Recommended Free Tools
Oracle Database can record privilege use with DBMS_PRIVILEGE_CAPTURE and report privileges observed or not observed during a defined capture. That can help identify grants to review, but a privilege listed as unused is only one that was not seen in the captured policy and runs—it is not proof that revoking it is safe.
What Oracle privilege analysis tells you
DBMS_PRIVILEGE_CAPTURE is Oracle’s PL/SQL interface for analyzing use of system and object privileges granted to users. It records activity within a policy’s scope, then lets administrators review what was and was not observed. Oracle says the approach can help administrators work toward least privilege: “By analyzing the privileges that users must have to perform specific tasks, privilege analysis policies help you to achieve a least privilege model for your users.” Oracle Database 19c DBMS_PRIVILEGE_CAPTURE reference.
As an Amazon Associate I earn from qualifying purchases.
The report answers a bounded question: which privileges did Oracle observe during these capture runs, under this policy? It does not establish that a privilege will never be needed. A DBA grant can confer many privileges, and a capture that misses a rarely used maintenance or recovery workflow may not reveal the need for the associated privilege.
Choose a capture scope that fits the question
Oracle documents four policy types. They differ in what activity is included, so choose deliberately before interpreting the results.
#1 Best Overall
| Policy type | What it captures | Useful when |
|---|---|---|
G_DATABASE |
Database privilege use, except privileges used by SYS. |
You want broad discovery across the database and understand that SYS activity is excluded. |
G_ROLE |
Use of privileges in specified roles. Role analysis includes privileges granted through nested roles. | You want to examine a particular role or set of roles rather than all database activity. |
G_CONTEXT |
Privilege use when a supplied SYS_CONTEXT condition is true. |
You want to focus on activity matching a session or application context. |
G_ROLE_AND_CONTEXT |
Use of privileges in selected roles while the supplied context condition is true. | You need both role-specific and context-specific scope. |
Context conditions use SYS_CONTEXT expressions, not arbitrary functions. A database-wide policy excludes SYS privilege use; do not interpret its output as a report of what SYS used. Oracle documents these policy types and their scope in the 19c package reference.
Create a policy, capture a run, and generate results
A new policy is disabled by default. Enable it for the period you want to observe, cover representative work, disable it, and then generate results. Oracle requires the policy to be disabled before GENERATE_RESULT.
- Create the policy: As an appropriately authorized administrator, call
DBMS_PRIVILEGE_CAPTURE.CREATE_CAPTUREwith a policy name and type. Supply the role list for role-based policies and a context condition for context-based policies. - Enable a capture run: Call
DBMS_PRIVILEGE_CAPTURE.ENABLE_CAPTURE. You may supply a run name so the results can be associated with that run. - Exercise representative activity: While capture is enabled, run the application workflows and operational tasks whose privilege use you need to understand.
- Disable the policy: Call
DBMS_PRIVILEGE_CAPTURE.DISABLE_CAPTUREwhen the observation period is complete. - Generate the analysis: Call
DBMS_PRIVILEGE_CAPTURE.GENERATE_RESULTfor the policy or a named run. Generation must occur after the policy is disabled. - Review the views: Inspect the used and unused privilege views for the analyzed policy and run; use path-aware views if you need to see how a privilege was granted.
The Oracle Database 19c reference says only one policy can be enabled at a time, with an exception allowing a G_DATABASE policy to run alongside another non-database-wide policy. A run name cannot be reused to enable the same run again. Check the package reference for the target database release and service before deployment, since these details here are grounded in 19c documentation and do not establish a complete availability or compatibility matrix.
Read used and unused results in context
Oracle 19c documents DBA_PRIV_CAPTURES for policy information, DBA_USED_PRIVS and specialized used views for observed privileges, and DBA_UNUSED_PRIVS and specialized unused views for privileges not used in reported policy runs. The guide also lists DBA_UNUSED_GRANTS and separate *_PATH views. The path-aware views expose grant paths; corresponding views without _PATH omit them. See Oracle’s Oracle Database 19c privilege-analysis guide.
Observed privileges
DBA_USED_PRIVS contains analyzed records with capture and sequence/run context, username, used role, privilege type, object details, host, module, and grant path. Oracle documents that access to the referenced analysis views requires the CAPTURE_ADMIN role. Consult the 19c guide when deciding which views to query.
Privileges not observed
DBA_UNUSED_PRIVS reports privilege categories not observed for analyzed policy runs and can show user or role, object, option, path, and run information. The Oracle result describing its precise columns is for AI Database 26ai and also specifies CAPTURE_ADMIN; treat those column details as 26ai documentation, not as a guarantee for 19c. Check the view reference for the database version you run: Oracle AI Database 26ai DBA_UNUSED_PRIVS reference.
How to decide whether a DBA-related grant can be revoked
Do not translate “unused” directly into “safe to revoke.” The result is limited to the policy and runs analyzed. Before changing production grants, use the findings as candidates for validation:
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →- Cover the business cycle: Capture representative periods, including month-end, quarter-end, annual, and other seasonal activity relevant to the system.
- Include infrequent operations: Identify maintenance, administration, batch, incident-response, and recovery tasks that may not occur during ordinary application use.
- Confirm policy scope: Check that the relevant users, roles, nested roles, application context, and SYS activity (where relevant) are represented by the capture design.
- Test candidate changes: Revoke candidate privileges in a representative nonproduction environment and exercise both regular and exceptional workflows.
- Stage and monitor: Make changes incrementally, monitor for failures, and retain a practical rollback path.
These are prudent operational safeguards, not a guarantee from Oracle that any particular revocation is safe. The captured result is evidence for review; business and operational validation must establish whether a privilege can be removed.
Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
