[20170207]11G审计日志清除.txt

--//11G缺省打开了许多审计,比如登录审计(我个人建议仅仅审计不成功的登录,特别对登录密集的系统),如果系统上线时没有关闭或者取
--//消一些审计,sys.aud$在system表空间,会导致空间异常增加,而且占用system表空间不是很合理.必须建立良好的监测清理机制.

1.环境:

SCOTT@book> @ &r/ver1
PORT_STRING VERSION BANNER
------------------------------ -------------- --------------------------------------------------------------------------------
x86_64/Linux 2.4.xx 11.2.0.4.0 Oracle Database 11g Enterprise Edition Release 11.2.0.4.0 - 64bit Production

SYS@book> show parameter audit
NAME                  TYPE     VALUE
--------------------- -------- --------------------------------
audit_file_dest       string   /u01/app/oracle/admin/book/adump
audit_sys_operations boolean FALSE
audit_syslog_level    string
audit_trail           string   DB, EXTENDED
--//这是安装完成后缺省设置.

SYS@book> select count(*) from sys.aud$;
COUNT(*)
----------
1049
--//我的测试环境,已经关闭登录审计,仅仅审计不成功的登录.

2.移动SYS.AUD$ ,SYS.FGA_LOG$到别的表空间:
SYS@book> SELECT OWNER, SEGMENT_NAME, TABLESPACE_NAME FROM DBA_SEGMENTS WHERE SEGMENT_NAME IN ('AUD$', 'FGA_LOG$');

OWNER SEGMENT_NAME         TABLESPACE_NAME
------ -------------------- ------------------------------
SYS    FGA_LOG$             SYSTEM
SYS    AUD$                 SYSTEM

--以sys用户执行:
BEGIN
DBMS_AUDIT_MGMT.set_audit_trail_location(
audit_trail_type => DBMS_AUDIT_MGMT.AUDIT_TRAIL_DB_STD,
audit_trail_location_value => 'users');
END;
/

--//注意如果aud$占用空间很大,执行上述命令很慢.可以先在执行前做一些清理工作.
--//我这里是测试环境,仅仅移动到users,个人建议建立单独的表空间来保持这些审计信息.

ALTER USER SYS QUOTA UNLIMITED ON users;

--说明:
The AUDIT_TRAIL_TYPE parameter is specified using one of three constants.
DBMS_AUDIT_MGMT.AUDIT_TRAIL_AUD_STD: Standard audit trail (AUD$).
DBMS_AUDIT_MGMT.AUDIT_TRAIL_FGA_STD: Fine-grained audit trail (FGA_LOG$).
DBMS_AUDIT_MGMT.AUDIT_TRAIL_DB_STD: Both standard and fine-grained audit trails.
----------

SYS@book> SELECT OWNER, SEGMENT_NAME, TABLESPACE_NAME FROM   DBA_SEGMENTS WHERE SEGMENT_NAME IN ('AUD$', 'FGA_LOG$');
OWNER SEGMENT_NAME         TABLESPACE_NAME
------ -------------------- ------------------------------
SYS    FGA_LOG$             USERS
SYS    AUD$                 USERS

3.设置清理的初始化工作:
--//任由日志文件增加不是很合理,必须建立合理的清除机制,而oracle缺省并没有做清理的初始化工作:
SET SERVEROUTPUT ON
BEGIN
IF sys.DBMS_AUDIT_MGMT.is_cleanup_initialized(sys.DBMS_AUDIT_MGMT.AUDIT_TRAIL_AUD_STD) THEN
DBMS_OUTPUT.put_line('YES');
ELSE
DBMS_OUTPUT.put_line('NO');
END IF;
END;
/
NO
PL/SQL procedure successfully completed.

--//返回NO,说明没有做清理的初始化工作.

SYS@book> SELECT * FROM DBA_AUDIT_MGMT_CONFIG_PARAMS;
PARAMETER_NAME                 PARAMETER_VALUE      AUDIT_TRAIL
------------------------------ -------------------- ----------------------------
DB AUDIT TABLESPACE            USERS                STANDARD AUDIT TRAIL
DB AUDIT TABLESPACE            USERS                FGA AUDIT TRAIL
AUDIT FILE MAX SIZE            10000                OS AUDIT TRAIL
AUDIT FILE MAX SIZE            10000                XML AUDIT TRAIL
AUDIT FILE MAX AGE             5                    OS AUDIT TRAIL
AUDIT FILE MAX AGE             5                    XML AUDIT TRAIL
DB AUDIT CLEAN BATCH SIZE      10000                STANDARD AUDIT TRAIL
DB AUDIT CLEAN BATCH SIZE      10000                FGA AUDIT TRAIL
OS FILE CLEAN BATCH SIZE       1000                 OS AUDIT TRAIL
OS FILE CLEAN BATCH SIZE       1000                 XML AUDIT TRAIL
10 rows selected.

