Oracle DDL Auditing

Auditing Database Changes with DDL

Oracle provides DDL triggers to audit all schema changes and can report the exact change, when it was made and by which user.  There are several ways to audit within Oracle, and it is important to take DDL auditing needs into consideration when designing the Oracle system to include auditing.

For 11g and beyond, see the DDL logging feature.

For Oracle, the following auditing tools are provided:

• SQL audit command (for DML)

• Auditing with object triggers (DML auditing)

• Auditing with system-level triggers (DML and DDL)

• Auditing with LogMiner (DML and DDL)

• Fine-grained auditing (select auditing)

Oracle System Event Trigger Auditing with DDL Triggers

Using the System Event DDL trigger, the Oracle DBA can automatically track all changes to the database including changes to tables, indexes, and constraints. The data from this trigger is especially useful for change control and auditing changes to the production environment.  This is especially important for Oracle databases that are certified by government agencies.

When Oracle first provided the functionality for these DDL triggers, it was not clear how they could be used in order to track system-wide usage. Initially, the implementation of system level triggers for end-user tracking was so new, curious Oracle shops tried it and found it a bit lacking in robust functionality.

Auditing with User Log on/off Triggers

The user log on/log off triggers was a great example of the limits on functionality.  While the user log on/off trigger will accurately capture the time of the user log on and user log off, it does not capture any additional information regarding the specific tasks that were performed during the user's session. In the event that users are not issued their own unique Oracle User ID, this DLL trigger may not be particularly useful as Oracle cannot then timestamp each individual users. 

From Oracle guru and Rampant TechPress author, Laurent Schneider, we get the answer to the following questions: 

1. Is there any alternative DDL scripting for DDL auditing?

2. What is the time offset for the current time in Unix?

Using enable_ddl_logging as a DDL Log Auditing Alternative

Laurent Schneider adds this regarding a new and cool alternative offered in Oracle 11g.  This option involves the use of enable_ddl_logging.

Setting enable_ddl_logging will allow the tracking of all ddl's in the alert log using the following:

 ALTER SYSTEM SET enable_ddl_logging=TRUE

Later, you issue create table:

 t(x number)

and you see in the alertLSC01.log:

 Tue Apr 05 14:43:32 2015
create table t(x number)

Wait, that's not really verbose !?

Remember the alert log is just there for backward compatibility, it is time you start looking in the xml file:

<msg time='2011-04-05T14:43:42.210+02:00' org_id='oracle' comp_id='rdbms'
  msg_id='opiexe:3937:4222333111' client_id='' type='NOTIFICATION'group='schema_ddl'
  level='16' host_id='srv01' host_addr='192.168.0.141' module='TOAD Beta 11.0.0.52'
  pid='2777799'>
  <txt>create table t(x number)
  </txt>
</msg>

There is not really much more there but the module, which indeed reveals someone is using TOAD to access my database !

Unfortunately for many shops, enable_ddl_logging is an additional cost feature available only to Enterprise Edition users.

Oracle Training from Don Burleson  The best on site "Oracle training classes" are just a phone call away! You can get personalized Oracle training by Donald Burleson, right at your shop!

Burleson is the American Team Note: This Oracle documentation was created as a support and Oracle training reference for use by our DBA performance tuning consulting professionals.  Feel free to ask questions on our Oracle forum. Verify experience! Anyone considering using the services of an Oracle support expert should independently investigate their credentials and experience, and not rely on advertisements and self-proclaimed expertise. All legitimate Oracle experts publish their Oracle qualifications. Errata?  Oracle technology is changing and we strive to update our BC Oracle support information.  If you find an error or have a suggestion for improving our content, we would appreciate your feedback.  Just  e-mail:   and include the URL for the page.                      Burleson Consulting The Oracle of Database Support Oracle Performance Tuning Remote DBA Services   Copyright © 1996 -  2020 All rights reserved by Burleson Oracle ® is the registered trademark of Oracle Corporation.