故障现象：用户反馈无法登录，WEBLOGIC日志显示ERROR 2010-08-17 23:05:36,889 JDBCExceptionReporter:logExceptions - ORA-01653: unable to extend table SYS.FGA_LOG$ by 8192 in tablespace SYSTEM

推理：从ORA-01653: unable to extend table SYS.FGA_LOG$ by 8192 in tablespace SYSTEM分析，可能是SYSTEM表空间的问题，通过OEM查看发现SYSTEM表空间确实已经满。但是应用方反馈没有对SYSTEM相关的操作。

继续分析：由于用户反馈昨天18：00开始进行应用加压测试，但24点应用出错，后台提示

ORA-01653错误。为了精确定位，采用OEM的ADDM采集了18：00-24：00的信息，从报告中发现如下语句占据了50%左右的开销。

insert into sys.fga_log$ (sessionid, ntimestamp#, dbuid, osuid, obj$schema, obj$name, policyname, scn, oshst, clientid, extid, lsqltext, proxy$sid,user$guid, instance#, process#, xid, statement, entryid, stmt_type, lsqlbind, auditid) values( :1, SYS_EXTRACT_UTC(SYSTIMESTAMP), :2, :3, :4, :5, :6, :7, :8, :9, :10, :11, :12, :13, :14, :15, :16, :17, :18, :19, :20, :21 )

很显然，从sys.fga_log$可以看出以上是一个细粒度审计。

向应用方提出，但是应用方反馈未加审计策略。只好出手找证据。

------------------------------------------------------------------------------------------

SETP1：通过select * from DBA_AUDIT_POLICIES;找出审计事项：

SQL> select * from DBA_AUDIT_POLICIES;

OBJECT_SCHEMA                  OBJECT_NAME                    POLICY_NAME                    POLICY_TEXT                                                                      POLICY_COLUMN                  PF_SCHEMA                      PF_PACKAGE                     PF_FUNCTION                    ENABLED SEL INS UPD DEL AUDIT_TRAIL  POLICY_COLUMN_OPTIONS

------------------------------ ------------------------------ ------------------------------ -------------------------------------------------------------------------------- ------------------------------ ------------------------------ ------------------------------ ------------------------------ ------- --- --- --- --- ------------ ---------------------

OPERATION                      SK_SSO_GRANTING_TICKET         FGA_SK_SSO_GRANTING_TICKET                                                                                                                                                                                                                  YES     YES YES YES YES DB+EXTENDED  ANY_COLUMNS

再通过sys.fga_log$来看审计内容，很显然对表更新做了审计。

SQL> SELECT dbuid, lsqltext FROM sys.fga_log$;

DBUID                          LSQLTEXT

------------------------------ --------

OPERATION                      insert i

OPERATION                      update S

OPERATION                      select s

OPERATION                      insert i

计算下条数165万条。

SQL> select count(*) from sys.fga_log$;

COUNT(*)

----------

1650749

此时把审计对象反馈给应用，一轮闻讯下来总算有人”坦白”了。

----------------------------------------------------------------------------------

SETP2：执行execute dbms_fga.drop_policy去除审计

SQL> execute dbms_fga.drop_policy(object_schema=>'OPERATION',object_name=>'SK_SSO_GRANTING_TICKET',policy_name=>'FGA_SK_SSO_GRANTING_TICKET');

PL/SQL procedure successfully completed

----------------------------------------------------------------------------------

SETP3：重复SETP1发现审计消失

SQL> select * from DBA_AUDIT_POLICIES;

OBJECT_SCHEMA                  OBJECT_NAME                    POLICY_NAME                    POLICY_TEXT                                                                      POLICY_COLUMN                  PF_SCHEMA                      PF_PACKAGE                     PF_FUNCTION                    ENABLED SEL INS UPD DEL AUDIT_TRAIL  POLICY_COLUMN_OPTIONS

------------------------------ ------------------------------ ------------------------------ -------------------------------------------------------------------------------- ------------------------------ ------------------------------ ------------------------------ ------------------------------ ------- --- --- --- --- ------------ ---------------------

SQL>

删除现有审计数据：

SQL> truncate table Sys.fga_log$;

Table truncated