Connecting Tech Pros Worldwide Help | Site Map

Auditing with an Oracle back end?

Member
 
Join Date: Aug 2007
Posts: 39
#1: Jul 6 '09
Hello,

I have a .net web app with an Oracle back end and I need to audit my database. I created this template trigger that I was using on inserts, edit & deletes however...

Expand|Select|Wrap|Line Numbers
  1. "CREATE OR REPLACE TRIGGER {0}.BIUD_{3} 
  2.   BEFORE INSERT OR UPDATE OR DELETE ON {0}.{2} 
  3.   REFERENCING OLD AS OLD NEW AS NEW 
  4.   FOR EACH ROW 
  5. BEGIN 
  6.   IF inserting THEN 
  7.     SELECT {0}.{1}.nextval 
  8.     INTO   :NEW.{4} 
  9.     FROM   dual; 
  10.  
  11.     INSERT INTO {0}.{5} 
  12.                ({4}{6}, 
  13.                 auditaction, 
  14.                 audituser, 
  15.                 auditdate) 
  16.     VALUES     (:NEW.{4}{7}, 
  17.                 'INSERT', 
  18.                 substr(sys_context('userenv','os_user'), INSTR(sys_context('userenv','os_user'),'\')+1), 
  19.                 SYSDATE); 
  20.   END IF; 
  21.  
  22.   IF updating THEN 
  23.     INSERT INTO {0}.{5} 
  24.                ({4}{6}, 
  25.                 auditaction, 
  26.                 audituser, 
  27.                 auditdate)
  28.     VALUES     (:OLD.{4}{7}, 
  29.                 'UPDATE', 
  30.                 substr(sys_context('userenv','os_user'), INSTR(sys_context('userenv','os_user'),'\')+1), 
  31.                 SYSDATE); 
  32.   END IF; 
  33.  
  34.   IF deleting THEN 
  35.     INSERT INTO {0}.{5} 
  36.                ({4}{6}, 
  37.                 auditaction, 
  38.                 audituser, 
  39.                 auditdate) 
  40.     VALUES     (:OLD.{4}{8},
  41.                 'DELETE', 
  42.                 substr(sys_context('userenv','os_user'), INSTR(sys_context('userenv','os_user'),'\')+1), 
  43.                 SYSDATE); 
  44.   END IF; 
  45. END;
  46. /"
  47.  
I only get the username if I use impersonation and I restrict the web app to a user group (no anonymous login).
I have 1 oracle question and 1 .Net question.
Is it possible to get the correct username in Oracle without using impersonation?
If not, is there anyway I can configure .net so I don't have to use impersonation to send the user name?
If not I'm going to have to do my auditing at the application level, boooo.
Member
 
Join Date: Aug 2007
Posts: 39
#2: Jul 8 '09

re: Auditing with an Oracle back end?


OK, to solve this I added ModifiedBy and IsDeleted Columns to all my tables.
In my DAL I set it up so that ModifiedBy is automatically set to the user I want.
I also changed my DAL to implement soft deletes and then my DAL automatically performs a hard delete after every soft delete. A soft delete is merely an update where the IsDeleted field is set to 1.
In my trigger I changed the audit username value to the modifiedby field that my dal passes. For deletes, I do the auditing on the soft delete that my DAL performs as that is the only opportunity to capture the user name.

This is a screwy fix to this problem, but it is a fix none the less.
Reply


Similar ASP.NET bytes