Home

Thursday, March 21, 2019

Steps to configure Audit job on Oracle Db's

Step1) To initialize the purge job

BEGIN
DBMS_AUDIT_MGMT.INIT_CLEANUP(
  AUDIT_TRAIL_TYPE            => DBMS_AUDIT_MGMT.AUDIT_TRAIL_ALL,
  DEFAULT_CLEANUP_INTERVAL    => 2 );
END;
/

Step2) To check the initialization is successful
SET SERVEROUTPUT ON
BEGIN
IF
   DBMS_AUDIT_MGMT.IS_CLEANUP_INITIALIZED(DBMS_AUDIT_MGMT.AUDIT_TRAIL_ALL)
THEN
   DBMS_OUTPUT.PUT_LINE('Database and OS audit are initialized for cleanup');
ELSE
   DBMS_OUTPUT.PUT_LINE('Database and OS audit are not initialized for cleanup.');
END IF;
END;
/

Step3) To purge
BEGIN
  DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL(
   AUDIT_TRAIL_TYPE           =>  DBMS_AUDIT_MGMT.AUDIT_TRAIL_ALL,
   USE_LAST_ARCH_TIMESTAMP    =>  TRUE );
END;

Step4) To schedule the puge job
BEGIN
  DBMS_AUDIT_MGMT.CREATE_PURGE_JOB (
   AUDIT_TRAIL_TYPE            => DBMS_AUDIT_MGMT.AUDIT_TRAIL_ALL,
   AUDIT_TRAIL_PURGE_INTERVAL  => 2,
   AUDIT_TRAIL_PURGE_NAME      => 'CLEANUP_OS_DB_AUDIT_RECORDS',
   USE_LAST_ARCH_TIMESTAMP     => TRUE );
END;
/

  
Step5)
SYS@DB1>BEGIN
DBMS_AUDIT_MGMT.INIT_CLEANUP(
  AUDIT_TRAIL_TYPE            => DBMS_AUDIT_MGMT.AUDIT_TRAIL_ALL,
  DEFAULT_CLEANUP_INTERVAL    => 2 );
END;
/  2    3    4    5    6

PL/SQL procedure successfully completed.

Step6)
SYS@DB1>SET SERVEROUTPUT ON
BEGIN
IF
   DBMS_AUDIT_MGMT.IS_CLEANUP_INITIALIZED(DBMS_AUDIT_MGMT.AUDIT_TRAIL_ALL)
THEN
   DBMS_OUTPUT.PUT_LINE('Database and OS audit are initialized for cleanup');
ELSE
   DBMS_OUTPUT.PUT_LINE('Database and OS audit are not initialized for cleanup.');
END IF;
END;

/
SYS@DB1>  2    3    4    5    6    7    8    9   10
Database and OS audit are initialized for cleanup

PL/SQL procedure successfully completed.

Step7)
SYS@DB1>BEGIN
  DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL(
   AUDIT_TRAIL_TYPE           =>  DBMS_AUDIT_MGMT.AUDIT_TRAIL_ALL,
   USE_LAST_ARCH_TIMESTAMP    =>  TRUE );
END;  2    3    4    5
  6  /

PL/SQL procedure successfully completed.

Step8)
SYS@DB1>BEGIN
  DBMS_AUDIT_MGMT.CREATE_PURGE_JOB (
   AUDIT_TRAIL_TYPE            => DBMS_AUDIT_MGMT.AUDIT_TRAIL_ALL,
  2    3    4     AUDIT_TRAIL_PURGE_INTERVAL  => 2,
   AUDIT_TRAIL_PURGE_NAME      => 'CLEANUP_OS_DB_AUDIT_RECORDS',
   USE_LAST_ARCH_TIMESTAMP     => TRUE );
END;
/  5    6    7    8

PL/SQL procedure successfully completed.

Step9)
SYS@DB1>select * from dba_audit_mgmt_cleanup_jobs;

JOB_NAME                                                                                             JOB_STAT AUDIT_TRAIL                  JOB_FREQUENCY
---------------------------------------------------------------------------------------------------- -------- ---------------------------- ----------------------------------------------------------------------------------------------------
CLEANUP_OS_DB_AUDIT_RECORDS                                                                          ENABLED  ALL AUDIT TRAILS             FREQ=HOURLY;INTERVAL=2

Step10)
SYS@DB1>show parameter AUDIT;

NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
audit_file_dest                      string      /u03/app/oracle/admin/CMGBOCH/
                                                 adump
audit_sys_operations                 boolean     TRUE
audit_syslog_level                   string
audit_trail                          string      OS

Step11)
SYS@DB1>select JOB_NAME,OWNER,ENABLED,LAST_START_DATE,NEXT_RUN_DATE from dba_scheduler_jobs where JOB_NAME like '%AUDIT%';

JOB_NAME                       OWNER                          ENABL LAST_START_DATE                                                             NEXT_RUN_DATE
------------------------------ ------------------------------ ----- --------------------------------------------------------------------------- ---------------------------------------------------------------------------
CLEANUP_OS_DB_AUDIT_RECORDS    SYS                            TRUE  15/FEB/2015 08:23:33.029046 PM LONDON                           
15/FEB/2015 10:23:33.000000 PM LONDON 

set pages 200 lines 200
col owner format a20
col job_name format a25
col JOB_ACTION format a75
col COMMENTS format a60  
select owner, job_name, next_run_date, state, enabled from dba_scheduler_jobs where job_name like '%AUDIT%'; 

select OWNER,JOB_NAME, JOB_ACTION, COMMENTS FROM DBA_SCHEDULER_JOBS where JOB_NAME='PURGE_AUDIT_LOG';

Get the metadata of audit job:
set pagesize 999
set long 999
select dbms_metadata.get_ddl('PROCOBJ','DAILY_AUDIT_ARCHIVE_TIMESTAMP','SYS') from dual;


Enjoy the work and do like me if you like this article!!!

Latest Posts

Number of failed login attempts exceeds threshold value

Number of failed login attempts exceeds threshold value alert message comes from OEM. How to check what and which user is causing this? how ...

Popular Posts