ORACLE 11g 实现伪审计用户<登陆退出>的详细记录

-- Create table  
create table UC_LOGON_OFF  
(  
  user_id         VARCHAR2(30),  
  session_id      NUMBER(8),  
  host            VARCHAR2(30),  
  last_program    VARCHAR2(48),  
  last_action     VARCHAR2(32),  
  last_module     VARCHAR2(32),  
  logon_day       DATE,  
  logon_time      VARCHAR2(10),  
  logoff_day      DATE,  
  logoff_time     VARCHAR2(10),  
  elapsed_minutes NUMBER(8),  
  sid             NUMBER(8),  
  serial          NUMBER(8)  
)  
tablespace USERS    
  pctfree   10       //--Pctfree：块中保留用于UPDATE操作的空间百分比，当数据占用的空间达到此上限时，新的数据将不能插入此块中
  initrans  1        //1--并行事务控制，1个代表最多一个并行事务
  maxtrans  255;    //--maxtrains定义了数据块中数据槽的最大值。事务表会根据需要动态扩展，最大达到MAXTRANS 个条目（假设块上有足够的自由空间）。所分配的每个事务条目需要占用块首部中的23～24 字节的存储空间。

CREATE OR REPLACE TRIGGER trig_logon_audit  
  AFTER LOGON  
   ON DATABASE  
BEGIN  
   INSERT INTO timdba.uc_logon_off  
        select  USER,  
                SYS_CONTEXT (‘USERENV‘, ‘SESSIONID‘),  
                SYS_CONTEXT (‘USERENV‘, ‘HOST‘),  
                NULL,  
                NULL,  
                NULL,  
                SYSDATE,  
                TO_CHAR (SYSDATE, ‘yyyy-mm-dd hh24:mi:ss‘),  
                NULL,  
                NULL,  
                NULL,  
                NULL, nullfrom dual;  
END;  

CREATE OR REPLACE TRIGGER trig_logoff_audit  
 BEFORE LOGOFF  
   ON DATABASE  
DECLARE  
    v_date date;  
BEGIN  
    SELECt t.logon_day INTO v_date from (select logon_day FROM timdba.uc_logon_off where session_id= SYS_CONTEXT (‘USERENV‘, ‘SESSIONID‘) AND logon_day IS NOT NULL order by logon_day asc) t where rownum<2;  
    INSERT INTO timdba.uc_logon_off  
        select  USER,  
                SYS_CONTEXT (‘userenv‘, ‘SESSIONID‘),  
                SYS_CONTEXT (‘userenv‘, ‘host‘),  
               (SELECT action FROM v$session WHERE SYS_CONTEXT (‘USERENV‘, ‘SESSIONID‘) = audsid),  
               (SELECT program FROM v$session WHERE SYS_CONTEXT (‘USERENV‘, ‘SESSIONID‘) = audsid),  
               (SELECT module  FROM v$session WHERE SYS_CONTEXT (‘USERENV‘, ‘SESSIONID‘) = audsid),  
                v_date,  
                TO_CHAR(v_date, ‘hh24:mi:ss‘),  
                sysdate,  
                TO_CHAR(sysdate, ‘hh24:mi:ss‘),  
                TRUNC(TO_NUMBER(sysdate - v_date) * 1440,2),  
                ROUND(TO_NUMBER(sysdate - v_date) * 24 * 60*60 ),  
                NULL,  
                SYS_CONTEXT (‘userenv‘, ‘ip_address‘) from dual;  
                 
                commit;   
   COMMIT;  
END;

create or replace trigger timdba.trig_uc_logonoff  
  before update or delete on timdba.uc_logon_off  
DECLARE  
   PRAGMA AUTONOMOUS_TRANSACTION;  
BEGIN  
  IF deleting THEN  
    RAISE_APPLICATION_ERROR(-20001, ‘can not delete ‘); 
  ELSIF updating then  
    RAISE_APPLICATION_ERROR(-20001, ‘can not update ‘);  
  END IF;  
END;  

--（1）统计需要授权的语句  
grant create session,connect to dw;  
grant select on v_$sql to dw;  
grant select on v_$session to dw;  
grant select,insert on timdba.uc_logon_off to dw;  

--（2）创建临时表，记录所有用户  
create table timdba.Z_USERS as select distinct owner from all_objects;  

--（3）生成授权的sql语句  
select ‘grant create session,connect to ‘ || owner ||‘; ‘ from timdba.Z_USERS t where t.owner not in(‘TIMDBA‘,‘SYS‘,‘SYSTEM‘)  
union all  
select  ‘grant select on v_$sql to  ‘ || owner ||‘; ‘ from timdba.Z_USERS t where t.owner not in(‘TIMDBA‘,‘SYS‘,‘SYSTEM‘)  
union all  
select ‘grant select on v_$session to  ‘ || owner ||‘; ‘   from timdba.Z_USERS t where t.owner not in(‘TIMDBA‘,‘SYS‘,‘SYSTEM‘)  
union all  
select ‘grant select,insert on timdba.uc_logon_off to ‘ || owner ||‘; ‘ from timdba.Z_USERS t where t.owner not in(‘TIMDBA‘,‘SYS‘,‘SYSTEM‘);  

--（4）将sql结果记录copy到一个文件grant_logonoff.sql，放到/home/oracle目录，然后sqlplus登陆执行sql文件授权。  
SQL> @/home/oracle/grant_logonoff.sql;  
Grant succeeded.  
Grant succeeded.  
Grant succeeded.  
……s     

select  t.elapsed_minutes,t.elapsed_seconds,t.ip,t.*  
from  uc_logon_off t
where t.user_id in(‘DW‘,‘LOGMINER‘,‘YS‘,‘TIMDBA‘,‘PLCRM‘)
      and t.elapsed_minutes is not null order by t.logon_day desc,t.session_id desc;