在诊断Oracle数据库问题时，Oracle支持服务人员可能会指示您执行某些诊断操作。有些诊断操作是无害的。但是，如果不正确地执行其他操作，可能会产生不利影响。为了控制和监控执行此类诊断操作的人员，Oracle Database20引入了诊断控制的安全控制措施。
这一改进是通过参数DIAGNOSTICS CONTROL来引入的
IGNORE:当未经授权的用户尝试执行潜在的不安全诊断操作时，尝试成功，不会出现错误信息或警告。
ERROR: 当未经授权的用户尝试执行一个潜在的不安全的诊断操作时，该尝试以错误ORA-01031: 权限不足而失败。
WARNING:当未经授权的用户尝试执行潜在的不安全诊断操作时，尝试成功，但警告被写入警告日志。
DIAGNOSTICS_CONTROL enables you to control and monitor the users who perform potentially unsafe database diagnostic operations.
When diagnosing Oracle database issues, an Oracle Support Service staff member might instruct you to perform diagnostic operations. Some diagnostic operations are harmless. However, others could have adverse effects if not performed properly with the guidance of an Oracle Support Service staff member. In order to control and monitor who performs such diagnostic operations, Oracle Database 20 introduces the following security controls:
• Potentially unsafe diagnostic operations are internally identified in the database. These operations include setting certain debug events and debug actions with the ALTER SESSION or ALTER SYSTEM statement. For example:
ALTER SESSION SET EVENTS ‘1357 trace name context forever, level 2’;
ALTER SYSTEM SET EVENTS ‘trace[vos]’;
A user can be authorized to perform potentially unsafe diagnostic operations, either by being granted the ENABLE DIAGNOSTICS system privilege, or by being granted the DBA role, or by authenticating as SYSDBA.
The DIAGNOSTICS_CONTROL initialization parameter enables you to specify how the database responds when an unauthorized user attempts to perform these diagnostic operations. The possible values are:
– ERROR: When an unauthorized user attempts to perform a potentially unsafe diagnostic operation, the attempt fails with error ORA-01031: insufficient privileges.
– WARNING: When an unauthorized user attempts to perform a potentially unsafe diagnostic operation, the attempt succeeds, but a warning is written to the alert log.
– IGNORE: When an unauthorized user attempts to perform a potentially unsafediagnostic operation, the attempt succeeds and no error messages or warnings occur.This is the default.
Note:
When altering the DIAGNOSTICS_CONTROL initialization parameter, be aware of the following guidelines:
• To modify this parameter with the ALTER SYSTEM command, you must be
authenticated AS SYSDBA.
• In Oracle RAC environments, it is currently not possible to modify this parameter on remote instances by specifying the SID clause in the ALTER SYSTEM SET statement.
