently have Oracle's Unified Auditing enabled, but I noticed that RMAN is also listed in the Unified_Audit_Trail. The value RMAN_AUDIT is displayed in the Audit_Type instead of Standard when i ...
- 1
0
votes
2
answers
680
views
Auditing via change data capture (CDC) for MSSQL
I want to ask the DBA community about best practices for auditing the MSSQL database. I set up CDC MSSQL and experience some difficulties with it. It's working all fine until I change the structure of ...
- 27
0
votes
1
answer
400
views
Getting database-level audit logs without database audit specification
I have server level auditing on SQL Server 2014.
Why am I receiving database-level audit events (such as SELECT, INSERT, UPDATE, DELETE, etc.), even though there are no database audit specifications?
...
- 13
4
votes
4
answers
7k
views
How to get historical queries in SQL Server, based on time
Please how do I get the query that was running at a specific time in SQL Server 2016? Something similar to AWR report in Oracle? We need to know what was happening at a specific time in the past ...
- 295
0
votes
0
answers
159
views
db2 How to get the application user from delete events
We use temporal tables to store the history of all changes to specific tables in the db. But we also need the user who made the changes. While on db2 side the user is the application, the application ...
- 1,803
0
votes
1
answer
217
views
Use trigger on DELETE to retrieve original SQL command and user who did it
I'm trying to create an audit log to store all delete commands on some tables, on MSSQL 2012.
What I need is the username that executed it and the command executed, then I can insert them on a log ...
- 1,513
1
vote
0
answers
74
views
Where does PMM store login details for DBs?
I have to audit the logins used by our services and it's not clear where I find the logins used for our PMM instance to connect to the remote DBs.
- 11
1
vote
1
answer
366
views
Find who is selecting from table SQL Server
We have a table that has a very long update process that I think was from a no longer used program. No one can seem to tell me if anyone still uses it or not.
What is the best way to log which users ...
- 127
0
votes
1
answer
516
views
How to include the oracle database name to os audit trail?
My DB settings:
Connected to:
Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production
Version 19.12.0.0.0
SYS@CDBXXX1>
unified_audit_common_systemlog string
...
- 978
1
vote
0
answers
163
views
Filtering for user transactions in Azure Log Analytics
We have audit logging in Azure Log Analytics set up for an Azure SQL Database we operate. I would like to query these logs to view user transactions to track down queries that have unintended ...
- 111
0
votes
1
answer
803
views
How to send alert on SQL Shutdown due to Audit Failure
Looking for a way to implement this STIG. What method should I use to monitor SQL Server, when it is shutdown due to "Shutdown on Audit Failure"?
SQL Server must provide an immediate real-...
- 21
0
votes
1
answer
331
views
Audit table and foreign key
I have a database with multiples tables that must be audited.
As an example, I have a table of objects defined with a unique ID, a name, and a description.
The name will always be the same. It is not ...
- 101
0
votes
1
answer
329
views
Oracle Fine-Grained Access (FGA) auditing excluding one source
I want to audit DML statements coming from other places than application user "tomcat" (OS_USER attribute). I want to focus only on developers or support team changing data in any way.
DML ...
- 155
2
votes
1
answer
709
views
SQL Server DML auditing - Triggers vs SQL Server Audit Feature (vs temporal tables vs change data capture)
I am looking to implement an auditing process on an instance I have on SQL Server 2017. However, I am not finding a complete conclusion on which auditing feature would be best to use for a DB with a ...
- 349
0
votes
1
answer
159
views
MSSQL - How to log every rpc_completed event into a table?
I want to log the Execution Time and Parameters for every stored procedure call on my database.
What I reached by searching is to use extended events as the latest method with minimum performance ...
0
votes
1
answer
153
views
MySQL - Information_schema Events - How persistent or retention is managed
I'm a MS SQL guy and understand agent job history.
I'm now working with MySQL.
I've searched hi and low but I can't find any solid info on how event data within information_schema.events is persisted, ...
- 113
0
votes
0
answers
165
views
Check when a privilege was granted - PostgreSQL
Is there any information_schema view that can tell when an object privilege was granted?
The pg_namespace view doesn't have that.
select
*
from pg_namespace
join lateral (
SELECT
*
from
...
- 13
1
vote
1
answer
574
views
An INSERT statement triggers the SQL Server Audit to write it down in the logs although INSERT is not listed as an Audit Action
Background:
I am trying to keep a track record of what users are querying in the database. One option I found is to create a Server and Database Audit Specification. I did not want to include INSERT ...
- 113