Oracle 23c 03
Oracle 23c 03
MikeDietrich
@MikeDietrichDE
https://MikeDietrichDE.com
Klaus Gronau
William
Beauregard . Mike Dietrich
Rodrigo Jorge
Subscribe
2010
2011
2012
2013
2014
2015
2016
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
MARKET
Oracle 11.2 WAIVED EXTENDED EXTENDED DRIVEN
MARKE
Oracle 12.1 EXTENDED T
DRIVEN
LIMITE
Oracle 12.2.0.1 D
Oracle 18
(12.2.0.2)
Oracle 19 EXTENDED
(12.2.0.3)
Oracle 21
Premier Support Waived Extended Support Paid Extended Support Market Driven Support Limited Error Correction
2017
2018
2019
2020
2021
2022
2023
2024
2025
2026
2027
2028
2029
2030
2031
2032
MARKET
11.2.0.4 DRIVEN
12.1.0.2 MDS
12.2.0.1
18c
Oracle 19
(12.2.0.3) EXTENDED
Oracle 21
EXTENDED
Oracle Database 23c Support
Innovation
Innovation
9 Copyright © 2023, Oracle and/or its affiliates Long Term Support Extended
Move production databases from one
1 2 3
Install Oracle Home Download and deploy Collect performance
including RU and MRP the most recent information from
AutoUpgrade current source and
MOS Note: 2118136.2 test thoroughly
MOS Note: 555.1 MOS Note: 2485457.1
MOS Note: 2781612.2
Auditing
Photo by Ian Stauffer on Unsplash
An Overview
1992
Traditional 2013
Auditing Unified
Oracle 6 Auditing
Mixed Mode
Oracle 12c
2023
2002 Unified Auditing
Fine Grained Pure Mode
Auditing Oracle 23c
Oracle 9i
21
Copyright © 2023, Oracle and/or its affiliates
Photo by
Photo by Arno Senoner
Bermix Studio Unsplash
onon Unsplash
Traditional Auditing
Initialization parameters
• AUDIT_TRAIL
• Enabled by default since Oracle Database 11g via DBCA
• Adjustment requires restart of the database
• Defines where and how audit information gets stored
• AUDIT_TRAIL=DB uses SYSTEM.AUD$ in SYSTEM tablespace
• Growth of system tablespace
• Undefined situation for moving AUD$ into another tablespace
• Database halts when audit records can't be written anymore
• Changing the parameter requires database restart
• AUDIT_SYS_OPERATIONS
• AUDIT_FILE_DEST
• AUDIT_SYSLOG_LEVEL
• SYS.AUD$
database audit trail
• SYS.FGA_LOG$
fine-grained auditing
• DVSYS.AUDIT_TRAIL$
Database Vault, Oracle Label Security
AUDIT_TRAIL=DB
AUDIT_TRAIL=DB
AUDIT_TRAIL=DB
AUDIT_TRAIL=DB
AUDIT_TRAIL=DB
AUDIT_TRAIL=DB
AUDIT_TRAIL=DB
Initialization parameters
• AUDIT_TRAIL
• With the upgrade to Oracle Database 12c or higher, AUD$ has to be moved from SYSTEM to SYS
• AutoUpgrade does this for you automatically
• olspreupgrade.sql allows manual migration pre-upgrade
• AUDIT_SYS_OPERATIONS
• AUDIT_FILE_DEST
• AUDIT_SYSLOG_LEVEL
• Fixup is available
• AutoUpgrade will handle this migration automatically
Initialization parameters
• AUDIT_TRAIL
• AUDIT_SYS_OPERATIONS
• Audit operations of SYSDBA and SYSOPER
• AUDIT_FILE_DEST
• AUDIT_SYSLOG_LEVEL
• Write into the OS' SYSLOG
AUDIT_TRAIL=OS
UPGR_ora_24088_20230510231115067867143795.aud
Examples
• AUDIT ALL ON tab1
• AUDIT table WHENEVER SUCCESSFUL
• DML and DDL
• AUDIT update table BY user1, user2
• AUDIT session
• AUDIT alter system
DBA_AUDIT_TRAIL
• All entries from AUD$
DBA_OBJ_AUDIT_OPTS
• All audit options activated for certain objects
DBA_PRIV_AUDIT_OPTS
• All system privileges being audited
Examples
• exec DBMS_FGA.ADD_POLICY(
object_name => 'tabname',
policy_name => 'community_policy',
audit_condition => 'sensitive_column > 100',
statement_types => 'select');
Typical issues
• Contention
• Login storms
