审计遇到ORA-32595

环境:
DB:11.2.0.1

本想对ddl做审计,执行如下语句报错误
SQL> connect system/oracle@mydb
已连接。
SQL> AUDIT Drop ANY TABLE BY scott BY Session WHENEVER Successful;
AUDIT Drop ANY TABLE BY scott BY Session WHENEVER Successful
                                 *
第 1 行出现错误:
ORA-32595: 不能使用指定的 BY SESSION 对 DDL 语句进行审计

该错误的描述如下:
ORA-32595: DDL statement cannot be audited with BY SESSION specified Cause: An attempt was made to audit a DDL statement with BY SESSION clause specified. DDL statements can be audited BY ACCESS only.
Action: Specify BY ACCESS instead of BY SESSION to audit the DDL statement.

将语句修改如下问题解决

SQL> AUDIT Drop ANY TABLE BY scott BY ACCESS  WHENEVER Successful;

审计已成功。


有关by session和by access官网的解释如下:
BY SESSION
In earlier releases, BY SESSION caused the database to write a single record for all SQL statements or operations of the same type executed on the same schema objects in the same session. Beginning with this release of Oracle Database, both BY SESSION and BY ACCESS cause Oracle Database to write one audit record for each audited statement and operation. BY SESSION continues to populate different values to the audit trail compared with BY ACCESS. Oracle recommends that you include the BY ACCESS clause for all AUDIT statements, which results in a more detailed audit record. If you specify neither clause, then BY SESSION is the default.

Note:

This change applies only to schema object audit options, statement options and system privileges that audit SQL statements other than data definition language (DDL) statements. The database has always audited BY ACCESS all SQL statements and system privileges that audit a DDL statement.

BY ACCESS
Specify BY ACCESS if you want Oracle Database to write one record for each audited statement and operation.

-- The End --