--//定义24小时执行1次清理.
BEGIN
SYS.dbms_audit_mgmt.init_cleanup(
audit_trail_type => SYS.DBMS_AUDIT_MGMT.AUDIT_TRAIL_DB_STD,
default_cleanup_interval => 24 /* hours */); -- PARAMETER NOT USED ON 11GR2 (FUTURE USE)
END;
/

SET SERVEROUTPUT ON
BEGIN
IF sys.DBMS_AUDIT_MGMT.is_cleanup_initialized(sys.DBMS_AUDIT_MGMT.AUDIT_TRAIL_AUD_STD) THEN
DBMS_OUTPUT.put_line('YES');
ELSE
DBMS_OUTPUT.put_line('NO');
END IF;
END;
/

YES
PL/SQL procedure successfully completed.

--//返回YES,说明已经做清理的初始化工作.

4.建立schedule,清理日志:
--//oracle处理这些问题的机制有点繁琐,首先是标记那些需要clean,然后交由清除程序处理.

BEGIN
DBMS_SCHEDULER.CREATE_JOB (
    job_name   => 'SYS.DAILY_AUDIT_ARCHIVE_TIMESTAMP',
    job_type   => 'PLSQL_BLOCK',
    job_action => 'BEGIN DBMS_AUDIT_MGMT.SET_LAST_ARCHIVE_TIMESTAMP(AUDIT_TRAIL_TYPE => DBMS_AUDIT_MGMT.AUDIT_TRAIL_AUD_STD,LAST_ARCHIVE_TIME => SYSDATE-30); END;',
    start_date => sysdate,
    repeat_interval => 'FREQ=HOURLY;INTERVAL=24',
    enabled    => TRUE,
    comments   => 'Create an archive timestamp'
);
END;
/
--//每个小时检查1次,标记30天前的日志.一些参数可以根据需要自己调整.我自己的测试保留30天.建议生产系统保留100天或者半年.

$ cd /u01/app/oracle/admin/book/adump
$ ls -ltr
total 388
-rw-r----- 1 oracle oinstall 795 2016-12-09 09:03:07 book_s000_64359_20161209090307799573143795.aud
-rw-r----- 1 oracle oinstall 795 2016-12-16 09:06:47 book_s000_49594_20161216090647626121143795.aud
-rw-r----- 1 oracle oinstall 795 2017-01-09 09:11:32 book_s000_57001_20170109091132668817143795.aud
-rw-r----- 1 oracle oinstall 784 2017-01-18 16:11:12 book1_ora_40227_20170118161112745444143795.aud
-rw-r----- 1 oracle oinstall 778 2017-01-18 16:11:12 book1_ora_40185_20170118161112689635143795.aud
-rw-r----- 1 oracle oinstall 981 2017-01-18 16:12:04 book1_ora_40237_20170118161156064475143795.aud
...

--//检查schedule是否启动.
SYS@book> @ &r/pt2 'SELECT OWNER,JOB_NAME,JOB_STYLE,JOB_CREATOR,JOB_TYPE,JOB_ACTION,START_DATE,REPEAT_INTERVAL,ENABLED,STATE,SYSTEM,NLS_ENV,COMMENTS FROM dba_scheduler_jobs WHERE job_name LIKE ''%AUDIT%'''
old   6:     from table(xmlsequence(cursor( &1 )))
new   6:     from table(xmlsequence(cursor( SELECT OWNER,JOB_NAME,JOB_STYLE,JOB_CREATOR,JOB_TYPE,JOB_ACTION,START_DATE,REPEAT_INTERVAL,ENABLED,STATE,SYSTEM,NLS_ENV,COMMENTS FROM dba_scheduler_jobs WHERE job_name LIKE '%AUDIT%' )))
ROW_NUM    COL_NUM COL_NAME        COL_VALUE
------- ---------- --------------- ----------------------------------------------------------------------------------------------------
      1          1 OWNER           SYS
                 2 JOB_NAME        DAILY_AUDIT_ARCHIVE_TIMESTAMP
                 3 JOB_STYLE       REGULAR
                 4 JOB_CREATOR     SYS
                 5 JOB_TYPE        PLSQL_BLOCK
                 6 JOB_ACTION      BEGIN DBMS_AUDIT_MGMT.SET_LAST_ARCHIVE_TIMESTAMP(AUDIT_TRAIL_TYPE => DBMS_AUDIT_MGMT.AUDIT_TRAIL_AUD
                 7 START_DATE      2017-02-07 10:06:40.000000 +08:00
                 8 REPEAT_INTERVAL FREQ=HOURLY;INTERVAL=24
                 9 ENABLED         TRUE
                10 STATE           SCHEDULED
                11 SYSTEM          TRUE
                12 NLS_ENV         NLS_LANGUAGE='AMERICAN' NLS_TERRITORY='AMERICA' NLS_CURRENCY='$' NLS_ISO_CURRENCY='AMERICA' NLS_NUME
                13 COMMENTS        Create an archive timestamp
13 rows selected.)

