审计功能这时候数据库是mount状态SQLgt; alter system set audit_file_dest=

审计功能
这时候数据库是mount状态
SQL> alter system set audit_file_dest='/u01/gdrz/' scope=spfile;
（设置审计保存的目录）
System altered.
SQL> alter system set audit_trail=db,extended scope=spfile;
System altered.
[Oracle@bw ~]$ sqlplus / as sysdba
SQL*Plus: Release 10.2.0.1.0 - Production on Sat Apr 23 17:01:42 2011
Copyright (c) 1982, 2005, Oracle. All rights reserved.
Connected to:
Oracle Database 10gEnterprise Edition Release 10.2.0.1.0 - Production
With the Partitioning, OLAP and Data Mining options
SQL> select username from dba_users; （删除用户drop user xx cascade；）
USERNAME
------------------------------
OUTLN
SYS
SYSTEM
BBWW
DBSNMP
TSMSYS
DIP
7 rows selected.
SQL> create user bb identified by oracle; （oracle指密码）
User created.
SQL> create user ww identified by oracle;
User created.
SQL> grant connect,resource to bb; （给权限）
Grant succeeded.
SQL> grant connect,resource to ww;
Grant succeeded.
SQL> conn bb/oracle
Connected.
SQL> select * from tab;
no rows selected
SQL> create table ctc ( name varchar2(10));
Table created.
SQL> select * from ctc;
no rows selected
SQL> insert into ctc values ('hangzhou');
1 row created.
SQL> commit; （提交数据）
Commit complete.
SQL> select * from ctc;
NAME
----------
hangzhou
SQL> show user;
USER is "BB"
SQL> grant select on ctc to ww;
Grant succeeded.
SQL> conn ww/oracle
Connected.
SQL> select * from bb.ctc;
NAME
----------
hangzhou
SQL> conn / as sysdba
Connected.
SQL> show parameter audit
NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
audit_file_dest string /u01/bwaudit
audit_sys_operations boolean FALSE
audit_syslog_level string
audit_trail string DB, EXTENDED
SQL> audit select on bb.ctc;
Audit succeeded.
SQL> conn ww/oracle
Connected.
SQL> select * from bb.ctc;
NAME
----------
hangzhou
SQL> conn / as sysdba
Connected.
SQL> select username,sql_text from dba_audit_trail;
USERNAME
------------------------------
SQL_TEXT
--------------------------------------------------------------------------------
WW
select * from bb.ctc （审计产生的结果）