环境：centos 6.10 ORACLE 11.2.0.1 RAC 环境
== audit 文件夹
[root@rac01 ~]# df -i Filesystem Inodes IUsed IFree IUse% Mounted on /dev/mapper/vg_rac01-lv_root 3276800 673377 2603423 21% / tmpfs 4105886 272 4105614 1% /dev/shm /dev/vda1 128016 39 127977 1% /boot /dev/mapper/vg_rac01-lv_home 8773632 117 8773515 1% /home [root@rac01 ~]# find /u01/ -user zabbix [root@rac01 ~]# find / -type f -size +500M |xargs du -shm find: `/proc/183849/task/183849/fdinfo/5': No such file or directory find: `/proc/183849/fdinfo/5': No such file or directory 1060 /opt/linux.x64_11gR2_database_2of2.zip 1005 /opt/linux.x64_11gR2_grid.zip 1182 /opt/linux.x64_11gR2_database_1of2.zip 16501 /home/swapfile/swapfile 940 /home/rman_store/***_2021-07-31.dmp 936 /home/rman_store/***_2021-07-29.dmp You have new mail in /var/spool/mail/root [root@rac01 ~]# find /u01 -amin -20 /u01/app/oracle/product/11.2.0/db_1/dbs/orapw***1 /u01/app/oracle/diag /u01/app/oracle/diag/rdbms/***/**1/metadata/INC_METER_SUMMARY.ams /u01/app/oracle/diag/rdbms/***/***1/metadata/INC_METER_INFO.ams /u01/app/oracle/diag/rdbms/***/***1/metadata/INC_METER_CONFIG.ams /u01/app/11.2.0/grid/rdbms/audit /u01/app/11.2.0/grid/rdbms/audit/+asm1_ora_182937_1.aud /u01/app/11.2.0/grid/rdbms/audit/+asm1_ora_183537_4.aud /u01/app/11.2.0/grid/rdbms/audit/+asm1_ora_183530_6.aud /u01/app/11.2.0/grid/rdbms/audit/+asm1_ora_181601_3.aud /u01/app/11.2.0/grid/rdbms/audit/+asm1_ora_181598_4.aud /u01/app/11.2.0/grid/rdbms/audit/+asm1_ora_182283_3.aud /u01/app/11.2.0/grid/rdbms/audit/+asm1_ora_182934_1.aud /u01/app/11.2.0/grid/rdbms/audit/+asm1_ora_182280_3.aud /u01/app/11.2.0/grid/rdbms/audit/+asm1_ora_182941_2.aud /u01/app/11.2.0/grid/rdbms/audit/+asm1_ora_182286_4.aud /u01/app/11.2.0/grid/rdbms/audit/+asm1_ora_181604_3.aud /u01/app/11.2.0/grid/rdbms/audit/+asm1_ora_183534_3.aud /u01/app/11.2.0/grid/auth/ohasd/rac01 /u01/app/11.2.0/grid/auth/crs/rac01 /u01/app/grid/diag [root@rac01 ~]# ll /u01/app/11.2.0/grid/rdbms/audit/ |wc -l 477093
查看文件内容
[root@rac01 audit]# cat +asm1_ora_99999_3.aud Audit file /u01/app/11.2.0/grid/rdbms/audit/+asm1_ora_99999_3.aud Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit Production With the Real Application Clusters and Automatic Storage Management options ORACLE_HOME = /u01/app/11.2.0/grid System name: Linux Node name: rac01 Release: 2.6.32-754.el6.x86_64 Version: #1 SMP Tue Jun 19 21:26:04 UTC 2018 Machine: x86_64 Instance name: +ASM1 Redo thread mounted by this instance: 0 <none> Oracle process number: 26 Unix process pid: 99999, image: oracle@rac01 (TNS V1-V3) Fri May 14 14:19:38 2021 -04:00 LENGTH : '142' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSASM' CLIENT USER:[4] 'grid' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[0] '' You have new mail in /var/spool/mail/root [root@rac01 audit]# find -amin -5 . ./+asm1_ora_184303_2.aud ./+asm1_ora_184300_1.aud ./+asm1_ora_99999_3.aud ./+asm1_ora_184306_2.aud [root@rac01 audit]# ll +asm1_ora_9999*.aud |wc -l 28 [root@rac01 audit]# ll +asm1_ora_99999_3.aud -rw-r----- 1 grid oinstall 723 May 14 14:19 +asm1_ora_99999_3.aud
查看oracle变量
