Questions tagged [audit]

Database auditing involves observing a database so as to be aware of the actions of database users.

Filter by
Sorted by
Tagged with
0
votes
1answer
25 views

Getting database-level audit logs without database audit specification

I have server level auditing on SQL Server 2014. Why am I receiving database-level audit events (such as SELECT, INSERT, UPDATE, DELETE, etc.), even though there are no database audit specifications? ...
0
votes
0answers
21 views

FGA AUDITING does not record audit

hello i dont know why my fga auditing is not working my code EXEC DBMS_FGA.ADD_POLICY(OBJECT_SCHEMA=>'PLSQL', OBJECT_NAME=>'REGIONS', AUDIT_COLUMN=>'REGION_NAME', POLICY_NAME=>'REGPOL', ...
3
votes
4answers
468 views

How to get historical queries in SQL Server, based on time

Please how do I get the query that was running at a specific time in SQL Server 2016? Something similar to AWR report in Oracle? We need to know what was happening at a specific time in the past ...
0
votes
0answers
30 views

db2 How to get the application user from delete events

We use temporal tables to store the history of all changes to specific tables in the db. But we also need the user who made the changes. While on db2 side the user is the application, the application ...
0
votes
1answer
47 views

Use trigger on DELETE to retrieve original SQL command and user who did it

I'm trying to create an audit log to store all delete commands on some tables, on MSSQL 2012. What I need is the username that executed it and the command executed, then I can insert them on a log ...
0
votes
0answers
22 views

Scheduled job not present on database, but visible from dba_scheduler_job_log

I'm seeing this error in the alert log (sorry, it's in italian!): *** 2021-09-14 23:50:17.891 *** SESSION ID:(249.6897) 2021-09-14 23:50:17.891 *** CLIENT ID:() 2021-09-14 23:50:17.891 *** SERVICE ...
1
vote
1answer
38 views

Where does PMM store login details for DBs?

I have to audit the logins used by our services and it's not clear where I find the logins used for our PMM instance to connect to the remote DBs.
1
vote
1answer
53 views

Find who is selecting from table SQL Server

We have a table that has a very long update process that I think was from a no longer used program. No one can seem to tell me if anyone still uses it or not. What is the best way to log which users ...
0
votes
1answer
72 views

How to include the oracle database name to os audit trail?

My DB settings: Connected to: Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 - Production Version 19.12.0.0.0 SYS@CDBXXX1> unified_audit_common_systemlog string ...
1
vote
0answers
28 views

Filtering for user transactions in Azure Log Analytics

We have audit logging in Azure Log Analytics set up for an Azure SQL Database we operate. I would like to query these logs to view user transactions to track down queries that have unintended ...
0
votes
1answer
97 views

How to send alert on SQL Shutdown due to Audit Failure

Looking for a way to implement this STIG. What method should I use to monitor SQL Server, when it is shutdown due to "Shutdown on Audit Failure"? SQL Server must provide an immediate real-...
0
votes
1answer
70 views

Audit table and foreign key

I have a database with multiples tables that must be audited. As an example, I have a table of objects defined with a unique ID, a name, and a description. The name will always be the same. It is not ...
0
votes
1answer
49 views

Oracle Fine-Grained Access (FGA) auditing excluding one source

I want to audit DML statements coming from other places than application user "tomcat" (OS_USER attribute). I want to focus only on developers or support team changing data in any way. DML ...
2
votes
1answer
141 views

SQL Server DML auditing - Triggers vs SQL Server Audit Feature (vs temporal tables vs change data capture)

I am looking to implement an auditing process on an instance I have on SQL Server 2017. However, I am not finding a complete conclusion on which auditing feature would be best to use for a DB with a ...
0
votes
0answers
35 views

How can I link together auditing of the sql and before and after values for row updates in Oracle

I had a number of triggers that used to work in Oracle 8i, that worked to capture both the before, and after values of a row, as well as the sql used to do the update. (I realize there would be cases ...
0
votes
1answer
32 views

MSSQL - How to log every rpc_completed event into a table?

