Preparation for Audit Analysis

This section describes two methods to analyze database server audit records:

• The first method is simply to display audit data as it appears in the audit trail, which you can subject to your own audit-analysis tools. This method guarantees accuracy because no processing is done on the raw audit records.
• The second method converts the audit records into a form that can be uploaded into a table that the database server manages. You can then use SQL to generate reports based on this data. With the SQL-based method, you can create and use customized forms and reports to manipulate and selectively view audit data, which provides a flexible and powerful audit-analysis procedure. Be sure, however, that records are not deleted or modified from either the intermediate file or from the database prior to analysis.

Both methods rely on a utility called onshowaudit, which Audit Analysis and Utility Syntax describe. For either method, you can extract audit events for specific users, database servers, or both.

Figure 4 shows the preparation process for both analysis methods. Audit Analysis explains each step in detail.

Figure 4. Preparing for Audit Analysis

To perform audit analysis, first have audit records in your database server or operating-system audit trail. The onshowaudit utility does not remove data from the audit trail. It only reads records from the audit trail and allows them to be viewed or manipulated with standard SQL utilities.