如果不对 Oracle ASM 实例的审计文件目录进行定期维护那么它将会包含大量的审计文件。如果存在大理审计文件可能会造成文件系统耗尽磁盘空间或 indoes，或者由于文件系统扩展限制而造成 Oracle 运行缓慢，还有可能造成Oracle ASM 实例在启动时 hang 住。
使用 Linux syslog 工具来管理 Oracle ASM 审计记录是一个很好的解决方案，通过使用操作系统的 syslog 工具来代替单独的 audit_dump_dest 目录来记录 Oracle ASM 审计记录。
1、对Oracle ASM实例设置audit_syslog_level与audit_sys_operations参数SQL>show parameter audit_sys_
---------------------------- -------------- ------------
audit_sys_operations boolean TRUE
audit_syslog_level string
SQL> alter system set AUDIT_SYSLOG_LEVEL='local0.info' scope=spfile sid='*';
System altered.
SQL>
由于 audit_sys_operations 参数默认为 TRUE，所以此处不再进行设置
2、为 Oracle ASM 审计配置 /etc/syslog.conf 通过执行以下两处改变来对 Oracle ASM 审计配置 syslog 的配置文件 /etc/rsyslog.conf
a.在 /etc/rsyslog.conf 文件中增加以下内容
local0.info /var/log/oracle_asm_audit.log
b.在 /etc/rsyslog.conf 文件中的 /var/log/messages 这一行增加 local0.none，修改后的配置如下:
[root@cs1 ~]# vi /etc/rsyslog.conf
....省略....
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
local0.info /var/log/oracle_asm_audit.log
*.info;mail.none;authpriv.none;cron.none;local0.none /var/log/messages
3、配置logrotate来管理syslog日志文件Linux的logrotate工具被用来管理Oracle ASM审计的syslog日志文件的大小与数量，创建文件 /etc/logrotate.d/oracle_asm_audit，并向文件增加以下内容：
weekly
rotate 4
compress
copytruncate
delaycompress
notifempty
}
4、重启 Oracle ASM 实例与 rsyslog 服务
a.为了使用这些改变生效必须重启 Oracle ASM 实例与 rsyslog 服务。可以使用 crsctl stop cluster -all 与 crsctl start cluster -all 在任何一个 RAC 节点上执行来重启 Oracle ASM 实例，这个操作会将数据库实例也关闭。
b.执行 systemctl restart rsyslog 命令来重启rsyslog服务
验证
验证日志输出可以看到Oracle ASM审计记录已经被记录到了/var/log/oracle_asm_audit.log 文件中。
May 9 07:02:33 node1 journal: Oracle Audit[1510]: LENGTH : '241' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[4] 'grid' CLIENT TERMINAL:[5] 'pts/0' STATUS:[1] '0' DBID:[0] '' SESSIONID:[10] '4294967295' USERHOST:[5] 'node1' CLIENT ADDRESS:[0] '' ACTION NUMBER:[3] '100'
May 9 07:02:35 node1 journal: Oracle Audit[1561]: LENGTH : '241' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[4] 'grid' CLIENT TERMINAL:[5] 'pts/0' STATUS:[1] '0' DBID:[0] '' SESSIONID:[10] '4294967295' USERHOST:[5] 'node1' CLIENT ADDRESS:[0] '' ACTION NUMBER:[3] '100'
May 9 07:02:35 node1 journal: Oracle Audit[1580]: LENGTH : '241' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[4] 'grid' CLIENT TERMINAL:[5] 'pts/0' STATUS:[1] '0' DBID:[0] '' SESSIONID:[10] '4294967295' USERHOST:[5] 'node1' CLIENT ADDRESS:[0] '' ACTION NUMBER:[3] '100'
May 9 07:02:35 node1 journal: Oracle Audit[1586]: LENGTH : '241' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[4] 'grid' CLIENT TERMINAL:[5] 'pts/0' STATUS:[1] '0' DBID:[0] '' SESSIONID:[10] '4294967295' USERHOST:[5] 'node1' CLIENT ADDRESS:[0] '' ACTION NUMBER:[3] '100'
May 9 07:02:37 node1 journal: Oracle Audit[1645]: LENGTH : '241' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[4] 'grid' CLIENT TERMINAL:[5] 'pts/0' STATUS:[1] '0' DBID:[0] '' SESSIONID:[10] '4294967295' USERHOST:[5] 'node1' CLIENT ADDRESS:[0] '' ACTION NUMBER:[3] '100'
May 9 07:02:38 node1 journal: Oracle Audit[1649]: LENGTH : '241' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[4] 'grid' CLIENT TERMINAL:[5] 'pts/0' STATUS:[1] '0' DBID:[0] '' SESSIONID:[10] '4294967295' USERHOST:[5] 'node1' CLIENT ADDRESS:[0] '' ACTION NUMBER:[3] '100'
May 9 07:02:47 node1 journal: Oracle Audit[1993]: LENGTH : '241' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSASM' CLIENT USER:[4] 'grid' CLIENT TERMINAL:[5] 'pts/0' STATUS:[1] '0' DBID:[0] '' SESSIONID:[10] '4294967295' USERHOST:[5] 'node1' CLIENT ADDRESS:[0] '' ACTION NUMBER:[3] '100'
May 9 07:02:48 node1 journal: Oracle Audit[2035]: LENGTH : '241' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSASM' CLIENT USER:[4] 'grid' CLIENT TERMINAL:[5] 'pts/0' STATUS:[1] '0' DBID:[0] '' SESSIONID:[10] '4294967295' USERHOST:[5] 'node1' CLIENT ADDRESS:[0] '' ACTION NUMBER:[3] '100'
May 9 07:02:49 node1 journal: Oracle Audit[2042]: LENGTH : '241' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSASM' CLIENT USER:[4] 'grid' CLIENT TERMINAL:[5] 'pts/0' STATUS:[1] '0' DBID:[0] '' SESSIONID:[10] '4294967295' USERHOST:[5] 'node1' CLIENT ADDRESS:[0] '' ACTION NUMBER:[3] '100'
May 9 07:02:55 node1 journal: Oracle Audit[2477]: LENGTH : '241' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSASM' CLIENT USER:[4] 'grid' CLIENT TERMINAL:[5] 'pts/0' STATUS:[1] '0' DBID:[0] '' SESSIONID:[10] '4294967295' USERHOST:[5] 'node1' CLIENT ADDRESS:[0] '' ACTION NUMBER:[3] '100'
Speak Your Mind