Oracle audit parameter

[#1]

Hello,

auditor complained settings of audit parameters in oracle 11, especially audit_sys_operations=FALSE and audit_syslog_level=' '.

I found notes 1551504, 700548, 1963700, 1128663 etc with informations about technical configuration.

But I didn't found notes or links about the recommended setting by SAP and by advisors. Sometimes these recomendations differ, so that advisors recommend stronger security settings.

What are recommended settings for these audit parameters? Is it better to log auditfiles in database? Do logs have to be reported to the UNIX-syslog? And what is a good way to secure auditfiles in a folder, so that dbauser can still access for reading or creating?

Regards,

Julia

[Former Member]

Hi julia

Auditing requirement is different for each company and auditors

now to give your question a generic reply

1. you need to set the parameter suggested by oracle in regards to your company in initsid.ora file and genrate sp file from it.

2. get it verify with the standard provided by auditor for your company then its fine phase 1 is ok.

3. now in phase 2 in regards to security of files

then you can make groups in unix / aix flavor

lets say you made group called DBA

and you have assigned users to that group

and now file system most probably

/oracle/SID/saptrace/audit /.....

you give the permission as follow

Chown userid:dba <dir name> that will make your files secure and nobody who is not in group of DBA able to change it.

regards

Dishant Pathak

[REDACTED BY MODERATOR PER SCN RULES OF ENGAGEMENT]