From oracle-l-bounce@freelists.org Thu Dec 1 10:57:05 2005 Return-Path: Received: from air891.startdedicated.com (root@localhost) by orafaq.com (8.12.10/8.12.10) with ESMTP id jB1Gv4DM014631 for ; Thu, 1 Dec 2005 10:57:04 -0600 X-ClientAddr: 206.53.239.180 Received: from turing.freelists.org (freelists-180.iquest.net [206.53.239.180]) by air891.startdedicated.com (8.12.10/8.12.10) with ESMTP id jB1GuvAX014611 for ; Thu, 1 Dec 2005 10:56:58 -0600 Received: from localhost (localhost [127.0.0.1]) by turing.freelists.org (Avenir Technologies Mail Multiplex) with ESMTP id 59A3D23EDF9; Thu, 1 Dec 2005 11:54:10 -0500 (EST) Received: from turing.freelists.org ([127.0.0.1]) by localhost (turing [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 27495-03; Thu, 1 Dec 2005 11:54:10 -0500 (EST) Received: from turing (localhost [127.0.0.1]) by turing.freelists.org (Avenir Technologies Mail Multiplex) with ESMTP id C694023EE0C; Thu, 1 Dec 2005 11:54:09 -0500 (EST) Received: with ECARTIS (v1.0.0; list oracle-l); Thu, 01 Dec 2005 11:52:13 -0500 (EST) Received: from localhost (localhost [127.0.0.1]) by turing.freelists.org (Avenir Technologies Mail Multiplex) with ESMTP id DAE4E23D0AC for ; Thu, 1 Dec 2005 11:52:12 -0500 (EST) Received: from turing.freelists.org ([127.0.0.1]) by localhost (turing [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 26927-03 for ; Thu, 1 Dec 2005 11:52:12 -0500 (EST) Received: from sxexscan1.qg.com (SXEXSCAN1.qg.com [161.49.252.44]) by turing.freelists.org (Avenir Technologies Mail Multiplex) with ESMTP id 873AB23DA3C for ; Thu, 1 Dec 2005 11:52:12 -0500 (EST) Received: from unknown (HELO sxexsmtp1.qg.com) ([192.168.5.28]) by sxexscan1.qg.com with ESMTP; 01 Dec 2005 10:53:01 -0600 X-IronPort-AV: i="3.99,202,1131343200"; d="scan'208,217"; a="25310390:sNHT51505104" Received: from sxexpub1.qg.com ([172.25.24.6]) by sxexsmtp1.qg.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 1 Dec 2005 10:52:10 -0600 Received: from QTEX1.qg.com ([161.49.71.132]) by sxexpub1.qg.com with Microsoft SMTPSVC(6.0.3790.211); Thu, 1 Dec 2005 10:52:10 -0600 X-MimeOLE: Produced By Microsoft Exchange V6.5.7226.0 Content-class: urn:content-classes:message MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C5F697.924C412E" Subject: RE: Can IP addresses be audited in Oracle Date: Thu, 1 Dec 2005 10:52:10 -0600 Message-ID: X-MS-Has-Attach: X-MS-TNEF-Correlator: Thread-Topic: Can IP addresses be audited in Oracle Thread-Index: AcX2k5Zbr0iiZnCFRdiiXJjDieQW4QAA515A From: "Jesse, Rich" Cc: X-OriginalArrivalTime: 01 Dec 2005 16:52:10.0805 (UTC) FILETIME=[927C6E50:01C5F697] X-archive-position: 28817 X-ecartis-version: Ecartis v1.0.0 Sender: oracle-l-bounce@freelists.org Errors-To: oracle-l-bounce@freelists.org X-original-sender: Rich.Jesse@quadtechworld.com Precedence: normal Reply-To: Rich.Jesse@quadtechworld.com X-list: oracle-l X-Virus-Scanned: by amavisd-new-20030616-p9 (Debian) at avenirtech.net X-mailscan-MailScanner-Information: Please contact the ISP for more information X-mailscan-MailScanner: Found to be clean X-MailScanner-From: oracle-l-bounce@freelists.org X-Spam-Checker-Version: SpamAssassin 2.63 (2004-01-11) on air891.startdedicated.com X-Spam-Level: X-Spam-Status: No, hits=-4.8 required=5.0 tests=AWL,BAYES_00, HTML_FONTCOLOR_BLUE,HTML_MESSAGE autolearn=no version=2.63 ------_=_NextPart_001_01C5F697.924C412E Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Don't forget your friendly flatfile listener.log, which in recent versions of Oracle can be setup as an external table to be read from the DB directly. Because of the nature of the listener, it can't know if a connection is successful or not, just that one was attempted. =20 Also note that all bets are off for just about any useful logging information if the client is using JDBC thin to connect. =20 Rich -----Original Message----- From: oracle-l-bounce@freelists.org [mailto:oracle-l-bounce@freelists.org] On Behalf Of Ethan Post Sent: Thursday, December 01, 2005 10:20 AM To: jametong@gmail.com Cc: Oracle-L@freelists.org Subject: Re: Can IP addresses be audited in Oracle =09 =09 I believe the hostname or IP is in DBA_AUDIT_TRAIL when you AUDIT SESSION. This is the only way to get the info for a failed logon attempt AFAIK. =09 =09 On 12/1/05, jame tong wrote:=20 you can use logon triggers to record the context of the logon event.=20 =09 =09 =09 ------_=_NextPart_001_01C5F697.924C412E Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Message
Don't forget your=20 friendly flatfile listener.log, which in recent versions of Oracle can = be setup=20 as an external table to be read from the DB directly.  Because of = the=20 nature of the listener, it can't know if a connection is successful = or not,=20 just that one was attempted.
 
Also note that=20 all bets are off for just about any useful logging = information if the=20 client is using JDBC thin to connect.
 
Rich
-----Original Message-----
From:=20 oracle-l-bounce@freelists.org [mailto:oracle-l-bounce@freelists.org] = On=20 Behalf Of Ethan Post
Sent: Thursday, December 01, 2005 = 10:20=20 AM
To: jametong@gmail.com
Cc:=20 Oracle-L@freelists.org
Subject: Re: Can IP addresses be = audited in=20 Oracle

I believe the hostname or IP is in = DBA_AUDIT_TRAIL=20 when you AUDIT SESSION. This is the only way to get the info for a = failed=20 logon attempt AFAIK.

On 12/1/05, jame=20 tong <jametong@gmail.com>=20 wrote:=20
you=20 can use logon triggers to record the context of the logon event.=20


------_=_NextPart_001_01C5F697.924C412E-- -- http://www.freelists.org/webpage/oracle-l