Oracle Audit Trail Add Program Name

18 Apr

Oracle Audit Trail Add Program Name

Auditing, Oracle Database, Oracle Audit Vault

The program name attribute (V$SESSION.PROGRAM) is not by default passed to Oracle’s audit logs. It can be optionally included. To do so, apply Patch 7023214 on the source database. After the patch is applied, the following event needs to be set:

ALTER SYSTEM SET
           EVENT='28058 trace name context forever'
           COMMENT='enable program logging in audit trail' SCOPE=SPFILE;

The table below summarizes key session attributres (V$SESSION) that are passed/not passed to Oracle auditing

Oracle Audit Trails

Session Attribute

(V$SESSION)

Description

Traditional Auditing (SYS.AUD$)

Fine Grained Auditing (SYS.FGA_LOG$)

CLIENT_IDENTIFIER

End user username

CLIENTID

CLIENTID

CLIENT_INFO

Concatenated application log string

Not passed

Not passed

MODULE

ABAP program, module, application component or service

Not passed

Not passed

ACTION

Business action being executed, page, code event, location within program

Not passed

Not passed

 

If you have questions, please contact us at info@integrigy.com

-Michael Miller, CISSP-ISSMP

Reference

 
 
 
 

 Share this post