[root@rac01 audit]# su - oracle [oracle@rac01 ~]$ sqlplus / as sysdba SQL*Plus: Release 11.2.0.1.0 Production on Thu Aug 5 20:08:23 2021 Copyright (c) 1982, 2009, Oracle. All rights reserved. Connected to: Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit Production With the Partitioning, Real Application Clusters, Automatic Storage Management, OLAP, Data Mining and Real Application Testing options SQL> select value from v$option where parameter='Unified Auditing'; no rows selected SQL> show parameter audit NAME TYPE VALUE ------------------------------------ ----------- ------------------------------ audit_file_dest string /u01/app/oracle/admin/***/adum p audit_sys_operations boolean FALSE audit_syslog_level string audit_trail string DB SQL> exit Disconnected from Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit Production With the Partitioning, Real Application Clusters, Automatic Storage Management, OLAP, Data Mining and Real Application Testing options [oracle@rac01 ~]$ su - grid Password: [grid@rac01 ~]$ sqlplus / as sysdba SQL*Plus: Release 11.2.0.1.0 Production on Thu Aug 5 20:09:09 2021 Copyright (c) 1982, 2009, Oracle. All rights reserved. Connected to: Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit Production With the Real Application Clusters and Automatic Storage Management options SQL> show parameter audit NAME TYPE VALUE ------------------------------------ ----------- ------------------------------ audit_file_dest string /u01/app/11.2.0/grid/rdbms/aud it audit_sys_operations boolean FALSE audit_syslog_level string SQL> exit Disconnected from Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit Production With the Real Application Clusters and Automatic Storage Management options
[root@rac01 audit]# pwd /u01/app/11.2.0/grid/rdbms/audit [grid@rac01 audit]$ rm -f +asm1_ora_1*.aud [grid@rac01 audit]$ ll +asm1_ora_11111*.aud |wc -l 32 [grid@rac01 audit]$ ll +asm1_ora_11111*.aud -rw-r----- 1 grid oinstall 725 Feb 27 11:13 +asm1_ora_111110_1.aud -rw-r----- 1 grid oinstall 725 May 6 17:39 +asm1_ora_111110_2.aud -rw-r----- 1 grid oinstall 725 Nov 24 2020 +asm1_ora_111111_1.aud -rw-r----- 1 grid oinstall 728 Feb 8 2020 +asm1_ora_11111_1.aud -rw-r----- 1 grid oinstall 725 May 1 2020 +asm1_ora_111112_1.aud -rw-r----- 1 grid oinstall 725 Jul 10 2020 +asm1_ora_111112_2.aud -rw-r----- 1 grid oinstall 725 Jun 7 19:48 +asm1_ora_111112_3.aud -rw-r----- 1 grid oinstall 725 Sep 6 2020 +asm1_ora_111113_1.aud -rw-r----- 1 grid oinstall 725 Nov 28 2020 +asm1_ora_111113_2.aud -rw-r----- 1 grid oinstall 725 May 6 17:39 +asm1_ora_111113_3.aud -rw-r----- 1 grid oinstall 727 Apr 9 2020 +asm1_ora_111114_1.aud -rw-r----- 1 grid oinstall 725 Nov 20 2020 +asm1_ora_111114_2.aud -rw-r----- 1 grid oinstall 725 Nov 24 2020 +asm1_ora_111114_3.aud -rw-r----- 1 grid oinstall 725 Nov 28 2020 +asm1_ora_111114_4.aud -rw-r----- 1 grid oinstall 725 Sep 6 2020 +asm1_ora_111115_1.aud -rw-r----- 1 grid oinstall 725 Oct 26 2020 +asm1_ora_111115_2.aud -rw-r----- 1 grid oinstall 725 Nov 20 2020 +asm1_ora_111115_3.aud -rw-r----- 1 grid oinstall 725 Nov 24 2020 +asm1_ora_111115_4.aud -rw-r----- 1 grid oinstall 725 Jun 7 19:48 +asm1_ora_111115_5.aud -rw-r----- 1 grid oinstall 725 Feb 12 2020 +asm1_ora_111116_1.aud -rw-r----- 1 grid oinstall 725 Aug 25 2020 +asm1_ora_111116_2.aud -rw-r----- 1 grid oinstall 725 Nov 20 2020 +asm1_ora_111116_3.aud -rw-r----- 1 grid oinstall 725 Feb 27 11:13 +asm1_ora_111116_4.aud -rw-r----- 1 grid oinstall 725 Mar 15 13:01 +asm1_ora_111116_5.aud -rw-r----- 1 grid oinstall 725 Feb 12 2020 +asm1_ora_111117_1.aud -rw-r----- 1 grid oinstall 725 Nov 28 2020 +asm1_ora_111117_2.aud -rw-r----- 1 grid oinstall 725 Feb 27 11:13 +asm1_ora_111117_3.aud -rw-r----- 1 grid oinstall 725 Sep 6 2020 +asm1_ora_111118_1.aud -rw-r----- 1 grid oinstall 725 Jun 7 19:48 +asm1_ora_111118_2.aud -rw-r----- 1 grid oinstall 725 Aug 25 2020 +asm1_ora_111119_1.aud -rw-r----- 1 grid oinstall 725 Oct 26 2020 +asm1_ora_111119_2.aud -rw-r----- 1 grid oinstall 725 Mar 15 13:01 +asm1_ora_111119_3.aud [grid@rac01 audit]$ du -sh 27M . [grid@rac01 audit]$ df -i Filesystem Inodes IUsed IFree IUse% Mounted on /dev/mapper/vg_rac01-lv_root 3276800 197640 3079160 7% / tmpfs 4105886 272 4105614 1% /dev/shm /dev/vda1 128016 39 127977 1% /boot /dev/mapper/vg_rac01-lv_home 8773632 117 8773515 1% /home [grid@rac01 audit]$ ll |wc -l 1351 [grid@rac01 audit]$ find /u01/app/11.2.0/grid/rdbms/audit -mtime +1 -name "+asm1_ora_*.aud" |xargs rm -rf "+asm1_ora_*.aud"
节点2
[root@rac02 ~]# df -i Filesystem Inodes IUsed IFree IUse% Mounted on /dev/mapper/vg_rac02-lv_root 3276800 647641 2629159 20% / tmpfs 4105886 272 4105614 1% /dev/shm /dev/vda1 128016 39 127977 1% /boot /dev/mapper/vg_rac02-lv_home 8773632 125 8773507 1% /home [root@rac02 ~]# su - grid [grid@rac02 ~]$ cd /u01/app/11.2.0/grid/rdbms/audit [grid@rac02 audit]$ ll +asm2_ora_9999*.aud |wc -l 26 ## find /u01/app/11.2.0/grid/rdbms/audit -mtime +1 -name "+asm2_ora_*.aud" |xargs rm -f "+asm2_ora_*.aud" [grid@rac02 audit]$ find /u01/app/11.2.0/grid/rdbms/audit -mtime +1 -name "+asm2_ora_*.aud" |xargs rm -f "+asm2_ora_*.aud" [grid@rac02 audit]$ df -i Filesystem Inodes IUsed IFree IUse% Mounted on /dev/mapper/vg_rac02-lv_root 3276800 172851 3103949 6% / tmpfs 4105886 272 4105614 1% /dev/shm /dev/vda1 128016 39 127977 1% /boot /dev/mapper/vg_rac02-lv_home 8773632 125 8773507 1% /home [grid@rac02 audit]$ ll |wc -l 1747
==adump 文件夹 ：记录的是SYS的登录信息，用以审计，可以删除
[root@rac01 ~]# cd /u01/app/oracle/admin/ [root@rac01 ***]# ll total 1908 drwxr-x--- 2 oracle oinstall 1933312 Aug 5 20:08 adump drwxr-x--- 2 oracle oinstall 4096 Feb 8 2020 dpdump drwxr-x--- 2 oracle oinstall 4096 Feb 8 2020 hdump drwxr-x--- 2 oracle oinstall 4096 Feb 8 2020 pfile drwxr-x--- 2 oracle oinstall 4096 Feb 8 2020 scripts [root@rac01 ***]# cd adump/ [root@rac01 adump]# ls |wc -l 42668 [root@rac01 adump]# find -atime -2 . ./***1_ora_186002_1.aud [root@rac01 adump]# cat ***1_ora_186002_1.aud Audit file /u01/app/oracle/admin/***/adump/***1_ora_186002_1.aud Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit Production With the Partitioning, Real Application Clusters, Automatic Storage Management, OLAP, Data Mining and Real Application Testing options ORACLE_HOME = /u01/app/oracle/product/11.2.0/db_1 System name: Linux Node name: rac01 Release: 2.6.32-754.el6.x86_64 Version: #1 SMP Tue Jun 19 21:26:04 UTC 2018 Machine: x86_64 Instance name: ***1 Redo thread mounted by this instance: 1 Oracle process number: 44 Unix process pid: 186002, image: oracle@rac01 (TNS V1-V3) Thu Aug 5 20:08:23 2021 -04:00 LENGTH : '160' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[5] 'pts/0' STATUS:[1] '0' DBID:[10] '1639890347' [root@rac01 adump]# find /u01/app/oracle/admin/**/adump/ -mtime +1 -name "*aud" -exec rm -rf {} ; ^C [root@rac01 adump]# ls | xargs -n 10 rm -fr ls