Re: AUD$ TIMESTAMP and LOGOFF_TIME are equal

Looks like the behavior has changed with 11g (both R1 and R2 - probably a bug!) - see the following:


10.2.0.4:
======

1.  After initial logon:
SQL> Select timestamp, action_name, logoff_time from DBA_AUDIT_SESSION;

TIMESTAMP          ACTION_NAME                  LOGOFF_TIME
------------------ ---------------------------- ------------------
30-DEC-10 21:26:33 LOGON

2.  After log off:
SQL> /

TIMESTAMP          ACTION_NAME                  LOGOFF_TIME
------------------ ---------------------------- ------------------
30-DEC-10 21:26:33 LOGOFF *30-DEC-10 21:29:49*

As you will notice, it is the desired behavior - we have the the correct/expected log-off-time:

With 11g (both R1 and R2):
===================
1.  After initial logon:
SQL> Select timestamp, action_name, logoff_time from DBA_AUDIT_SESSION;
TIMESTAMP          ACTION_NAME                  LOGOFF_TIME
------------------ ---------------------------- ------------------
30-DEC-10 21:32:03 LOGON

2. After log-off:

TIMESTAMP          ACTION_NAME                  LOGOFF_TIME
------------------ ---------------------------- ------------------
30-DEC-10 21:33:24 LOGOFF 30-DEC-10 21:33:24 => same timestamps







On 12/30/2009 4:13 PM, Yong Huang wrote:
Is there any consistency of the audit rows where TIMESTAMP = LOGOFF_TIME?
I remember reading on MOS that said what Dave said earlier "if the session
ends properly, TIMESTAMP and LOGOFF_TIME should be the same." At logoff
time, the timestamp is updated to that time, unless the action is 'LOGOFF
BY CLEANUP', i.e. the session terminates abnormally.

I didn't find that note, but found Note:271615.1 that says "From 10g
onwards the time shown in TIMESTAMP and LOGOFF_TIME columns are in
different time zones". I thought that would create a difference in query
result. But no. TIMESTAMP of the dba_audit_* views in 10g and up is
already converted to the local timezone, even though the ntimestamp#
column of aud$ is in UTC. Ric, you're talking about the columns of
dba_audit_*, not aud$. What you see is normal.

Yong Huang



--
http://www.freelists.org/webpage/oracle-l




Other related posts: