DG0029-ORACLE11 - Required auditing parameters for database auditing should be set - 'audit_trail != none'

Information

Oracle auditing can be set to log audit data to the database or operating system files. Logging events to the database prevents operating system users from viewing the data, while logging events to operating system files prevents malicious database users from accessing the data. The value NONE disables auditing and is, therefore, not in compliance with policy.

Solution

Enable database auditing.

Select the desired audit trail format (external file or internal database table).

From SQL*Plus:
alter system set audit_trail= [audit trail format] scope=spfile;

Compliant selections for [audit trail format] are (per MetaLink Note 30690.1):

Oracle 11.1 - 11.2 = 'true', 'os' & 'db' (true = os for backward compatibility)
Oracle 11.1 - 11.2 = 'db_extended', 'xml' & 'xml, extended'

The above SQL*Plus command will set the parameter to take effect at next system startup.

See Also

https://dl.dod.cyber.mil/wp-content/uploads/stigs/zip/U_Oracle_Database_11g_Y21M10_STIG.zip

Item Details

Category: AUDIT AND ACCOUNTABILITY

References: 800-53|AU-12c., CAT|II, Rule-ID|SV-24615r2_rule, STIG-ID|DG0029-ORACLE11, Vuln-ID|V-5685

Plugin: OracleDB

Control ID: 485c80698425bbf47aefe5f641b338f338186d3e01eeea8ea14e2b6c44fd27d6