what is being audited by the database

From: Ls Cheng <exriscer_at_gmail.com>
Date: Fri, 26 Apr 2019 16:01:58 +0200
Message-ID: <CAJ2-Qb_XrFmP7Vi6GvO1tF7k9jC7fNA0b_izu7Bdw59ND-S+Zw_at_mail.gmail.com>

Hi

I have a database which is generating large amount of audit information in syslog. audit_trail is set to OS. SELECT statements are being audited, one sample audit record

Apr 26 14:54:42 no1b local6:notice
Oracle Audit[54526112]:
LENGTH: "272"
SESSIONID:[8] "99149799"
ENTRYID:[5] "37831"
STATEMENT:[5] "82728"
USERID:[4] "MOON"

USERHOST:[7] "curve2"
TERMINAL:[7] "unknown"
ACTION:[1] "3"

RETURNCODE:[1] "0"
OBJ$CREATOR:[4] "MOON"
OBJ$NAME:[19] "API_Q_POINT"
OS$USERID:[6] "curve"
DBID:[10] "3327503583" I checked what is being audited but nothing is being audited. Ichecked by running these queries:

SELECT * FROM DBA_STMT_AUDIT_OPTS where USER_NAME is not null order by user_name,audit_option;
SELECT * FROM DBA_PRIV_AUDIT_OPTS where USER_NAME is not null order by user_name,privilege;
SELECT * FROM DBA_OBJ_AUDIT_OPTS order by owner,object_name,object_type; SELECT * FROM ALL_DEF_AUDIT_OPTS; All of them return cero rows except ALL_DEF_AUDIT_OPTS which shows

ALT AUD COM DEL GRA IND INS LOC REN SEL UPD REF EXE FBK REA --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/-

Anyone know where else can I check :-?

audit parameters

show parameter audit

NAME                                 TYPE        VALUE
------------------------------------ -----------
------------------------------
audit_file_dest                      string
/u01/app/oracle/admin/AIX112/adump
audit_sys_operations                 boolean     FALSE
audit_syslog_level                   string      LOCAL6.NOTICE
audit_trail                          string      OS

Thank you

--
http://www.freelists.org/webpage/oracle-l

Received on Fri Apr 26 2019 - 16:01:58 CEST