Home » RDBMS Server » Security » Audit sys operation fail
Audit sys operation fail [message #259006] Tue, 14 August 2007 02:04 Go to next message
SilverChi
Messages: 17
Registered: September 2006
Junior Member
Hi all..

I got some confuse about my audit_sys_operation option. I already set it to "TRUE", but any actions of sysdba privileged users still not recorded on Sys.Aud$. However, i can still find those records on OS events log. In Contrary, other user's (without sysdba privilege) actions still recorded bot on Sys.Aud$ and OS events log.
Is it something i've missed?

Oracle 9.2, Windows 2000 AS

Regards..
Re: Audit sys operation fail [message #259009 is a reply to message #259006] Tue, 14 August 2007 02:25 Go to previous messageGo to next message
Michel Cadot
Messages: 68625
Registered: March 2007
Location: Nanterre, France, http://...
Senior Member
Account Moderator
SYS actions are never audit in aud$. It should be useless as SYS can erase/modify aud$ rows.
So these actions are always recorded in file given by the parameter audit_file_dest.
Other users actions are recorded accordingly with audit_trail parameter (and audit statements).

Regards
Michel
Re: Audit sys operation fail [message #259179 is a reply to message #259009] Tue, 14 August 2007 10:35 Go to previous messageGo to next message
DreamzZ
Messages: 1666
Registered: May 2007
Location: Dreamzland
Senior Member
did you restart database?
Re: Audit sys operation fail [message #259381 is a reply to message #259179] Wed, 15 August 2007 06:51 Go to previous messageGo to next message
SilverChi
Messages: 17
Registered: September 2006
Junior Member
Yes, i've restarted the db. I better to set the param audit_file_dest on my db, as cadot says.


Thanks Gurus..
Re: Audit sys operation fail [message #259427 is a reply to message #259381] Wed, 15 August 2007 10:43 Go to previous messageGo to next message
DreamzZ
Messages: 1666
Registered: May 2007
Location: Dreamzland
Senior Member
Did you figure it?
Re: Audit sys operation fail [message #259942 is a reply to message #259381] Thu, 16 August 2007 21:54 Go to previous message
ebrian
Messages: 2794
Registered: April 2006
Senior Member
SilverChi wrote on Wed, 15 August 2007 07:51
I better to set the param audit_file_dest on my db, as cadot says.

AUDIT_FILE_DEST is not needed (and for that matter...supported) on Windows platform. If you are getting log entries in your Windows event log, then it would appear that your auditing is performing successfully.
Previous Topic: how decrypt oracle user's password
Next Topic: OS login
Goto Forum:
  


Current Time: Thu Mar 28 12:24:54 CDT 2024