--//建立清理程序:
BEGIN
SYS.DBMS_AUDIT_MGMT.CREATE_PURGE_JOB(
    AUDIT_TRAIL_TYPE           => SYS.DBMS_AUDIT_MGMT.AUDIT_TRAIL_AUD_STD,
    AUDIT_TRAIL_PURGE_INTERVAL => 24 /* hours */,
    AUDIT_TRAIL_PURGE_NAME     => 'Daily_Audit_Purge_Job',
    USE_LAST_ARCH_TIMESTAMP    => TRUE
);
END;
/

--//检查schedule是否建立.
SYS@book> SELECT JOB_NAME,JOB_STATUS,AUDIT_TRAIL,JOB_FREQUENCY FROM DBA_AUDIT_MGMT_CLEANUP_JOBS;
JOB_NAME JOB_STAT AUDIT_TRAIL JOB_FREQUENCY
--------------------- -------- --------------------- ------------------------
DAILY_AUDIT_PURGE_JOB ENABLED STANDARD AUDIT TRAIL FREQ=HOURLY;INTERVAL=24

SYS@book> @ &r/pt2 'SELECT OWNER,JOB_NAME,JOB_STYLE,JOB_CREATOR,JOB_TYPE,JOB_ACTION,START_DATE,REPEAT_INTERVAL,ENABLED,STATE,SYSTEM,NLS_ENV,COMMENTS FROM dba_scheduler_jobs WHERE job_name LIKE ''%AUDIT%'''
old   6:     from table(xmlsequence(cursor( &1 )))
new   6:     from table(xmlsequence(cursor( SELECT OWNER,JOB_NAME,JOB_STYLE,JOB_CREATOR,JOB_TYPE,JOB_ACTION,START_DATE,REPEAT_INTERVAL,ENABLED,STATE,SYSTEM,NLS_ENV,COMMENTS FROM dba_scheduler_jobs WHERE job_name LIKE '%AUDIT%' )))
ROW_NUM    COL_NUM COL_NAME        COL_VALUE
------- ---------- --------------- ----------------------------------------------------------------------------------------------------
      1          1 OWNER           SYS
                 2 JOB_NAME        DAILY_AUDIT_ARCHIVE_TIMESTAMP
                 3 JOB_STYLE       REGULAR
                 4 JOB_CREATOR     SYS
                 5 JOB_TYPE        PLSQL_BLOCK
                 6 JOB_ACTION      BEGIN DBMS_AUDIT_MGMT.SET_LAST_ARCHIVE_TIMESTAMP(AUDIT_TRAIL_TYPE => DBMS_AUDIT_MGMT.AUDIT_TRAIL_AUD
                 7 START_DATE      2017-02-07 10:06:40.000000 +08:00
                 8 REPEAT_INTERVAL FREQ=HOURLY;INTERVAL=24
                 9 ENABLED         TRUE
                10 STATE           SCHEDULED
                11 SYSTEM          TRUE
                12 NLS_ENV         NLS_LANGUAGE='AMERICAN' NLS_TERRITORY='AMERICA' NLS_CURRENCY='$' NLS_ISO_CURRENCY='AMERICA' NLS_NUME
                13 COMMENTS        Create an archive timestamp
      2          1 OWNER           SYS
                 2 JOB_NAME        DAILY_AUDIT_PURGE_JOB
                 3 JOB_STYLE       REGULAR
                 4 JOB_CREATOR     SYS
                 5 JOB_TYPE        PLSQL_BLOCK
                 6 JOB_ACTION      BEGIN DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL(1, TRUE); END;
                 7 START_DATE      2017-02-07 10:10:39.837281 +08:00
                 8 REPEAT_INTERVAL FREQ=HOURLY;INTERVAL=24
                 9 ENABLED         TRUE
                10 STATE           SCHEDULED
                11 SYSTEM          TRUE
                12 NLS_ENV         NLS_LANGUAGE='AMERICAN' NLS_TERRITORY='AMERICA' NLS_CURRENCY='$' NLS_ISO_CURRENCY='AMERICA' NLS_NUME
                13 COMMENTS        Audit clean job = 'Daily_Audit_Purge_Job'
26 rows selected.)

--//这样就不必要困惑aud$异常增加,以及审计目录下存在许多文件.

SYS@book> select count(*) from sys.aud$;
COUNT(*)
----------
513
--//现在已经删除了一部分数据.

5.补充关闭登录登录的命令:

NOAUDIT CREATE SESSION WHENEVER SUCCESSFUL;