Categories

JAVA DATEBASE
Technology Network Community
Oracle Database
Fusion Middleware
Development Tools
Java
Desktop
Server & Storage Systems
Enterprise Management
Berkeley DB Family
Cloud Computing
Big Data
Business Intelligence
Architecture
Migration and Modernization
E-Business Suite
Siebel
PeopleSoft Enterprise
JD Edwards World
Industries
JD Edwards EnterpriseOne
User Productivity Kit Pro (UPK) and Tutor
Governance, Risk & Compliance (GRC)
Master Data Management (MDM)
Oracle CRM On Demand
On Demand: SaaS and Managed Applications
AutoVue Enterprise Visualization
Primavera
ATG
Agile PLM
Endeca Experience Management
Fusion Applications
Archived Forums

 



Tags

General Questions


auditing problem


Hello,  My customer is using 10.2.0.4 version database. In her stand by database the job is running every Wednesday around 23:55 PM.   The listener log doesn't appear  to  show the  external connections at that time to STDBY.  As per the audit log  file PRIVILEGE :[4] 'NONE' . If it is a SYS connection, it should show as SYSDBA. But in this case,it showing as NONE. Customer question is who is running the job?   Audit File Info ======================= Wed Sep  1 23:55:58 2010 LENGTH : '168' ACTION :[44] 'select count(*), NULL, NULL from dba_repcat' DATABASE USER:[1] '/' PRIVILEGE :[4] 'NONE' CLIENT USER:[0] '' CLIENT TERMINAL:[8] 'UNKNOWN' STATUS:[1] '0'   Wed Sep  1 23:55:58 2010 LENGTH : '208' ACTION :[84] 'select count(*), NULL, NULL from dba_users where password in ('GLOBAL', 'EXTERNAL')' DATABASE USER:[1] '/' PRIVILEGE :[4] 'NONE' CLIENT USER:[0] ''    SQL>sho parameter audit results in NAME                                 TYPE        VALUE  ----------- audit_file_dest                      string          /u01/app/oracle/admin/STDBY/adump audit_sys_operations            boolean     TRUE audit_syslog_level                string audit_trail                            string          DB  Thanks

Hi,     In unix system, any commands fired by "/ as sysdba" or as an administrative user are logged to special log files created by Oracle and stored in $ORACLE_HOME/rdbms/audit directory.  Seems like, somebody connected to the database as "/ as sysdba" (on the server) and fired those select statements and hence, its logged in the file in audit directory.  [http://aprakash.wordpress.com/2010/03/29/audit-connect-as-sysdba/]  HTH Anand

Hi, Thanx for the reply,                                   But what you  are talking about is mandatory auditing, means irrespective of value of the parameter "audit_sys_operations", sys actions will be audited in /rdbms/audit directory. In this case, audit_sys_operations parameter is set to true. but still the privilege is showing as NONE in the audit records, can you please tell me reason  for this?


Related Links

multiversions in Materialized View Replication Environment
Oracle SE1
Looking into a uncommitted transactions...how do you?
9i agent will not start on windows
imp error incompatible characeterset ?
Support for Oracle Database 9.2
Altering the Shared Pool Size
What is the lightest version of Oracle?
Unix or Wintel
Date
What protocol do i use to direct connect my DATABASE? instead of TCP/IP
ORA-00932: inconsistent datatypes
Shutting down Oracle
Query that don't work
Can you audit on roles?
CTF File