Search code examples
sqlperformanceoracle-databaserow-level-security

How to see the predicates added by a VPD in an Oracle database?


The predicates added by a Row Level Security policy do not show in the 10046 trace file. One suggestion is to use the 10053 (optimizer) trace to see the VPD predicates, but it is difficult to set the 10053 trace on a given session from another session.

Is there any other way to see what predicates were added by an RLS policy ?

Scenario : The RLS policy is applied on a query in session #1. We need to analyse what happens in session #1 from session #2.

The database 10g is Oracle 10g.


Solution

  • You need a user who has access to V$VPD_POLICY. By default that would be just the SYSDBA users, so you'll probably need a DBA to grant you access on the view. The view ties predicates to SQL statements. You'll need to get the SQL_ID from V$SQLAREA, because that gives you the ADDRESS, which is the only mechanism to link the SQL statement to the right row in V$SESSION.

    Actually the order of access is: V$SESSION gives you the ADDRESS of the last statement executed by session 1. You use that to find its SQL_ID in V$SQLAREA, which in turn allows you to link to V$VPD_POLICY.

    So you need access to several of the V$ views. But if you're tuning you should have access to them anyway, except V$VPD_POLICY.