Search Results dbms_privilege_capture

Overview

SYS.DBMS_PRIVILEGE_CAPTURE is an Oracle database-supplied PL/SQL package that provides the infrastructure for privilege analysis — the mechanism by which the database records which system privileges, object privileges, and roles are actually exercised by a user, a role, or a set of sessions during a defined observation window. Rather than inferring required privileges from application design documentation, the package allows the DBA to observe real runtime behaviour and produce an evidence-based report of granted privileges that were never used.

In the Oracle E-Business Suite 12.1.1 and 12.2.2 context, this capability is chiefly relevant to security hardening and least-privilege remediation on the EBS database tier. EBS schemas — most notably APPS — traditionally hold very broad grants. Privilege analysis lets an EBS DBA determine empirically which of those grants are genuinely required by a given schema, responsibility-driven session, or concurrent-processing job, and which can be revoked without functional impact. The package is owned by SYS, is classified in ETRM as OTHER, and is referenced by no other documented EBS package, confirming that it is invoked directly by DBAs or by external tooling rather than called from application code.

Key Procedures and Functions

The ETRM metadata documents five procedures, all of which are PROCEDUREs; there are no functions in the specification.

• CREATE_CAPTURE — Defines a new privilege capture. The user supplies a capture name and, optionally, a description, a capture type, a list of roles, and a condition. The capture type determines the scope of observation; the package declares four capture-type constants (database, role, context, and role-and-context). The roles parameter takes a role_name_list collection and constrains the capture when a role-based type is selected, while the condition parameter carries a Boolean expression used to filter the sessions that are observed for context-based capture types. CREATE_CAPTURE only creates the definition; it does not begin recording.
• DROP_CAPTURE — Removes an existing capture definition and its associated analysis results by name. This is the clean-up counterpart to CREATE_CAPTURE.
• ENABLE_CAPTURE — Activates a previously created capture so that privilege usage begins to be recorded.
• DISABLE_CAPTURE — Stops recording for a named capture, closing the observation window while preserving the collected data.
• GENERATE_RESULT — Processes the raw data collected during the enabled period and materialises the analysis result set. The reported results distinguish between used and unused privileges and are exposed through database-provided reporting views.

Tables Accessed

The ETRM metadata records no tables referenced through APPS synonyms for this package. This is expected: DBMS_PRIVILEGE_CAPTURE is a SYS-owned database utility whose internal state is maintained in fixed dictionary tables and views under the SYS and DBA_/USER_ namespaces rather than in EBS application tables. Consequently, no EBS application schema — including APPS — stores capture definitions or results on behalf of this package. The package therefore has no bearing on EBS data model integrity, but it does read dictionary metadata describing grants, roles, and sessions in order to assemble results.

Usage Notes

Because DBMS_PRIVILEGE_CAPTURE is a SYS-owned package and is not referenced by any other documented EBS package, it is not invoked from EBS forms, concurrent programs, or standard application code. It is called directly by a DBA with EXECUTE privilege on the package, ordinarily from SQL*Plus or another database client while connected with SYSDBA or a suitably privileged account. In an EBS 12.1.1 / 12.2.2 environment the typical sequence is to define and enable a capture for a bounded period of representative activity, disable it, generate the results, review the unused-privilege output, and then drop the capture. The natural candidates for such an exercise are the high-privilege EBS schemas such as APPS, and role-based captures can be scoped to the database roles that EBS grants.

Privilege analysis requires the relevant database option to be licensed and enabled, and running a capture imposes measurable overhead on the monitored workload. It should therefore be scheduled outside peak batch windows such as AutoConfig runs or concurrent manager peak periods. Any subsequent revocation of reported unused privileges on an EBS database must be treated with caution: grants may be exercised only under infrequent business cycles, so at least one full annual accounting or period-close cycle should be observed before acting on the results.