Questions tagged [audit]

Database auditing involves observing a database so as to be aware of the actions of database users.

Filter by
Sorted by
Tagged with
0 votes
0 answers
24 views

How to filter out some database roles from sql server login audit?

I have in place a Server audit that collects logins. Every 5 minutes I import that data into a table in another instace where I build and send by email a small report. That's fine but i need to set up ...
user avatar
  • 3,367
0 votes
1 answer
13 views

Built in audit tracking database

I remember reading a blog post last year about a database with built in audit tracking, being able to get a version of any table at a point in time without any custom work needing to be done. Maybe it ...
user avatar
0 votes
0 answers
32 views

Noaudit and Drop Audit Don't Work for Oracle 19c

I've enabled unified auditing at our production database (ver. 19.14). Created policies for auditing all dml's and select queries. After seeing that it's filling up SYSAUX table, i decided to disable ...
user avatar
1 vote
1 answer
25 views

Create Audit Trail from SQL CDC

I have a few tables on which I have enabled CDC. As each row in CDC table contains all the columns regardless if they were changed or not, so it becomes difficult to figure out only the changed data. ...
user avatar
1 vote
1 answer
28 views

Can one log manual data changes to an Azure SQL table using Set-AzSqlDatabaseAudit?

This is a follow-on question to Logging just one table in an Azure SQL Database It is possible to connect to my Azure SQL Server database using SSMS (Microsoft SQL Server Management Studio), and an ...
user avatar
  • 205
1 vote
1 answer
64 views

Logging just one table in an Azure SQL Database

Our company is ISO27001 certified. As such, it is required for us to log database events. We are taking an incremental approach, and first starting with logging events just on one table. This ...
user avatar
  • 205
0 votes
1 answer
65 views

What could be the reason for this invalid objects after trying to upgrade?

We recently wanted to upgrade our Database but didnt get to do it as we got a lot of Audit specific invalid objects, after looking online for ressources we couldnt find anything specific reason for ...
user avatar
3 votes
0 answers
48 views

Double registration when using select into

SQL Server 2019 CU15, Database Audit: When auditing a SELECT on a database, everything looks fine, but if I SELECT INTO a #myTempDB, I get double registration in the AUDIT LOG. I created a test ...
user avatar
1 vote
2 answers
108 views

Reading SQL Server .sqlaudit Files Stored in S3

I set up an audit in SQL Server that saves audit logs (.sqlaudit files) to RDS, which we then copy over to S3 using a standard process. All of the documentation I can find on reading these audit files ...
user avatar
0 votes
0 answers
25 views

How do i disable Oracle Unified Auditing for RMAN?

I currently have Oracle's Unified Auditing enabled, but I noticed that RMAN is also listed in the Unified_Audit_Trail. The value RMAN_AUDIT is displayed in the Audit_Type instead of Standard when i ...
user avatar
0 votes
2 answers
87 views

Auditing via change data capture (CDC) for MSSQL

I want to ask the DBA community about best practices for auditing the MSSQL database. I set up CDC MSSQL and experience some difficulties with it. It's working all fine until I change the structure of ...
user avatar
0 votes
0 answers
18 views

TLS Encryption Logging/Auditing in Oracle

I use Oracle only occasionally, but have heard that it is pretty easy to verify if your Oracle encryption is working (e.g. this post Verify if the client is connecting to the Oracle database using ...
user avatar
0 votes
1 answer
53 views

Getting database-level audit logs without database audit specification

I have server level auditing on SQL Server 2014. Why am I receiving database-level audit events (such as SELECT, INSERT, UPDATE, DELETE, etc.), even though there are no database audit specifications? ...
user avatar
  • 13
0 votes
0 answers
25 views

FGA AUDITING does not record audit

hello i dont know why my fga auditing is not working my code EXEC DBMS_FGA.ADD_POLICY(OBJECT_SCHEMA=>'PLSQL', OBJECT_NAME=>'REGIONS', AUDIT_COLUMN=>'REGION_NAME', POLICY_NAME=>'REGPOL', ...
user avatar
4 votes
4 answers
752 views

How to get historical queries in SQL Server, based on time

Please how do I get the query that was running at a specific time in SQL Server 2016? Something similar to AWR report in Oracle? We need to know what was happening at a specific time in the past ...
user avatar
  • 231
0 votes
0 answers
49 views

db2 How to get the application user from delete events

We use temporal tables to store the history of all changes to specific tables in the db. But we also need the user who made the changes. While on db2 side the user is the application, the application ...
user avatar
  • 1,735
0 votes
1 answer
57 views

