userhost of unified_audit_trail shown as cryptic string
Date: Thu, 26 Apr 2018 13:55:47 +0000 (UTC)
Message-ID: <1613239659.1153883.1524750947839_at_mail.yahoo.com>
Oracle 12.2.0.1
Column userhost of unified_audit_trail sometimes shows strange values for some client hosts, e.g. the first one below
SQL> select os_username, userhost, event_timestamp, return_code, authentication_type
2 from unified_audit_trail
...
I can find the actual client from the IP address shown in the authentication_type string. In this case, IP 10.74.67.54 is reverse resolved to dcsrlcs2 plus our domain name. But what is the string under userhost? That value is not the MAC address of the host (86-21-ec is not a vendor code), not host ID (Linux host ID is 4 bytes instead of 6), not ASCII values of part of the host name (ec maps to a non-ASCII character). So what is it? We don't have this problem in 11g, and this only happens to certain hosts connecting to 12c.
Yong Huang
3 where event_timestamp > sysdate - 1/1440 and action_name='LOGON'
4 order by 3;
OS_USERNAME USERHOST EVENT_TIMESTAMP RETURN_CODE
-------------------- ----------------------------------- ------------------------------ -----------
AUTHENTICATION_TYPE
root 8621ecdafb91 26-APR-18 08.49.00.037272 AM 0
(TYPE=(DATABASE));(CLIENT ADDRESS=((ADDRESS=(PROTOCOL=tcp)(HOST=10.74.67.54)(PORT=44462))));
novlua dosrlidmig1 26-APR-18 08.49.06.468324 AM 0
(TYPE=(DATABASE));(CLIENT ADDRESS=((ADDRESS=(PROTOCOL=tcp)(HOST=10.74.198.241)(PORT=49776))));
--
http://www.freelists.org/webpage/oracle-l
Received on Thu Apr 26 2018 - 15:55:47 CEST