Questions tagged [audit]

Database auditing involves observing a database so as to be aware of the actions of database users.

Filter by
Sorted by
Tagged with
0
votes
1answer
46 views

After delete audit table doesn't have the rows that were deleted

CREATE TRIGGER trgEmp ON Emp AFTER DELETE AS BEGIN IF EXISTS (SELECT * FROM deleted) AND NOT EXISTS (SELECT * FROM inserted) BEGIN INSERT INTO EmpAudit ( Change, ...
0
votes
2answers
2k views

Check all login users list from back 3 months

There is any way to check all database login users list and their activities from back 3 months in SQL Server? I tried with SQL server Logs but I need more info about user activities from past 3 ...
0
votes
1answer
123 views

MongoDB Auditing vs. Profling

I wanted in the first place to log connections to a collection and while I was searching I found that it's possible to configure profiling and auditing and logging. So my question is : What's the ...
0
votes
1answer
502 views

Check users not being audited

I need to confirm that actions by privileged users are being audited. As far as I can tell from views such as dba_stmt_audit_opts, the statements by the privileged users I want to be audited are being ...
2
votes
2answers
5k views

What happens if sys.aud$ is full in Oracle?

I am not seeing this in the documentation, but what happens when the Oracle 10.2 audit trail is full? Does it just not making any more audit records? Overwrites the oldest records? Shuts down the ...
0
votes
1answer
458 views

Where are SYS Audit Entries in Windows Event Log?

I have audit_sys_operations set to true, audit_trail set to DB, have restarted the database since setting them, and have logged in as and performed actions as sysdba. However, I cannot find these ...
1
vote
2answers
188 views

Can `sys.aud$` recycle itself?

In Oracle 11, what happens if I leave sys.aud$ to get bloated up to soak up the whole SYSTEM TABLESPACE? Does it start rewriting the oldest records? Can Oracle be configured to do so? Does it stop ...
1
vote
2answers
62 views

Audit kernel module usage in Oracle

In my continuing effort to bring my database up to a given standard, I need to ensure that all loading, unloading, and restarting of kernel modules are being audited. I have no idea what this thing is ...
2
votes
3answers
1k views

Logins Not being used in last one month

I have a requirement to create a query which can get the logins details which were not used in last one month. I have tried several way like extended events and audit tracing. But i'm unable to get ...
5
votes
1answer
418 views

sp_tables blocking my other statements. Who runs it?

In our application we sporadically experience a locking issue caused by the execution of an sp_tables statement. We use SQL Server 2012. In our code and queries in our stored procedures we don't make ...
1
vote
1answer
575 views

Find current users DDL statement running, Oracle 11g

I have created a database trigger (oracle 11.2.0.4 standard edition on windows 2008 R2) to intercept any drop or truncate statements, eg drop table abc123; and that will raise an exception to ...
1
vote
0answers
1k views

How to audit database user password changes in oracle 11g?

I want to record how many times or which user accounts passwords were changed using Oracle database auditing techniques. I also want to record any password changes done to system user account.
5
votes
2answers
525 views

Alternative to triggers on system views for user auditing

Even writing the title I'm cringing at the idea I've tried this (but hey, I've learned something in the process). I've got a problem with developers running migration scripts on the database and in ...
0
votes
1answer
1k views

Audit all does not capture truncate

I want to capture truncate and drop operations on my table. So i executed the following: SQL> select name, value from v$parameter where name like '%aud%'; NAME VALUE ---- ----...
0
votes
2answers
822 views

Auditing sysadmin members by a specific group

A Sql Server 2012 Database Audit performs an audit on sysadmins when you specify the principal DBO. However, this causes ALL the sysadmins to be audited. What configuration or solution can be used to ...
0
votes
1answer
294 views

Is there any MongoDB handler for find event?

I want to know is there any handler or trigger kind of functionality exist in MongoDB which can help me to run my mongo command on find query? Basically, I want to run a specific set of Mongo queries ...
1
vote
1answer
321 views

Auditing authentication issues in a distributed environment

I'm trying to get a better handle on what locked out a specific user when multiple Oracle databases are involved using database links. Setup: sqlplus kjohnston@db2 create user testuser identified ...
3
votes
1answer
5k views

How to track failed logon attempts using Unified Auditing

I activated a ORA_LOGON_FAILURES policy and I've tried to execute select * from unified_audit_trail where unified_audit_policies = 'ORA_LOGON_FAILURES'; But it doesn't work. All my failed ...
3
votes
1answer
1k views

Way to track data deleted from database

I'm using Oracle 11g database in archivelog mode and auditing is not enabled. Two days before, a few lines from a child table in my database got deleted. As the schema password was shared, I'm unable ...
0
votes
1answer
634 views

How to Audit 2 or more SQL Logins (server principals) using SQL Server Audit

I need to audit the few SQL Server Logins, I have used filters while creating Server Audit by using CREATE SERVER AUDIT [audit123] TO FILE ( FILEPATH = N'D:\' ,MAXSIZE = 2048 MB ,...
2
votes
2answers
2k views

Audit Plugin on Ubuntu: CONTROL [main] Failed global initialization: FileNotOpen: Failed to open “/path” : exit status 1

We use MongoDB 3.2.11 and try to enable Audit. New in version 2.6. MongoDB Enterprise includes an auditing capability for mongod and mongos instances. The auditing facility allows ...
3
votes
3answers
81 views

Auditing which tables get joined most often

I'm trying to establish some metrics associated with which tables in our database get joined together the most often. How can I go about accomplishing this? edit: I should explain my reasoning; we ...
2
votes
1answer
1k views

dynamically create trigger to audit row changes

I'm using this approach to create a trigger to catch data changes. However, the system allows schema changes, and I would like to create this trigger dynamically after a new table has been created. I ...
1
vote
1answer
239 views

Auditing - sp_send_dbmail from server-level triggers failed

I have a server-level trigger to send a mail when a database is created. I have a few users in the db_creator server role. The trigger fails for these users because they don't have permissions to ...
2
votes
2answers
20k views

Oracle SYS Auditing with Audit Trail to DB

I have an Oracle Database 11g R2 on Oracle Enterprise Linux. I have enabled SYS auditing as: SQL> ALTER SYSTEM SET audit_sys_operations=true SCOPE=spfile; SQL> ALTER SYSTEM SET audit_trail=OS ...
1
vote
1answer
31 views

How can I get the host_name who creates a DB (proactive mode) in SQL Server 2008?

First, I want to clarify that I am not looking for a SELECT HOST_NAME(). I am managing a database environment and have given the developers permission to create the databases they need in the ...
1
vote
0answers
107 views

SQL Server Audit with dynamic sql

I'm trying to implement database level audit on some tables for tracking the changes. When I activate the audit I see the results in the audit file as seen below. UPDATE "MYDB"."dbo"."MyCompany$Mail ...
6
votes
2answers
7k views

Add columns to all tables in a database if the columns don't exist

I have to implement auditing in a database with many (50+) tables. I am looking to add the user name and the time when the user altered the record as columns to all tables. However, some tables have ...
2
votes
0answers
2k views

Storing table history - is this a good use case for Postgres's table partitioning / inheritance?

I currently have a products table which stores product information (title, description, tags, manufacturer, etc.) for a website. I would like to store historical information of changes to this table -...
0
votes
1answer
517 views

SQL Server - Uniqueness Of The Transaction ID

For auditing purposes, I need to get the unique transaction id from inside the current transaction. I will log the mapping between this transaction id and the application specific session id in a ...
2
votes
1answer
947 views

Determine the command type in a DDL trigger / get names and datatypes of new columns

Given strings corresponding to DDL commands, how can I determine which DDL command (column addition, constraint addition etc.) it precisely is? I have a DDL trigger on a database that will be fired ...
14
votes
1answer
553 views

Can I tell when and who updated my database from v11 to v12 on Azure?

Earlier today I noticed that all my Azure SQL database servers where updated from v11 to v12. I am the only one in my company that should be touching those dials, but not the only person in my company ...
4
votes
2answers
417 views

Windows Storage Server, SQL Server, regular files — means to protect from insider threats?

