CON_ID NAME OPEN_MODE
—— ——— ———-
2 PDB$SEED READ ONLY
3 SALESPDB READ WRITE
4 HRPDB READ WRITE
5 APP_ROOT READ WRITE
6 APP_PDB1 READ WRITE

# 切换到PDB
SQL> ALTER SESSION SET CONTAINER = fgfgfgsalespdb;

Session altered.

# 查看审计参数
SQL> SHOW PARAMETER audit

NAME TYPE VALUE
———————————— ———– ——————————
audit_file_dest string /oracle/app/oracle/admin/orclcdb/adump
audit_sys_operations boolean TRUE
audit_trail string DB

# 配置标准审计
SQL> AUDIT SESSION BY fgfgfgsales_user;

Audit succeeded.

SQL> AUDIT TABLE BY fgfgfgsales_user BY ACCESS;

Audit succeeded.

SQL> AUDIT UPDATE, DELETE ON fgfgfgsales.orders BY fgfgfgsales_user;

Audit succeeded.

# 查看审计选项
SQL> SELECT user_name, audit_option, success, failure FROM dba_audit_trail_options WHERE user_name = ‘SALES_USER’ ORDER BY user_name, audit_option;

USER_NAME AUDIT_OPTION SUCCESS FAILURE
———– —————- ——— ———
SALES_USER SESSION BY ACCESS BY ACCESS
SALES_USER TABLE BY ACCESS BY ACCESS
SALES_USER UPDATE ON ORDERS BY ACCESS BY ACCESS
SALES_USER DELETE ON ORDERS BY ACCESS BY ACCESS

# 验证标准审计配置成功

Session altered.

# 创建精细审计策略
SQL> BEGIN
DBMS_FGA.ADD_POLICY(
object_schema => ‘SALES’,
object_name => ‘ORDERS’,
policy_name => ‘ORDERS_FGA_POLICY’,
audit_condition => ‘TOTAL_AMOUNT > 10000’,
audit_column => ‘TOTAL_AMOUNT’,
handler_schema => NULL,
handler_module => NULL,
enable => TRUE
);
END;
/

PL/SQL procedure successfully completed.

# 查看精细审计策略
SQL> SELECT object_schema, object_name, policy_name, enabled FROM dba_audit_policies WHERE object_schema = ‘SALES’ AND object_name = ‘ORDERS’;

OBJECT_SCHEMA OBJECT_NAME POLICY_NAME ENABLED
————- ———— —————— ——–
SALES ORDERS ORDERS_FGA_POLICY YES

# 验证精细审计配置成功

Session altered.

# 查看统一审计状态
SQL> SELECT value FROM v$option WHERE parameter = ‘Unified Auditing’;

VALUE
——
FALSE

# 配置统一审计
SQL> ALTER SYSTEM SET AUDIT_TRAIL = ‘DB, EXTENDED’ SCOPE = SPFILE;

System altered.

# 重启数据库
SQL> SHUTDOWN IMMEDIATE;

Database closed.
Database dismounted.
ORACLE instance shut down.

SQL> STARTUP;

ORACLE instance started.

Total System Global Area 838860800 bytes
Fixed Size 9139560 bytes
Variable Size 536870912 bytes
Database Buffers 285212672 bytes
Redo Buffers 7637656 bytes
Database mounted.
Database opened.

# 查看统一审计状态
SQL> SELECT value FROM v$option WHERE parameter = ‘Unified Auditing’;

VALUE
——
TRUE

# 验证统一审计配置成功

Session altered.

# 创建审计策略
SQL> CREATE AUDIT POLICY fgfgfgsales_audit_policy
PRIVILEGES CREATE SESSION, CREATE TABLE, DROP TABLE
ACTIONS UPDATE ON fgfgfgsales.orders, DELETE ON fgfgfgsales.orders
WHEN ‘SYS_CONTEXT(”USERENV”, ”SESSION_USER”) = ”SALES_USER”’
EVALUATE EVERY;

Audit policy created.

# 启用审计策略
SQL> AUDIT POLICY fgfgfgsales_audit_policy;

Audit succeeded.

# 查看审计策略
SQL> SELECT policy_name, policy_name, enabled FROM dba_audit_policies WHERE policy_name = ‘SALES_AUDIT_POLICY’;

POLICY_NAME POLICY_NAME ENABLED
—————— —————— ——–
SALES_AUDIT_POLICY SALES_AUDIT_POLICY YES

# 验证审计策略配置成功

Session altered.

# 测试标准审计
$ sqlplus fgfgfgsales_user/”NewSales123#”@fgfgfgsalespdb

SQL*Plus: Release 19.0.0.0.0 – Production on Fri Mar 31 10:00:00 2026
Version 19.3.0.0.0

Copyright (c) 1982, 2019, Oracle. All rights reserved.

Connected to:
Oracle Database 19c Enterprise Edition Release 19.0.0.0.0 – Production
Version 19.3.0.0.0

SQL> SHOW USER;

USER is “SALES_USER”

SQL> CREATE TABLE test_audit (
id NUMBER,
name VARCHAR2(100)
);

Table created.

SQL> INSERT INTO test_audit (id, name) VALUES (1, ‘Audit Test’);

1 row created.

SQL> COMMIT;

Commit complete.

# 查看审计记录
SQL> SELECT username, action_name, obj_name, timestamp FROM dba_audit_trail WHERE username = ‘SALES_USER’ ORDER BY timestamp DESC FETCH FIRST 10 ROWS ONLY;

USERNAME ACTION_NAME OBJ_NAME TIMESTAMP
————– ————– ———— ——————-
SALES_USER CREATE TABLE TEST_AUDIT 31-MAR-26 10:00:00
SALES_USER LOGON 31-MAR-26 10:00:00

# 验证标准审计成功

Session altered.

# 测试精细审计
SQL> UPDATE fgfgfgsales.orders SET total_amount = 15000 WHERE order_id = 1;

1 row updated.

SQL> COMMIT;

Commit complete.

# 查看精细审计记录
SQL> SELECT db_user, object_name, policy_name, sql_text FROM dba_fga_audit_trail WHERE db_user = ‘SALES_USER’ ORDER BY timestamp DESC FETCH FIRST 10 ROWS ONLY;

DB_USER OBJECT_NAME POLICY_NAME SQL_TEXT
——– ———— —————— ——————————
SALES_USER ORDERS ORDERS_FGA_POLICY UPDATE fgfgfgsales.orders SET total_amount = 15000 WHERE order_id = 1

# 验证精细审计成功