RE: dba_audit_session -- finding process?
- From: "Powell, Mark D" <mark.powell@xxxxxxx>
- To: "J. Dex" <cemail_219@xxxxxxxxxxx>, <oracle-l@xxxxxxxxxxxxx>
- Date: Wed, 29 Mar 2006 11:25:47 -0500
The v$session.audsid is available in dba_audit_trail however as the
session is not there (never connected) you are not going to find any
entries for it. You might check the dba_audit_trail columns userhost,
os_username, terminal, and timestamp to see if these columns provide any
useful information.
Did you check the Widows event logs to see if some process is logging
there?
HTH -- Mark D Powell --
-----Original Message-----
From: J. Dex [mailto:cemail_219@xxxxxxxxxxx]
Sent: Wednesday, March 29, 2006 10:14 AM
To: Powell, Mark D; oracle-l@xxxxxxxxxxxxx
Subject: RE: dba_audit_session -- finding process?
Unfortunately, it's a Windows 2003 server that was just assigned to me.
Besides, it just seems that there must be someway from an auditing
perspective to find out more about what is actually happening versus
just who it is trying to login. Just for the knowledge, I would like to
try to find out more about what they are trying to do.
>From: "Powell, Mark D" <mark.powell@xxxxxxx>
>To: <cemail_219@xxxxxxxxxxx>, <oracle-l@xxxxxxxxxxxxx>
>Subject: RE: dba_audit_session -- finding process?
>Date: Wed, 29 Mar 2006 09:59:23 -0500
>
>
>If you are on a UNIX based system I would suggest checking both Oracle
>and the root cron jobs (again) for a job that is logging on with the
>system username.
>
>HTH -- Mark D Powell --
>
>
>-----Original Message-----
>From: oracle-l-bounce@xxxxxxxxxxxxx
>[mailto:oracle-l-bounce@xxxxxxxxxxxxx] On Behalf Of J. Dex
>Sent: Wednesday, March 29, 2006 9:47 AM
>To: oracle-l@xxxxxxxxxxxxx
>Subject: dba_audit_session -- finding process?
>
>Is there anyway to map sessionid (or any other parameter) from
>dba_audit_session to a specific process to get more information on what
>it actually is that is running? My system password keeps locking up so
>I turned on auditing. I can see by error 1017 that it is due to
>invalid login/password but can't tell what is trying to access the
>database using the invalid login/password. We recently changed the
>password so I suspect it is a script but I am not sure. I am also open
>to any other ways of solving this problem. I recently took over this
>server and may just not know where all of the scripts, etc. are even
>though I thought I found everything.
>
>_________________________________________________________________
>On the road to retirement? Check out MSN Life Events for advice on how
>to get there! http://lifeevents.msn.com/category.aspx?cid=Retirement
>
>--
>//www.freelists.org/webpage/oracle-l
>
>
_________________________________________________________________
Express yourself instantly with MSN Messenger! Download today - it's
FREE!
http://messenger.msn.click-url.com/go/onm00200471ave/direct/01/
--
//www.freelists.org/webpage/oracle-l
Other related posts:
