Alex, Thanks a lot. Probably should have had another thread, just forgot to change subject. Ran SELECT DISTINCT USERNAME , OS_USERNAME, COUNT(*) FROM DBA_AUDIT_SESSION WHERE USERNAME IN ('XXX' ,'yyy' ) GROUP BY USERNAME ,OS_USERNAME ; and got what I wanted. Can't seem to get userhost info. Found jbdc connections coming in from app server as "oracle" It's an older version of ARIBA and I don't know how the jbdc part works. Rather see the app connections as something like "buyerX" -----Original Message----- From: Alex Gorbachev [mailto:gorbyx@xxxxxxxxx] Sent: Tuesday, August 08, 2006 3:19 AM To: Wolfson Larry - lwolfs Cc: oracle-l@xxxxxxxxxxxxx Subject: Re: Oracle Auditing Recommendations You should have a look at DBA_AUDIT_SESSION. Obviously, AUDIT_TRAIL must be set to DB. 2006/8/7, Wolfson Larry - lwolfs <lawrence.wolfson@xxxxxxxxxx>: > I looked at AUD$ thinking I'd see the osusers/servers and see > if any weren't coming from valid osusers/servers. But all I saw was > userhost and that not populated. -- Best regards, Alex Gorbachev http://blog.oracloid.com ************************************************************************* The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged. If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited. If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system. Thank you. ************************************************************************* -- //www.freelists.org/webpage/oracle-l