Oracle 12.2.0.1
Column userhost of unified_audit_trail sometimes shows strange values for some
client hosts, e.g. the first one below
SQL> select os_username, userhost, event_timestamp, return_code,
authentication_type
2 from unified_audit_trail
3 where event_timestamp > sysdate - 1/1440 and action_name='LOGON'
4 order by 3;
OS_USERNAME USERHOST EVENT_TIMESTAMP
RETURN_CODE
-------------------- -----------------------------------
------------------------------ -----------
AUTHENTICATION_TYPE
---------------------------------------------------------------------------------------------------
root 8621ecdafb91 26-APR-18
08.49.00.037272 AM 0
(TYPE=(DATABASE));(CLIENT
ADDRESS=((ADDRESS=(PROTOCOL=tcp)(HOST=10.74.67.54)(PORT=44462))));
novlua dosrlidmig1 26-APR-18
08.49.06.468324 AM 0
(TYPE=(DATABASE));(CLIENT
ADDRESS=((ADDRESS=(PROTOCOL=tcp)(HOST=10.74.198.241)(PORT=49776))));
...
I can find the actual client from the IP address shown in the
authentication_type string. In this case, IP 10.74.67.54 is reverse resolved to
dcsrlcs2 plus our domain name. But what is the string under userhost? That
value is not the MAC address of the host (86-21-ec is not a vendor code), not
host ID (Linux host ID is 4 bytes instead of 6), not ASCII values of part of
the host name (ec maps to a non-ASCII character). So what is it? We don't have
this problem in 11g, and this only happens to certain hosts connecting to 12c.
Yong Huang
--
//www.freelists.org/webpage/oracle-l