Use trigger on DELETE to retrieve original SQL command and user who did it

I'm trying to create an audit log to store all delete commands on some tables, on MSSQL 2012. What I need is the username that executed it and the command executed, then I can insert them on a log ...
user avatar
  • 1,413
0 votes
0 answers
46 views

Scheduled job not present on database, but visible from dba_scheduler_job_log

I'm seeing this error in the alert log (sorry, it's in italian!): *** 2021-09-14 23:50:17.891 *** SESSION ID:(249.6897) 2021-09-14 23:50:17.891 *** CLIENT ID:() 2021-09-14 23:50:17.891 *** SERVICE ...
user avatar
1 vote
1 answer
43 views

Where does PMM store login details for DBs?

I have to audit the logins used by our services and it's not clear where I find the logins used for our PMM instance to connect to the remote DBs.
user avatar
1 vote
1 answer
58 views

Find who is selecting from table SQL Server

We have a table that has a very long update process that I think was from a no longer used program. No one can seem to tell me if anyone still uses it or not. What is the best way to log which users ...
user avatar
  • 127
0 votes
1 answer
193 views

How to include the oracle database name to os audit trail?

My DB settings: Connected to: Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production Version 19.12.0.0.0 SYS@CDBXXX1> unified_audit_common_systemlog string ...
user avatar
  • 868
1 vote
0 answers
39 views

Filtering for user transactions in Azure Log Analytics

We have audit logging in Azure Log Analytics set up for an Azure SQL Database we operate. I would like to query these logs to view user transactions to track down queries that have unintended ...
user avatar
0 votes
1 answer
207 views

How to send alert on SQL Shutdown due to Audit Failure

Looking for a way to implement this STIG. What method should I use to monitor SQL Server, when it is shutdown due to "Shutdown on Audit Failure"? SQL Server must provide an immediate real-...
user avatar
0 votes
1 answer
122 views

Audit table and foreign key

I have a database with multiples tables that must be audited. As an example, I have a table of objects defined with a unique ID, a name, and a description. The name will always be the same. It is not ...
user avatar
  • 101
0 votes
1 answer
94 views

Oracle Fine-Grained Access (FGA) auditing excluding one source

I want to audit DML statements coming from other places than application user "tomcat" (OS_USER attribute). I want to focus only on developers or support team changing data in any way. DML ...
user avatar
  • 155
2 votes
1 answer
246 views

SQL Server DML auditing - Triggers vs SQL Server Audit Feature (vs temporal tables vs change data capture)

I am looking to implement an auditing process on an instance I have on SQL Server 2017. However, I am not finding a complete conclusion on which auditing feature would be best to use for a DB with a ...
user avatar
0 votes
1 answer
49 views

MSSQL - How to log every rpc_completed event into a table?

I want to log the Execution Time and Parameters for every stored procedure call on my database. What I reached by searching is to use extended events as the latest method with minimum performance ...
user avatar
0 votes
1 answer
63 views

MySQL - Information_schema Events - How persistent or retention is managed

I'm a MS SQL guy and understand agent job history. I'm now working with MySQL. I've searched hi and low but I can't find any solid info on how event data within information_schema.events is persisted, ...
user avatar
  • 113
0 votes
0 answers
38 views

Check when a privilege was granted - PostgreSQL

Is there any information_schema view that can tell when an object privilege was granted? The pg_namespace view doesn't have that. select * from pg_namespace join lateral ( SELECT * from ...
user avatar
  • 13
1 vote
1 answer
128 views

An INSERT statement triggers the SQL Server Audit to write it down in the logs although INSERT is not listed as an Audit Action

Background: I am trying to keep a track record of what users are querying in the database. One option I found is to create a Server and Database Audit Specification. I did not want to include INSERT ...
user avatar
  • 113
1 vote
1 answer
327 views

Extended Events Login audit - Reduce login noise

We are looking for the optimal sql login audit solution, with usable filtering. Thus far we have looked into Server Audits and profiler but have concluded that extended events look most promising, ...
user avatar
0 votes
1 answer
104 views

How to audit a specific query in Oracle

I want to audit a specific SQL query in Oracle. However I think we can audit only users or table level. For example I want to audit 'audit statements', such as who run the "AUDIT CREATE SESSION ...
user avatar
1 vote
0 answers
57 views

MS SQL Server Enterprise 2016 is truncating the audited select statements, how do we fix it?

TL;DR; I am getting SELECT as the audit output instead of the actual (suspected) query SELECT DISTINCT CONVERT(varchar, DecryptByPassphrase(getkey(N'key1'), FIELD1)) as DECRYPTED_FIELD1 FROM view1 ...
user avatar
0 votes
1 answer
43 views

Identify table usage in sql server before we stop the load

I tried browsing this across lot of links but cant get much of help so i am posting this question which sound bit similar. We have quite some tables which are being planned from our app team that they ...
user avatar
0 votes
1 answer
42 views

Find if and when a Query was run?

I am trying to get to the root of a problem and need to see if and when a specific Delete Query was run on my MS SQL Server. The command would have come from my .NET website. My Server is Windows 2012 ...
user avatar
  • 109
0 votes
3 answers
299 views

Auditing of database connections in SQL Server 2008 R2

We are finally planning to close down our last SQL Server 2008 R2 server. Before we can proceed with this we need to track what users are connecting to which databases. We have tried different options ...
user avatar
  • 345
1 vote
1 answer
41 views

Audit succesfull logons , loging every 2 seconds

I created an audit to audit only succesfull logons. But the problem is, I did it in a test environment and it's loging a connection every second Did I do something wrong ? I only selected SUCCESFULL ...
user avatar
  • 7,100
1 vote
1 answer
96 views

audit on object by user in Oracle

Is there some way to audit, for example, a select in a specific table just by one specified user? something like this: audit select on foo.table by soe; this command return: ERROR at line 1: ORA-...
user avatar
  • 506
0 votes
2 answers
68 views

reapply permissions post sql server restart

In our environment, users were granted read/write/ddladmin permissions on tempdb database (dev/qa/prod). These permissions will be lost when SQL Services restart, as tempdb rebuilds every time. One ...
user avatar
  • 324
1 vote
3 answers
49 views

How to pass application user names to the database server for audit purposes?

Writing an application that will require a user to login. I would like to use a table to store my user information; however, the user's ID will not be available to me when I create audits for all my ...
user avatar
  • 113
0 votes
1 answer
114 views

SQL Server Extended Events to Capture Objects access by a User [duplicate]

I am in for a requirement where I need to use EE to capture the Objects Accessed by a particular SQL User. I want to avoid the action sqlserver.sql_text, if I use this, I will need to manually scan ...
user avatar
  • 11
0 votes
1 answer
280 views

Disable auditing of select statements

Somehow the auditing of select statements was enabled in our oracle database. We have several data processing apps that are generating upwards of 15 GB per day in the audit trail. Now we cannot turn ...
user avatar
0 votes
2 answers
72 views

Is it a good idea to split an auditable table into two tables based on the update frequency?

I'm currently designing a database schema for a small microservice which handles products. The service contains a simple REST API which allows users to perform basic management of products and an ...
user avatar
  • 25
2 votes
2 answers
90 views

Is there any reason to maintain audit columns when the target table already has an audit table?

I'm currently designing a database schema for a small microservice which handles products. The service contains a simple REST API which allows users to perform basic management of products and also ...
user avatar
  • 25
0 votes
1 answer
30 views

Which are the options I have to create a structured log of all INSERT, UPDATE and DELETE from all tables of my PostgreSQL database?

With MySql, I'm using replication api to record all changes from my database. pymysqlreplication and https://github.com/nevill/zongji are what I'm using. I wonder which are the options I have to do ...
user avatar
  • 1
1 vote
1 answer
26 views

Alternative to FK for sys.objects reference

I'm updating an audit/log table that is populated by trigger when a table is updated. My intention is to use the sys.objects.object_id for table name and column name columns in the log table but it's ...
user avatar
  • 1,127
0 votes
1 answer
115 views

Audit everything coming from an ip adress in an Oracle database

I need to audit all activity coming from a specific ip adress. Whats the best method to do this in an Oracle Database 19c?
user avatar
  • 868
4 votes
1 answer
380 views

Problem with enabling System Audit (Firebird's Trace and Audit Services)

I would like to enable System Audit on my Firebird 2.5.9.27139 (x64) database (Windows 10), to inspect all queries performed on it. I've already read some docs about what the configuration file should ...
user avatar
0 votes
1 answer
52 views

MySQL: how to use audit_log plugin to audit user modification

I am trying to audit any user modification action (create user/alter user/drop user/rename user) on a MySQL Enterprise server 5.7.24. I have installed the audit_log plugin following the document, and ...
user avatar
0 votes
1 answer
33 views

Oracle auditing: Is it possible to log when a permission is being used?

Does Oracle offer a way to log instances where a given permission is evaluated? Suppose I GRANT SELECT ANY DICTIONARY or something similar to a role, I am looking for a way to log every instance where ...
user avatar
  • 115

1
2 3 4 5
8