OraFAQ Forum: Security » Audit sys operation fail

Home » RDBMS Server » Security » Audit sys operation fail

Show: Today's Messages :: Polls :: Message Navigator
E-mail to friend

Audit sys operation fail [message #259006]

Tue, 14 August 2007 02:04

SilverChi
Messages: 17
Registered: September 2006

Junior Member

Hi all..

I got some confuse about my audit_sys_operation option. I already set it to "TRUE", but any actions of sysdba privileged users still not recorded on Sys.Aud$. However, i can still find those records on OS events log. In Contrary, other user's (without sysdba privilege) actions still recorded bot on Sys.Aud$ and OS events log.
Is it something i've missed?

Oracle 9.2, Windows 2000 AS

Regards..

Report message to a moderator

Re: Audit sys operation fail [message #259009 is a reply to message #259006]

Tue, 14 August 2007 02:25

Michel Cadot
Messages: 68718
Registered: March 2007
Location: Saint-Maur, France, https...

Senior Member
Account Moderator

SYS actions are never audit in aud$. It should be useless as SYS can erase/modify aud$ rows.
So these actions are always recorded in file given by the parameter audit_file_dest.
Other users actions are recorded accordingly with audit_trail parameter (and audit statements).

Regards
Michel

Report message to a moderator

Re: Audit sys operation fail [message #259179 is a reply to message #259009]

Tue, 14 August 2007 10:35

DreamzZ
Messages: 1666
Registered: May 2007
Location: Dreamzland

Senior Member

did you restart database?

Report message to a moderator

Re: Audit sys operation fail [message #259381 is a reply to message #259179]

Wed, 15 August 2007 06:51

SilverChi
Messages: 17
Registered: September 2006

Junior Member

Yes, i've restarted the db. I better to set the param audit_file_dest on my db, as cadot says.

Thanks Gurus..

Report message to a moderator

Re: Audit sys operation fail [message #259427 is a reply to message #259381]

Wed, 15 August 2007 10:43

DreamzZ
Messages: 1666
Registered: May 2007
Location: Dreamzland

Senior Member

Did you figure it?

Report message to a moderator

Re: Audit sys operation fail [message #259942 is a reply to message #259381]

Thu, 16 August 2007 21:54

ebrian
Messages: 2794
Registered: April 2006

Senior Member

SilverChi wrote on Wed, 15 August 2007 07:51

I better to set the param audit_file_dest on my db, as cadot says.

AUDIT_FILE_DEST is not needed (and for that matter...supported) on Windows platform. If you are getting log entries in your Windows event log, then it would appear that your auditing is performing successfully.

Report message to a moderator

Previous Topic:	how decrypt oracle user's password
Next Topic:	OS login

Goto Forum:

-=] Back to Top [=-

[ Syndicate this forum (XML) ] [

]

Current Time: Wed Dec 04 13:53:30 CST 2024