Comments on: Select Trigger in Oracle Database – introducing Fine Grained Auditing

By: David Wendelken

David Wendelken — Fri, 10 Feb 2012 15:51:50 +0000

Hi Lucas! It’s been awhile since I last saw you at ODTUG.

Re Kalid’s question, he could embed his application’s queries in packaged procedures and have the packaged procedure record the record level info before returning the data to the calling app.

Unless, of course, they’ve given users the ability to query the data directly via sql*plus or some other tool…

Good article, by the way.

By: Lucas Jellema

Lucas Jellema — Thu, 29 Sep 2011 03:22:29 +0000

Dear Kalid,

The only way to learn about the actual primary key values accessed in the query would be to execute the query itself (with the same context variables set and the same VPD policies and View where conditions applied) from within the audit handler procedure. And that is not necessarily very easy.

One way to record every primary key for every record queried is by having all data accessed by views that consist of a query from a table (or view) joined to a table function based on PL/SQL function that takes the primary key as its input and a collection with a single row as its output. The PL/SQL function can record the primary key somewhere. Sounds somewhat farfetched... There may be an easier way - but I cannot think of it rightaway.

Lucas

By: Kalid

Kalid — Mon, 26 Sep 2011 14:06:55 +0000

Hi,
Excellent Article. Question, is it possible to capture pk of the record as in this example empid and insert that into emp_audit table? HIPPA regulation requires to store info about the record and not just the sql statement. Wondering if in 11gr2 is it possible? I know you made it clear that it is statement level trigger and not on each record returned by query but the regulation requires each record audit. That’s our requirement. Is this possible?
Thanks

By: Ammar

Ammar — Tue, 01 Feb 2011 06:47:27 +0000

I’m researcher ,
Can useful from this to fight SQL injection?I think its food idea to create something triger special to audit sql statement this is useful to detectt sql Injection .

By: Christian

Christian — Wed, 12 Jan 2011 17:19:14 +0000

Hi
Is it possible to track if someone executes a packaged procedure or function too?
Thanks
Christian

By: Lucas Jellema

Lucas Jellema — Thu, 23 Sep 2010 14:41:03 +0000

For that particular situation, you can just use an Insert trigger – no need to make things complicated with this ’select trigger’ trick.

By: kuivge

kuivge — Fri, 16 Jul 2010 12:25:25 +0000

Dear Lucas, i ‘m new member of AMIS blog.
Is is usefull to use this package / trigger when insert a record in EMP for a non-existing DEP, also insert a record in DEP for this EMP. (“cascade insert”) or should another solution be better?

By: Oracle: Loggen von Selects - PG-Forum.de

Oracle: Loggen von Selects - PG-Forum.de — Thu, 18 Jun 2009 13:32:55 +0000

[...] select trigger gleich der erste treffer – von jemandem der sich mit dem thema beschaeftigt hat AMIS Technology blog � Blog Archive � Select Trigger in Oracle Database – introducing Fine Grained A… weiter unten findest du dann noch quellen, deren titel VERMUTEN lassen, dass sie sich mit ganz [...]

By: Oracle: Loggen von Selects - PG-Forum.de

Oracle: Loggen von Selects - PG-Forum.de — Thu, 18 Jun 2009 06:50:45 +0000

[...] google – oracle select trigger gleich der erste treffer – von jemandem der sich mit dem thema beschaeftigt hat AMIS Technology blog � Blog Archive � Select Trigger in Oracle Database – introducing Fine Grained A… [...]

By: links for 2008-11-01 « My place

links for 2008-11-01 « My place — Sat, 01 Nov 2008 18:49:36 +0000

[...] AMIS Technology blog » Blog Archive » Select Trigger in Oracle Database – introducing Fine Grained… Fine Grained Auditing is primarily intended for auditing special events in the database. In Oracle 9i the only event that was supported by dbms_fga was the query event – execution of a SELECT statement. In 10g, dbms_fga has been extended to also capture DML events – INSERT, UPDATE and DELETE statements. For the purpose of our SELECT trigger, we will focus on the SELECT event. Hence, this is available in both 9i and 10g. Note: this trigger is a STATEMENT level trigger. The select-trigger will not be called for every record that is either evaluated or returned by the query. Fortunately! We create our SELECT trigger in two steps. First we create the Handler – a PL/SQL procedure – that will process the Select Events that we want to be triggered on, then we can define a Fine Grained Auditing Policy that is associated with our Handler. (tags: oracle audit programming pl/sql) [...]