Summary of DBMS_FGA Subprograms

Table 16-1 Summary of DBMS_FGA Subprograms

Subprogram	Description
ADD_POLICY Procedure	Creates an audit policy using the supplied predicate as the audit condition
DROP_POLICY Procedure	Drops an audit policy
ENABLE_POLICY Procedure	Enables an audit policy
DISABLE_POLICY Procedure	Disables an audit policy

ADD_POLICY Procedure

This procedure creates an audit policy using the supplied predicate as the audit condition.

Syntax

DBMS_FGA.ADD_POLICY(
   object_schema   VARCHAR2, 
   object_name     VARCHAR2, 
   policy_name     VARCHAR2, 
   audit_condition VARCHAR2, 
   audit_column    VARCHAR2, 
   handler_schema  VARCHAR2, 
   handler_module  VARCHAR2,  
   enable          BOOLEAN  );

Parameters

Table 16-2 ADD_POLICY Procedure Parameters

Parameter	Description
object_schema	The schema of the object to be audited
object_name	The name of the object to be audited
policy_name	The unique name of the policy
audit_condition	A condition in a row that indicates a monitoring condition
audit_column	The column to be checked for access. The default is all columns.
handler_schema	The schema that contains the event handler. The default is the current schema.
handler_module	The function name of the event handler; includes the package name if necessary. This is fired only after the first row that matches the audit condition is processed in the query. If the procedure fails with exception, the user SQL statement will fail as well. The default is NULL.
enable	Enables the policy if TRUE, which is the default.

Usage Notes

• An event record will always be inserted into fga_log$ when the monitored condition becomes TRUE.
• The audit function must have the following interface:
  PROCEDURE <fname> ( object_schema VARCHAR2, object_name VARCHAR2, policy_name VARCHAR2 ) AS ...
where fname is the name of the procedure, schema is the schema of the table audited, table is the table audited, and policy is the policy being enforced.
• The audit function is executed as an autonomous transaction.
• Each audit policy is applied to the query individually. That is, as long as the rows being returned fit into any of the audit condition defined on the table, an audit record will be generated, and there will be at most one record generated for each policy.

DROP_POLICY Procedure

This procedure drops an audit policy.

Syntax

DBMS_FGA.DROP_POLICY(
   object_schema  VARCHAR2, 
   object_name    VARCHAR2, 
   policy_name    VARCHAR2 );

Parameters

Table 16-3 DROP_POLICY Procedure Parameters

Parameter	Description
object_schema	The schema of the object to be audited
object_name	The name of the object to be audited
policy_name	The unique name of the policy

Usage Notes

The DBMS_FGA procedures cause current DML transactions, if any, to commit before the operation. However, the procedures do not cause a commit first if they are inside a DDL event trigger. With DDL transactions, the DBMS_FGA procedures are part of the DDL transaction.

ENABLE_POLICY Procedure

This procedure enables an audit policy.

Syntax

DBMS_FGA.ENABLE_POLICY(
   object_schema  VARCHAR2 := NULL,
   object_name    VARCHAR2,
   policy_name    VARCHAR2,
   enable         BOOLEAN := TRUE);

Parameters

Table 16-4 ENABLE_POLICY Procedure Parameters

Parameter	Description
object_schema	The schema of the object to be audited
object_name	The name of the object to be audited
policy_name	The unique name of the policy
enable	Defaults to TRUE to enable the policy

DISABLE_POLICY Procedure

This procedure disables an audit policy.

Syntax

DBMS_FGA.DISABLE_POLICY(
   object_schema  VARCHAR2, 
   object_name    VARCHAR2, 
   policy_name    VARCHAR2 ); 

Parameters

Table 16-5 DISABLE_POLICY Procedure Parameters

Parameter	Description
object_schema	The schema of the object to be audited
object_name	The name of the object to be audited
policy_name	The unique name of the policy