Home » RDBMS Server » Security » LOGON vs. LOGOFF during auditing
- LOGON vs. LOGOFF during auditing [message #237532] Mon, 14 May 2007 15:18 Go to next message
vkpugh
Messages: 2
Registered: May 2007
Location: Helena MT, USA
Junior Member
The database I'm working with has auditing turned on.

"CREATE SESSION" is turned on for all users.

However, I'm finding that a person can have a LOGOFF statement without having an earlier LOGON statement - over the course of this morning, for example, a user had 14 LOGOFFs and only 3 LOGONs (looking at the dba_audit_trail or dba_audit_session views).

The first CREATE SESSION audit statement for the day was a LOGOFF, followed by a couple more LOGOFFs before the first LOGON.

Logically, I would think you would LOGON, then LOGOFF, but because this is not happening, I'm not sure I'm understanding what LOGON and LOGOFF really mean.

I've looked at the literature and researched in this and other forums, but I've not seen anything about this subject.

Any help would be appreciated.

Thanks!

[Updated on: Mon, 14 May 2007 15:20]

Report message to a moderator

- Re: LOGON vs. LOGOFF during auditing [message #237572 is a reply to message #237532] Mon, 14 May 2007 23:49 Go to previous messageGo to next message
Michel Cadot
Messages: 68726
Registered: March 2007
Location: Saint-Maur, France, https...
Senior Member
Account Moderator
LOGON and LOGOFF for a session are recorded in the same audit row.
SQL> desc dba_audit_session
 Name                             Null?    Type
 -------------------------------- -------- ----------------------
 OS_USERNAME                               VARCHAR2(255)
 USERNAME                                  VARCHAR2(30)
 USERHOST                                  VARCHAR2(128)
 TERMINAL                                  VARCHAR2(255)
 TIMESTAMP                                 DATE
 ACTION_NAME                               VARCHAR2(28)
 LOGOFF_TIME                               DATE
...

ACTION_NAME contains the last action for a session either LOGON or LOGOFF%.
If it is LOGON, user didn't yet LOGOFF or session has not been clean.

Regards
Michel
- Re: LOGON vs. LOGOFF during auditing [message #242708 is a reply to message #237572] Mon, 04 June 2007 14:37 Go to previous message
vkpugh
Messages: 2
Registered: May 2007
Location: Helena MT, USA
Junior Member
Sorry to not have replied before, but this is exactly what I needed but couldn't find in documentation.

It was much appreciated!!

Thanks!
Previous Topic: How to find number of users connected to database from operating system level
Next Topic: Kill Session privileges
Goto Forum:
  


Current Time: Fri Dec 13 18:34:55 CST 2024