Did you access the directory from a new or existing session? Most audit
commands only take effect for new sessions.
________________________________
From: oracle-l-bounce@xxxxxxxxxxxxx <oracle-l-bounce@xxxxxxxxxxxxx> on behalf
of Rich J <rjoralist3@xxxxxxxxxxxxxxxxxxxxx>
Sent: Wednesday, October 26, 2016 11:04:43 AM
To: Oracle L
Subject: What audit option causes trail entry on external table query?
Hey all,
In 11.2.0.3, I'm doing some analysis on my production listener logs. So I
copied them to the test DB server, merged them, and setup an external table to
read them from a test DB. But each time I SELECT from that external table, I
get an audit record with an action of 103 "SESSION REC" on the directory where
the external table exists.
I do have "AUDIT DIRECTORY BY ACCESS" set, but there is no object-level
auditing -- DBA_OBJ_AUDIT_OPTS is empty. According to
http://docs.oracle.com/cd/E11882_01/server.112/e41084/statements_4007.htm#SQLRF53740
I believe I should not be getting audit records when reading an external table
from that, or any, directory.
To test, I created a script that did a NOAUDIT, SELECT on the external table,
and then reissued the AUDIT for each audit option enabled. I used the output
from the scripts from the MOS doc: "SCRIPT: Generate AUDIT and NOAUDIT
Statements for Current Audit Settings (Doc ID 287436.1)" to generate the list
of audits enabled. In every case, the SELECT on the external table caused a
new audit record.
As a final test, I created another script to NOAUDIT every option, SELECT on
the external table, then re-enable all audits. Yup, a new audit record was
still created with no audits set.
Nothing found in MOS, the googles/duckduckgos, or the documentation. Thoughts?
Rich