I want to log the Execution Time and Parameters for every stored procedure call on my database. What I reached by searching is to use extended events as the latest method with minimum performance ...
0
votes
1answer
33 views

MySQL - Information_schema Events - How persistent or retention is managed

I'm a MS SQL guy and understand agent job history. I'm now working with MySQL. I've searched hi and low but I can't find any solid info on how event data within information_schema.events is persisted, ...
0
votes
0answers
23 views

Check when a privilege was granted - PostgreSQL

Is there any information_schema view that can tell when an object privilege was granted? The pg_namespace view doesn't have that. select * from pg_namespace join lateral ( SELECT * from ...
1
vote
1answer
107 views

An INSERT statement triggers the SQL Server Audit to write it down in the logs although INSERT is not listed as an Audit Action

Background: I am trying to keep a track record of what users are querying in the database. One option I found is to create a Server and Database Audit Specification. I did not want to include INSERT ...
1
vote
1answer
202 views

Extended Events Login audit - Reduce login noise

We are looking for the optimal sql login audit solution, with usable filtering. Thus far we have looked into Server Audits and profiler but have concluded that extended events look most promising, ...
0
votes
1answer
52 views

How to audit a specific query in Oracle

I want to audit a specific SQL query in Oracle. However I think we can audit only users or table level. For example I want to audit 'audit statements', such as who run the "AUDIT CREATE SESSION ...
1
vote
0answers
50 views

MS SQL Server Enterprise 2016 is truncating the audited select statements, how do we fix it?

TL;DR; I am getting SELECT as the audit output instead of the actual (suspected) query SELECT DISTINCT CONVERT(varchar, DecryptByPassphrase(getkey(N'key1'), FIELD1)) as DECRYPTED_FIELD1 FROM view1 ...
0
votes
1answer
41 views

Identify table usage in sql server before we stop the load

I tried browsing this across lot of links but cant get much of help so i am posting this question which sound bit similar. We have quite some tables which are being planned from our app team that they ...
0
votes
1answer
41 views

Find if and when a Query was run?

I am trying to get to the root of a problem and need to see if and when a specific Delete Query was run on my MS SQL Server. The command would have come from my .NET website. My Server is Windows 2012 ...
0
votes
3answers
188 views

Auditing of database connections in SQL Server 2008 R2

We are finally planning to close down our last SQL Server 2008 R2 server. Before we can proceed with this we need to track what users are connecting to which databases. We have tried different options ...
0
votes
0answers
30 views

MySQL router making mysql general log not useful

I am running MySQL 5.7 on a 3 node cluster using InnodBCluster. It is making the user of the general_log quite challenging. The mysqlrouter check ins are being logged in the mysql general_log. These ...
1
vote
1answer
40 views

Audit succesfull logons , loging every 2 seconds

I created an audit to audit only succesfull logons. But the problem is, I did it in a test environment and it's loging a connection every second Did I do something wrong ? I only selected SUCCESFULL ...
1
vote
1answer
67 views

audit on object by user in Oracle

Is there some way to audit, for example, a select in a specific table just by one specified user? something like this: audit select on foo.table by soe; this command return: ERROR at line 1: ORA-...
0
votes
2answers
41 views

reapply permissions post sql server restart

In our environment, users were granted read/write/ddladmin permissions on tempdb database (dev/qa/prod). These permissions will be lost when SQL Services restart, as tempdb rebuilds every time. One ...
1
vote
3answers
43 views

How to pass application user names to the database server for audit purposes?

Writing an application that will require a user to login. I would like to use a table to store my user information; however, the user's ID will not be available to me when I create audits for all my ...
0
votes
1answer
82 views

SQL Server Extended Events to Capture Objects access by a User [duplicate]

I am in for a requirement where I need to use EE to capture the Objects Accessed by a particular SQL User. I want to avoid the action sqlserver.sql_text, if I use this, I will need to manually scan ...
0
votes
1answer
191 views

Disable auditing of select statements

Somehow the auditing of select statements was enabled in our oracle database. We have several data processing apps that are generating upwards of 15 GB per day in the audit trail. Now we cannot turn ...
0
votes
2answers
67 views

Is it a good idea to split an auditable table into two tables based on the update frequency?

I'm currently designing a database schema for a small microservice which handles products. The service contains a simple REST API which allows users to perform basic management of products and an ...
2
votes
2answers
71 views

Is there any reason to maintain audit columns when the target table already has an audit table?

I'm currently designing a database schema for a small microservice which handles products. The service contains a simple REST API which allows users to perform basic management of products and also ...
0
votes
1answer
29 views

Which are the options I have to create a structured log of all INSERT, UPDATE and DELETE from all tables of my PostgreSQL database?

With MySql, I'm using replication api to record all changes from my database. pymysqlreplication and https://github.com/nevill/zongji are what I'm using. I wonder which are the options I have to do ...
1
vote
1answer
24 views

Alternative to FK for sys.objects reference

I'm updating an audit/log table that is populated by trigger when a table is updated. My intention is to use the sys.objects.object_id for table name and column name columns in the log table but it's ...
0
votes
1answer
69 views

Audit everything coming from an ip adress in an Oracle database

I need to audit all activity coming from a specific ip adress. Whats the best method to do this in an Oracle Database 19c?
4
votes
1answer
251 views

Problem with enabling System Audit (Firebird's Trace and Audit Services)

I would like to enable System Audit on my Firebird 2.5.9.27139 (x64) database (Windows 10), to inspect all queries performed on it. I've already read some docs about what the configuration file should ...
0
votes
1answer
36 views

MySQL: how to use audit_log plugin to audit user modification

I am trying to audit any user modification action (create user/alter user/drop user/rename user) on a MySQL Enterprise server 5.7.24. I have installed the audit_log plugin following the document, and ...
0
votes
1answer
27 views

Oracle auditing: Is it possible to log when a permission is being used?

Does Oracle offer a way to log instances where a given permission is evaluated? Suppose I GRANT SELECT ANY DICTIONARY or something similar to a role, I am looking for a way to log every instance where ...
0
votes
1answer
89 views

Oracle 11gR2 - How To Audit SYS.USER$ Table

I have a Oracle 11gR2 database and I want to audit all select operations on SYS.USER$ table for which users select on this table. When I try this command (I'm trying to run this command with SYS user):...
0
votes
1answer
28 views

Passively load a monitoring shared object into an Oracle process

I'm trying to load my own code, which should add some security features to my environment, into each oracle BEQ dedicated process. The reason I'm posting this on this platform, is that I hope there is ...
0
votes
2answers
93 views

Default trace vs auditing in SQL Server

Currently I am working in an environment that has the default trace enabled and I would like to propose that we add SQL server auditing to our environment. I'm looking for some points to put forward ...
0
votes
1answer
78 views

SQL SERVER auditing SELECT of a single column

Is this possible, or is table-level the most granular access? So far, Google search has shown nothing, and this screenshot does not mention column, but I thought I'd ask here. SQL Server version is ...
1
vote
4answers
3k views

Audit all insert, delete, update and select statements on a schema in Oracle 12.2

I cannot understand how to create a Unified Audit policy in order to audit all INSERT, UPDATE, DELETE and SELECT statements performed on all the objects within a specific schema. The goal is to track ...
0
votes
1answer
99 views

Is it good practice to only delete through a trigger to enforce 'deleted by' auditing?

We've decided to design our database such that we actually delete rows when we want to delete some data, rather than just marking them as deleted, because the latter approach means that you always ...
1
vote
1answer
119 views

MSSQL Audits are growing out of control. 1gb every 4 minutes - any way to get size down?

I am trying to setup audits for a Veeam backup server. I used the audit specifications from STIG - https://www.stigviewer.com/stig/ms_sql_server_2016_instance/ I haven't setup any database auditing ...
0
votes
1answer
32 views

Database: Storing multiple Types in single table or multiple intermediate delta tables

Using Java and Oracle. We need to update changes in Email, UserID of employee to third party. Actual table is Employee and intermediate table we keep which we will use for comparison of changes ...
0
votes
1answer
58 views

SQL Server 2016 Audit Actions, Can DatabaseAuditSpecification capture param values used in statement?

I am using Schema_Object_access_Group audit action type. When I run a select, insert, update SQL statement, it records all statements nicely. For example, captured Sql statement looks like : UPDATE ...
2
votes
1answer
296 views

Get date from SQL Server audit filename

SQL Server audit filenames use the following pattern: Name_GUID_PartitionNumber_Timestamp.sqlaudit An example filename below: Audit-ObjectChanges_2D94C1E8-CCAD-405F-A9F2-...

1
2 3 4 5
8