{"id":7608,"date":"2020-04-29T09:06:56","date_gmt":"2020-04-29T09:06:56","guid":{"rendered":"https:\/\/rax-stg-wp-aws.com\/blogs\/enable-oracle-audits-at-the-operating-system-level-in-rac-databases\/"},"modified":"2026-11-03T19:28:46","modified_gmt":"2026-11-03T19:28:46","slug":"enable-oracle-audits-at-the-operating-system-level-in-rac-databases","status":"publish","type":"blogs","link":"https:\/\/www.rackspace.com\/en-gb\/blogs\/enable-oracle-audits-at-the-operating-system-level-in-rac-databases\/","title":{"rendered":"Enable Oracle audits at the operating system level in RAC databases"},"content":{"rendered":"

 Introduction<\/strong><\/p>\n

When you set this parameter to `true`, the process generates files in the directory determined by the  `AUDIT_FILE_DEST` <\/em>parameter. These files contain a protocol of all the actions of the `sys`<\/em> user. By default, the files contain the connections by `sys` <\/em>but do not include the actions that occur after the connection.<\/p>\n

If you set `AUDIT_SYS_OPERATIONS=true`, the audit file containing all the actions of `sys` <\/em>belongs to the operating system user that installed the database– usually, the Oracle user. A user with privileges to connect as
\n`sys` <\/em>probably also has the privilege to connect as `Oracle` on the operating system (OS) level. This access makes using `AUDIT_SYS_OPERATIONS<\/em>` somewhat useless from a security standpoint. So, Oracle permits `root` to own the audit file, which should make it harder for the database administrator to manipulate or delete
\nthe file.<\/p>\n

Configure the audit file at the OS level<\/strong><\/p>\n

Use the following steps to configure the audit file at the OS level in an Oracle Real Application Clusters (RAC) environment:<\/p>\n

Step 1: Set the database parameters<\/strong><\/p>\n

Use the following commands to set the database parameters:<\/p>\n

    SQL> alter system set audit_sys_operations=true scope=spfile;
\n    System altered.<\/em><\/p>\n

    SQL> alter system set audit_syslog_level=’LOCAL1.WARNING’ scope=spfile;
\n    System altered.<\/em><\/p>\n

    SQL> alter system set audit_trail = OS
\n    SCOPE=SPFILE;
\n    System altered.<\/em><\/p>\n

Step 2: Configure the RAC nodes<\/strong><\/p>\n

Use the following steps, as root<\/strong>, to configure the RAC1 and RAC2 nodes:<\/p>\n

a) Run the following command to back up \/etc\/rsyslog.conf<\/strong>:<\/p>\n

    cp -p \/etc\/rsyslog.conf \/etc\/rsyslog.conf.<ITK#><\/em><\/p>\n

b) Add the following lines to \/etc\/rsyslog.conf<\/strong>:<\/p>\n

    # Oracle audit <ITK#>
\n    local1.warning \/var\/log\/oracle\/db_name_audit.log<\/em><\/p>\n

#### Step 3: Restart the syslog logger<\/p>\n

Run the following commands to restart the `syslog<\/em>` logger process:<\/p>\n

    service rsyslog status
\n    service rsyslog restart
\n    service rsyslog status<\/em><\/p>\n

 Step 4: Restart the RAC database<\/strong><\/p>\n

Use the following steps to restart the RAC database on RAC1 and RAC2 in a rolling fashion:<\/p>\n

a) Run the following commands on RAC2:<\/p>\n

    srvctl stop instance -d DB_NAME -i DB_SID2
\n    srvctl start instance -d DB_NAME -i DB_SID2
\n    srvctl status database -d DB_NAME<\/em><\/p>\n

b) Wait for ten minutes.<\/p>\n

c) Run the following commands on RAC1:<\/p>\n

    srvctl stop instance -d DB_NAME -i DB_SID1
\n    srvctl start instance -d DB_NAME -i DB_SID1
\n    srvctl status database -d DB_NAME<\/em><\/p>\n

 Step 5: Set up the logrotate file<\/strong><\/p>\n

To set up the logrotate<\/strong> file on RAC1 and RAC2, edit \/etc\/logrotate.d\/oracle_audit<\/strong>,
\nas root<\/strong>, to include the following lines:<\/p>\n

    \/var\/log\/oracle\/db_name_audit.log
\n    {
\n       rotate 12
\n       compress
\n       weekly
\n       dateext
\n       notifempty
\n       missingok
\n       copytruncate
\n    }<\/em>
\n <\/p>\n

Logrotate parameters<\/strong><\/p>\n

You can include the following options (collected from Manage your logs using Logrotate<\/a>] and the man file<\/a> in the logrotate<\/strong> configuration file:<\/p>\n