This is my first post here, and I am by no means qualified as a Windows Server or Storage Server 2008 or SQL Server 2008 administrator. I am mostly a Unix guy, however tasked with a job to investigate ...
1
vote
1answer
162 views

Applying audit policy on multiple auditing subject or object

I have created a policy on execute category and I would like to know if this policy can be applied on multiple auditing subject or object. Since the execute category will generate many audit entries I ...
13
votes
5answers
6k views

eCommerce orders table. Save prices, or use an audit/history table?

Im designing my first eCommerce schema. I've been reading around the subject for a little while, and am a bit confused about the relationship between an order_line_item and a product A product can ...
0
votes
1answer
1k views

Unable to remove trace from sys.traces

We recently discovered one of our drives was being filled up by audittrace files. One of our DBAs turned off C2 auditing which should normally stop the files filling up the drive. However, it appears ...
0
votes
1answer
635 views

History of User privileges held

In Oracle 12c or 11g, is it possible to fetch the history of user privileges held by a schema? Say from last two months, I might have granted different roles and privileges. I can get the current ...
0
votes
1answer
4k views

Oracle auditing on specific user activity

I want to be able audit user 'SCOTT' on 'SELECT, INSERT, UPDATE, DELETE' dml operations across all objects in the database SCOTT has access to. I'm familiar with dbms_fga but I can't achieve what I'd ...
2
votes
1answer
167 views

Audit use of CLR Table-valued function

I have written some CLR table-valued functions that invoke a web service and I would like to audit their use. Does anyone know of any way this can be achieved in the CLR code itself? I would be nice ...
1
vote
1answer
2k views

SQL trigger to get User ID column

I would like to achieve the following: Users log into a web app, using their credentials from the users table. After inserting a row into the inserttest table, a trigger activates in which it ...
5
votes
1answer
6k views

Stored Procedure Processing and Error Log

I used to work for a company where they had this 3rd party Data warehouse Solution. Obviously all the objects and tables were hidden in the Supporting database so I don't have clear idea on what ...
0
votes
1answer
53 views

Audit Requirement - Capture Logins vs Database

I have a question, I hope you can give me some guidance based on your high expertise level. There is an audit requirement where we have to provide login information per databases on a given server. ...
0
votes
1answer
283 views

All in one query for tracking changes in sql server

Is there any feature in SQL Server 2012 or in any version, wherein I can track all DB activities (DDL and DML) and others in one single query with who has modified and from where and when? I need ...
1
vote
2answers
117 views

SQL Server - storing audit to table

Is there a standardised way to store auditing information constantly to a table for further analyse?
0
votes
1answer
264 views

Loop through all tables and detect changed rows using checksum or hashbytes

All the tables have an extra row called checksum which is stored by doing INSERT INTO example_table VALUES ('a','b', BINARY_CHECKSUM('a','b')). Suppose someone change a row value, obviously the ...
4
votes
4answers
673 views

Consolidating a row of data, based on previous rows

I'm trying to build a history table out of an audit log (ultimately to build out a type 2 dimension table). Unfortunately, the audit log only records the specific fields being changes. Here's a ...
1
vote
0answers
1k views

Trying to install Audit_log Plugin on MySQL

I'm trying to install the Percona Audit_log plugin for my instance of MySQL. I ran it previously so I know it works ok with MySQL (I'm sure it says so in the documentation anyway). I have MySQL 5.5....
0
votes
1answer
893 views

os_username vs username in Oracle audits

I have recently been given the task of building reports from the audits of our Oracle 11g database. While not being the DBA and him being on vacation for a few weeks I have troubles understanding how ...
4
votes
4answers
6k views

Can SQL Server Audit be used to track hostnames or IP adresses of the users performing DML on a table?

I have been reading about SQL Server Audit, and so far I have assimilated that it tracks the command that has been executed, and some other additional information(SPID, object ID and stuff). But can ...
2
votes
1answer
17k views

Tracing failed login attempts in Oracle

I have some users who are logging in with a wrong password and their accounts get locked. Now I need to find the source of the failed login attempt. The machine, username etc. Is it possible to find ...

1 2 3
4
5
7