RE: SYS.AUD$ USERHOST column all NULL?

The meaning of USERHOST changed between 9.2 and 10g.  In 10g and later, it 
means the host from which the connection was originated (e.g. the client).  In 
9.2 and earlier, it means something else entirely.  From the docs (for 
DBA_AUDIT_TRAIL, but they mean the same thing) at 
http://docs.oracle.com/cd/B10501_01/server.920/a96536/ch2205.htm:

"Numeric instance ID for the Oracle instance from which the user is accessing 
the database. Used only in environments with distributed file systems and 
shared database files."

So in 9i this is not going to give you what you want anyway - and it is 
(typically) only available in RAC systems.  That is probably why you are seeing 
nulls.

Don Granaman | Phone: 402-361-3073 | Cell: 402-960-6955 | Fax: 402-361-3173 | 
Solutionary | Relevant . Intelligent . Security

-----Original Message-----
From: oracle-l-bounce@xxxxxxxxxxxxx [mailto:oracle-l-bounce@xxxxxxxxxxxxx] On 
Behalf Of Kenneth Fowler
Sent: Monday, April 16, 2012 10:09 AM
To: oracle-l@xxxxxxxxxxxxx
Subject: SYS.AUD$ USERHOST column all NULL?

List,


I am trying to create a report that will identify inappropriate access
against SYS.AUD$ across many databases.  In order to do this I am
reporting on any access except SELECT and DELETE (where the delete
originates from a known job used to maintain the audit table).

To determine if the delete originates from the known job used to
maintain the audit table, I am using a selection criteria including
columns OS_USERNAME, USERNAME and USERHOST.  This works fine in most
cases except that, for a handful of 9i databases, I have noticed that
USERHOST is always NULL which breaks my strategy...

SQL> select version from v$instance;

VERSION
-----------------
9.2.0.8.0

SQL> select count(*) from sys.aud$;

  COUNT(*)
----------
     54229

SQL> select count(*) from sys.aud$ where userhost is null;

  COUNT(*)
----------
     54229

This is on Solaris 9.  I checked MOS and google but did not get any
hits.  This is occurring for about 10 databases that are all 9.2.0.6,
9.2.0.7, 9.2.0.8.  Has anyone seen this behavior?  Any fix?


Thanks,
Ken.
--
http://www.freelists.org/webpage/oracle-l


--
http://www.freelists.org/webpage/oracle-l

Other related posts: