Oracle-L: RE: Database Auditing

From: Hallas, John, Tech Dev <John.Hallas_at_gb.vodafone.co.uk>
Date: Thu, 01 May 2003 01:26:50 -0800
Message-ID: <F001.0058D3FA.20030501012650@fatcity.com>

Jay,
Have you selected from sys.aud$ to see if the audit rows have been created?

John

-----Original Message-----
Sent: 30 April 2003 15:07
To: Multiple recipients of list ORACLE-L

What am I missing here? I have enabled auditing in the database, but it doesn't seem to work. This is an 8.1.7.3 database on Tru64. I set the initialization parameter and issued two AUDIT statements - AUDIT ALTER USER and AUDIT ALTER USER BY JMH123; I want to monitor activity that alters accounts.

Thank you,
Jay

SQL> run
1 select name,value from v$parameter
2* where name like '%audit%'

NAME                                                             VALUE
---------------------------------------------------------------- --------------------
transaction_auditing                                             TRUE
audit_trail                                                      DB
audit_file_dest                                                  ?/rdbms/audit

SQL> select * from dba_stmt_audit_opts;

USER_NAME                      PROXY_NAME                     AUDIT_OPTION                             SUCCESS    FAILURE
------------------------------ ------------------------------ ---------------------------------------- ---------- ----------
                                                              ALTER USER                               BY ACCESS  BY ACCESS
JMH123                                                        ALTER USER                               BY ACCESS  BY ACCESS

SQL> connect jmh123
Enter password:
Connected.
SQL> alter user jmh123 identified by devdata;

User altered.

SQL> connect system
Enter password:
Connected.
SQL> select * from dba_audit_trail;

no rows selected

SQL> SQL> select * from dba_audit_statement;

no rows selected

**DISCLAIMER
This e-mail message and any files transmitted with it are intended for the use of the individual or entity to which they are addressed and may contain information that is privileged, proprietary and confidential. If you are not the intended recipient, you may not use, copy or disclose to anyone the message or any information contained in the message. If you have received this communication in error, please notify the sender and delete this e-mail message. The contents do not represent the opinion of D&E except to the extent that it relates to their official business.
--

Please see the official ORACLE-L FAQ: http://www.orafaq.net
--

Author: Jay Hostetter
INET: jhostetter_at_decommunications.com

Fat City Network Services    -- 858-538-5051 http://www.fatcity.com
San Diego, California        -- Mailing list and web hosting services
---------------------------------------------------------------------

To REMOVE yourself from this mailing list, send an E-Mail message to: ListGuru_at_fatcity.com (note EXACT spelling of 'ListGuru') and in the message BODY, include a line containing: UNSUB ORACLE-L (or the name of mailing list you want to be removed from). You may also send the HELP command for other information (like subscribing).

--

Please see the official ORACLE-L FAQ: http://www.orafaq.net
--

Author: Hallas, John, Tech Dev
INET: John.Hallas_at_gb.vodafone.co.uk

Fat City Network Services    -- 858-538-5051 http://www.fatcity.com
San Diego, California        -- Mailing list and web hosting services
---------------------------------------------------------------------