RE: dba_audit_session -- finding process?
- From: "Powell, Mark D" <mark.powell@xxxxxxx>
- To: "J. Dex" <cemail_219@xxxxxxxxxxx>, <oracle-l@xxxxxxxxxxxxx>
- Date: Wed, 29 Mar 2006 11:25:47 -0500
The v$session.audsid is available in dba_audit_trail however as the session is not there (never connected) you are not going to find any entries for it. You might check the dba_audit_trail columns userhost, os_username, terminal, and timestamp to see if these columns provide any useful information. Did you check the Widows event logs to see if some process is logging there? HTH -- Mark D Powell -- -----Original Message----- From: J. Dex [mailto:cemail_219@xxxxxxxxxxx] Sent: Wednesday, March 29, 2006 10:14 AM To: Powell, Mark D; oracle-l@xxxxxxxxxxxxx Subject: RE: dba_audit_session -- finding process? Unfortunately, it's a Windows 2003 server that was just assigned to me. Besides, it just seems that there must be someway from an auditing perspective to find out more about what is actually happening versus just who it is trying to login. Just for the knowledge, I would like to try to find out more about what they are trying to do. >From: "Powell, Mark D" <mark.powell@xxxxxxx> >To: <cemail_219@xxxxxxxxxxx>, <oracle-l@xxxxxxxxxxxxx> >Subject: RE: dba_audit_session -- finding process? >Date: Wed, 29 Mar 2006 09:59:23 -0500 > > >If you are on a UNIX based system I would suggest checking both Oracle >and the root cron jobs (again) for a job that is logging on with the >system username. > >HTH -- Mark D Powell -- > > >-----Original Message----- >From: oracle-l-bounce@xxxxxxxxxxxxx >[mailto:oracle-l-bounce@xxxxxxxxxxxxx] On Behalf Of J. Dex >Sent: Wednesday, March 29, 2006 9:47 AM >To: oracle-l@xxxxxxxxxxxxx >Subject: dba_audit_session -- finding process? > >Is there anyway to map sessionid (or any other parameter) from >dba_audit_session to a specific process to get more information on what >it actually is that is running? My system password keeps locking up so >I turned on auditing. I can see by error 1017 that it is due to >invalid login/password but can't tell what is trying to access the >database using the invalid login/password. We recently changed the >password so I suspect it is a script but I am not sure. I am also open >to any other ways of solving this problem. I recently took over this >server and may just not know where all of the scripts, etc. are even >though I thought I found everything. > >_________________________________________________________________ >On the road to retirement? Check out MSN Life Events for advice on how >to get there! http://lifeevents.msn.com/category.aspx?cid=Retirement > >-- >http://www.freelists.org/webpage/oracle-l > > _________________________________________________________________ Express yourself instantly with MSN Messenger! Download today - it's FREE! http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/ -- http://www.freelists.org/webpage/oracle-l