How to Enable Unified Auditing in Oracle E-Business Suite 12.2

By -


Oracle EBS R12.2 Unified Auditing – Enable, Configure and Validate (Step-by-Step Guide)

Unified Auditing is Oracle Database’s consolidated auditing framework that combines standard auditing, fine-grained auditing (FGA), RMAN auditing, Data Pump auditing, and other audit mechanisms into a single unified audit trail (UNIFIED_AUDIT_TRAIL view).

In Oracle EBS R12.2, Unified Auditing is used to track sensitive object access, security object modifications, account management, login failures, and tablespace changes. It provides a centralized and secure auditing mechanism to simplify compliance and monitoring.

Prerequisites

Before proceeding, ensure that the Oracle E-Business Suite environment meets the minimum required AD and TXK code levels.

  • R12.AD.C.Delta.13 (Minimum)
  • R12.TXK.C.Delta.13 (Minimum)

Validate Current Auditing Status

SQL> SELECT VALUE
     FROM V$OPTION
     WHERE PARAMETER = 'Unified Auditing';

If the result is FALSE, Unified Auditing is not enabled.

Procedure to Enable Unified Auditing

Step 1: Stop EBS Services

$ adstpall.sh apps/<apps_password>

Step 2: Shutdown Database (All RAC Nodes)

$ sqlplus / as sysdba

SQL> shutdown immediate;

Step 3: Relink Oracle Binary (Enable Unified Audit)

$ cd $ORACLE_HOME/rdbms/lib

$ make -f ins_rdbms.mk uniaud_on ioracle ORACLE_HOME=$ORACLE_HOME

Step 4: Set audit_trail Parameter

$ sqlplus / as sysdba

SQL> startup nomount;
SQL> alter system set audit_trail=NONE scope=spfile;
SQL> shutdown immediate;
SQL> startup;

Step 5: Validate

SQL> SELECT VALUE
     FROM V$OPTION
     WHERE PARAMETER = 'Unified Auditing';

-- Should return TRUE

SQL> SHOW PARAMETER audit_trail;

-- Should return NONE

Step 6: Create Unified Audit User (CDB Level)

SQL> CREATE USER c##audit IDENTIFIED BY <password>;

SQL> GRANT CREATE SESSION TO c##audit CONTAINER=ALL;
SQL> GRANT AUDIT_ADMIN TO c##audit CONTAINER=ALL;
SQL> GRANT SELECT_CATALOG_ROLE TO c##audit CONTAINER=ALL;
SQL> GRANT CREATE PROCEDURE TO c##audit CONTAINER=ALL;
SQL> GRANT AUDIT SYSTEM TO c##audit CONTAINER=ALL;
SQL> GRANT AUDIT ANY TO c##audit CONTAINER=ALL;

SQL> GRANT SELECT ON SYS.audit_unified_contexts TO c##audit CONTAINER=ALL;
SQL> GRANT SELECT ON SYS.audit_unified_policies TO c##audit CONTAINER=ALL;
SQL> GRANT SELECT ON SYS.audit_unified_enabled_policies TO c##audit CONTAINER=ALL;

Step 7: Create Unified Audit User (PDB Level)

SQL> ALTER SESSION SET CONTAINER=<PDB_NAME>;

SQL> CREATE USER ebsuaad IDENTIFIED BY <password>;

SQL> GRANT CREATE SESSION TO ebsuaad;
SQL> GRANT AUDIT_ADMIN TO ebsuaad;
SQL> GRANT SELECT_CATALOG_ROLE TO ebsuaad;
SQL> GRANT CREATE PROCEDURE TO ebsuaad;
SQL> GRANT AUDIT SYSTEM TO ebsuaad;
SQL> GRANT AUDIT ANY TO ebsuaad;

SQL> GRANT SELECT ON SYS.audit_unified_contexts TO ebsuaad;
SQL> GRANT SELECT ON SYS.audit_unified_policies TO ebsuaad;
SQL> GRANT SELECT ON SYS.audit_unified_enabled_policies TO ebsuaad;

Step 8: Create EBS Unified Policies

$ cd $FND_TOP/patch/115/sql

$ sqlplus c##audit/<password>
SQL> @fnd_create_UA_policies.sql

$ sqlplus ebsuaad/<password>@<PDB_SERVICE>
SQL> @fnd_create_UA_policies.sql

Validate Enabled Policies

SQL> SHOW PDBS;

    CON_ID CON_NAME   OPEN MODE  RESTRICTED
---------- ---------- ---------- ----------
         3 ebsdb      READ WRITE NO

SQL> SELECT policy_name 
     FROM audit_unified_enabled_policies 
     ORDER BY policy_name;

POLICY_NAME
-----------------------------------------------------------------------------------------------------------------
EBS_ACTIONS_ON_SEC_OBJ
EBS_ACTIONS_ON_SENSITIVE_OBJ
EBS_AUDIT_DATAPUMP
EBS_OLS_POLICY_CHANGES
EBS_REDACTION_POLICY_CHANGES
EBS_TABLESPACE_CHANGES
EBS_VPD_POLICY_CHANGES
ORA_ACCOUNT_MGMT
ORA_DATABASE_PARAMETER
ORA_LOGON_FAILURES

10 rows selected.

The above output confirms that Unified Auditing is successfully enabled and the default EBS audit policies are active in the PDB.

Step 9: Start EBS Services

$ adstrtal.sh apps/<apps_password>

Procedure to Disable Unified Auditing

Relink Binary (Disable)

$ cd $ORACLE_HOME/rdbms/lib

$ make -f ins_rdbms.mk uniaud_off ioracle ORACLE_HOME=$ORACLE_HOME

Set Traditional Auditing

$ sqlplus / as sysdba

SQL> startup nomount;
SQL> alter system set audit_trail=DB scope=spfile;
SQL> shutdown immediate;
SQL> startup;

Validate

SQL> SELECT VALUE
     FROM V$OPTION
     WHERE PARAMETER = 'Unified Auditing';

SQL> SHOW PARAMETER audit_trail;

References

Oracle MOS Document ID 2777404.1 – Enabling Unified Auditing in Oracle E-Business Suite Release 12.2

Comments

Post a Comment

Popular posts from this blog

How to troubleshoot long running concurrent request in R12.2

By -
We frequently encounter issues with concurrent programs running long and concurrent requests not picking up jobs. These problems are often expected from the development and functional team we need to address this issue To solve this, we should take the following steps: Collect below basis level of information to development team 1 Oracle seeded program/Custom program? 2 How much time it used earlier? 3 Is there any recent code change done in concurrent program? 4 Is this program fetching higher data compare to last run? 5 Does this job running any specific time/ It can be run any time? 6 Does this job fetching data using DB link? 7 Does the problem happen on both the test and production instance?   Troubleshooting Steps for Concurrent Requests Check for Locks and Blocking sessions Identify if the request is running but blocked by database locks/Blocking sessions. Use DBA tools or queries to identify and release locks if necessary. Review Parameters and Data ...
Read more

How to find EBS URL in R12.2

By -
There are different way to find the EBS URL Method 1 Login the R12.2 application server Source the Env File [oracle@san ~]$ grep login $CONTEXT_FILE          <login_page oa_var="s_login_page">http://dev1.apps.com:8001/OA_HTML/AppsLogin</login_page> [oracle@san~]$ Method 2: Connect sqlplus apps user SQL> SELECT home_url  FROM icx_parameters; HOME_URL -------------------------------------------------------------------------------- http://<Hostname>:8007/OA_HTML/AppsLogin How to find Weblogic URL and PORT number: Login the R12.2 application server Source the Env File [oracle@sanprod ~]$ grep s_wls_adminport $CONTEXT_FILE          <wls_adminport oa_var="s_wls_adminport" oa_type="PORT" base="7001" step="1" range="-1" label="WLS Admin Server Port"> 7002 </wls_adminport> [oracle@sanprod ~]$ Weblogic Port Number:7002  Weblogic URL:http://<...
Read more

How to Grant Privileges in Oracle EBS R12.2 Using AD_ZD.GRANT_PRIVS

By -
When working with Oracle E-Business Suite (EBS) R12.2, granting privileges to applicatation objects requires special care to avoid invalidating objects in the current edition.  Grants cannot be performed in the run edition when the application is being used. A direct GRANT (DDL) command can potentially cause object invalidation when the application is actively being used. To handle this in a more controlled manner, Oracle introduced the AD_ZD.GRANT_PRIVS utility. Why Use AD_ZD.GRANT_PRIVS? In Oracle EBS R12.2, all grants should be performed using the AD_ZD.GRANT_PRIVS procedure rather than the traditional GRANT statement.  The reason is simple: the GRANT statement directly modifies objects in the database, and this can invalidate them in the current edition. Invalidations during runtime can cause service interruptions, which is unacceptable in a live system. Syntax for Granting and Revoking Privileges The AD_ZD package provides two p...
Read more