Hello, My customer is using 10.2.0.4 version database. In her stand by database the job is running every Wednesday around 23:55 PM. The listener log doesn't appear to show the external connections at that time to STDBY. As per the audit log file PRIVILEGE : 'NONE' . If it is a SYS connection, it should show as SYSDBA. But in this case,it showing as NONE. Customer question is who is running the job? Audit File Info ======================= Wed Sep 1 23:55:58 2010 LENGTH : '168' ACTION : 'select count(*), NULL, NULL from dba_repcat' DATABASE USER: '/' PRIVILEGE : 'NONE' CLIENT USER: '' CLIENT TERMINAL: 'UNKNOWN' STATUS: '0' Wed Sep 1 23:55:58 2010 LENGTH : '208' ACTION : 'select count(*), NULL, NULL from dba_users where password in ('GLOBAL', 'EXTERNAL')' DATABASE USER: '/' PRIVILEGE : 'NONE' CLIENT USER: '' SQL>sho parameter audit results in NAME TYPE VALUE ----------- audit_file_dest string /u01/app/oracle/admin/STDBY/adump audit_sys_operations boolean TRUE audit_syslog_level string audit_trail string DB Thanks
Hi, In unix system, any commands fired by "/ as sysdba" or as an administrative user are logged to special log files created by Oracle and stored in $ORACLE_HOME/rdbms/audit directory. Seems like, somebody connected to the database as "/ as sysdba" (on the server) and fired those select statements and hence, its logged in the file in audit directory. [http://aprakash.wordpress.com/2010/03/29/audit-connect-as-sysdba/] HTH Anand
Hi, Thanx for the reply, But what you are talking about is mandatory auditing, means irrespective of value of the parameter "audit_sys_operations", sys actions will be audited in /rdbms/audit directory. In this case, audit_sys_operations parameter is set to true. but still the privilege is showing as NONE in the audit records, can you please tell me reason for this?