• Excessive growth
• Technology from the past
• Security flaws
• Audit record protection possible only with DV
by Arno
Photo by
Photo Senoner
Bermix onon
Studio Unsplash
Unsplash
• Who? AUDSYS
• Where? SYSAUX
• Where exactly (from 12.2 onward)? AUD$UNIFIED
SQL> SELECT PARAMETER, VALUE FROM V$OPTION WHERE PARAMETER = 'Unified Auditing';
PARAMETER VALUE
___________________ ________
Unified Auditing FALSE
COUNT(*)
___________
8475
BEGIN
DBMS_AUDIT_MGMT.SET_LAST_ARCHIVE_TIMESTAMP(
AUDIT_TRAIL_TYPE => DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED,
LAST_ARCHIVE_TIME => '11-MAY-2023 06:30:00.00',
RAC_INSTANCE_NUMBER => 1,
CONTAINER => DBMS_AUDIT_MGMT.CONTAINER_CURRENT);
END;
/
BEGIN
DBMS_AUDIT_MGMT.CLEAN_AUDIT_TRAIL(
AUDIT_TRAIL_TYPE => DBMS_AUDIT_MGMT.AUDIT_TRAIL_UNIFIED,
USE_LAST_ARCH_TIMESTAMP => TRUE,
CONTAINER => DBMS_AUDIT_MGMT.CONTAINER_CURRENT );
END;
/
$ cd $ORACLE_HOME/rdbms/lib
$ make -f ins_rdbms.mk uniaud_on ioracle
SQL> SELECT PARAMETER, VALUE FROM V$OPTION WHERE PARAMETER = 'Unified Auditing';
PARAMETER VALUE
___________________ ________
Unified Auditing TRUE
• AUDIT_TRAIL
• AUDIT_SYS_OPERATIONS
• AUDIT_FILE_DEST
• AUDIT_SYSLOG_LEVEL
• BEGIN
DBMS_AUDIT_MGMT.SET_AUDIT_TRAIL_LOCATION(
audit_trail_type => dbms_audit_mgmt.audit_trail_unified,
audit_trail_location_value => 'TBS_AUDIT_DATA');
END;
/
POLICY_NAME
__________________________
ORA_ACCOUNT_MGMT
ORA_CIS_RECOMMENDATIONS
ORA_DATABASE_PARAMETER
ORA_LOGON_FAILURES
ORA_RAS_POLICY_MGMT
ORA_RAS_SESSION_MGMT
ORA_SECURECONFIG
10
8 8.5
6.8
6 5.8
5.1 5.2
4
2
0
0.3K 3K 6K 12K 30K
SQL> SELECT PARAMETER, VALUE FROM V$OPTION WHERE PARAMETER = 'Unified Auditing';
PARAMETER VALUE
___________________ ________
Unified Auditing TRUE
Goal
• Don't introduce interruptions for customers still using Traditional Auditing
• Encourage customers to move to the far better and more secure Unified
Auditing
Implementation
• Traditional Auditing can be still used
• No new TA policies can be created
• Existing TA policies can't be updated
• Can be enforced with an underscore parameter
• Migration procedure for TA policies
• Unified Auditing can't be linked off anymore
• UA_CreatePolicy.sql
• Generates CREATE AUDIT POLICY statements to create unified audit policies
• UA_EnablePolicy.sql
• Generates AUDIT POLICY statements to enable unified audit policies, based on current traditional audit configuration
• UA_DisablePolicy.sql
• Generates NOAUDIT POLICY statements to disable those unified audit policies
• UA_DropPolicy.sql
• Use this script to drop the unified audit policies, in case you no longer require them.
• UA_ConvertPolicySummary.txt
• Summary of created unified audit policies. Lists also incomplete creations.
Documentation
Upgrade:
• You must be on the CDB architecture
• If you upgrade "everything at once", it stays as is
Migration:
• You migrate a non-CDB to a PDB
• Be aware of the audit parameters in your freshly created CDB
65 Copyright © 2023, Oracle and/or its affiliates
Photo by Wil Stewart on Unsplash
66 Copyright © 2023, Oracle and/or its affiliates
Recorded Web Seminars
https://MikeDietrichDE.com/video
s
• 300+ videos
• No marketing
• No buzzword
• All tech
Link
https://MikeDietrichDE.com
https://DOHdatabase.com
https://www.dbarj.com.br/en
Webinars:
https://MikeDietrichDE.com/videos
YouTube channel:
OracleDatabaseUpgradesandMigrations