Who locked oracle user [message #673085] |
Mon, 05 November 2018 06:47 |
|
muthukrish104
Messages: 82 Registered: November 2017
|
Member |
|
|
Hi Everyone,
I want to know who locked the account.
Our parameter setup is:-
audit_file_dest string C:\ORACLE\ORA12C\HOME\DBS\ADMIN\ADUMP
audit_sys_operations boolean TRUE
audit_trail string DB
And I am using the below query:-
select
os_username,
username,
userhost,terminal client,
action_name,
returncode,timestamp
from
dba_audit_session
where
returncode='1017'
and
username=='<username>'
order by timestamp desc
But it is not showing the latest details of the account lock. Am I missing anything.?
Also, what is the difference of using the below query:-
select terminal,userhost,spare1,ntimestamp# from aud$
where
returncode='1017'
and
userid='<username>'
order by ntimestamp# desc
Regards
M.Krish
|
|
|
|
|
|
|
|
|
|
|
Re: Who locked oracle user [message #673823 is a reply to message #673812] |
Tue, 11 December 2018 06:45 |
|
EdStevens
Messages: 1376 Registered: September 2013
|
Senior Member |
|
|
muthukrish104 wrote on Mon, 10 December 2018 23:02Hi Michel,
Yes,we have set the parameter "audit_trail" with the value of DB.
so, we should set it as EXTENDED or UNIFIED AUDITING.
Otherwise no chance to get the account locked info?
Am I right?
Regards
krish
Setting the audit_trail parameter is necessary but not sufficient. That enables auditing, but you must also use the AUDIT command to specify what you want to audit. See https://docs.oracle.com/database/121/DBSEG/audit_config.htm#DBSEG1025
And as I pointed up yesterday, setting auditing is NOT retroactive. Auditing causes information to be captured so that it can be reported. If you were not auditing at the time of the incident, then you were not capturing and so cannot report.
[Updated on: Tue, 11 December 2018 06:45] Report message to a moderator
|
|
|