Hi
I have a database which is generating large amount of audit information in
syslog. audit_trail is set to OS. SELECT statements are being audited, one
sample audit record
Apr 26 14:54:42 no1b local6:notice
Oracle Audit[54526112]:
LENGTH: "272"
SESSIONID:[8] "99149799"
ENTRYID:[5] "37831"
STATEMENT:[5] "82728"
USERID:[4] "MOON"
USERHOST:[7] "curve2"
TERMINAL:[7] "unknown"
ACTION:[1] "3"
RETURNCODE:[1] "0"
OBJ$CREATOR:[4] "MOON"
OBJ$NAME:[19] "API_Q_POINT"
OS$USERID:[6] "curve"
DBID:[10] "3327503583"
I checked what is being audited but nothing is being audited. Ichecked by
running these queries:
SELECT * FROM DBA_STMT_AUDIT_OPTS where USER_NAME is not null order by
user_name,audit_option;
SELECT * FROM DBA_PRIV_AUDIT_OPTS where USER_NAME is not null order by
user_name,privilege;
SELECT * FROM DBA_OBJ_AUDIT_OPTS order by owner,object_name,object_type;
SELECT * FROM ALL_DEF_AUDIT_OPTS;
All of them return cero rows except ALL_DEF_AUDIT_OPTS which shows
ALT AUD COM DEL GRA IND INS LOC REN SEL UPD REF EXE FBK REA
--- --- --- --- --- --- --- --- --- --- --- --- --- --- ---
-/- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/-
Anyone know where else can I check :-?
audit parameters
show parameter audit
NAME TYPE VALUE
------------------------------------ -----------
------------------------------
audit_file_dest string
/u01/app/oracle/admin/AIX112/adump
audit_sys_operations boolean FALSE
audit_syslog_level string LOCAL6.NOTICE
audit_trail string OS
Thank you
