DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=gamma;
        h=message-id:date:from:to:subject:cc:in-reply-to:mime-version:content-type:references;
        b=CjscU68yEvDBWlUWj88fDC4pqRLzdyL7fcycWvD8AdaUqD3ZWtgaR0IaGNleasmkV5dYyobgLECc8d5lpPz3loGTxFE832VSkcUP98KlDAAO0V9BFRhyFcd56VpFAuuxefpr8y1BZpkMmNHnfNSz7z7IOzGmsEX0lKjBq5tWGAc=
Message-ID: <bf46380803111614x6c5718b0m96604699a3ed0b89@mail.gmail.com>
Date: Tue, 11 Mar 2008 16:14:04 -0700
From: "Jared Still" <jkstill@gmail.com>
To: mary_mcneely@yahoo.com
Subject: Re: Audit for program at login time
Cc: oracle-l@freelists.org
In-Reply-To: <83269.11309.qm@web54111.mail.re2.yahoo.com>
MIME-Version: 1.0
Content-Type: multipart/alternative; boundary="----=_Part_5504_24994458.1205277244789"
References: <83269.11309.qm@web54111.mail.re2.yahoo.com>
Sender: oracle-l-bounce@freelists.org
Errors-to: oracle-l-bounce@freelists.org
Precedence: normal
Reply-to: jkstill@gmail.com
------=_Part_5504_24994458.1205277244789
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

This information might be good for troubleshooting, or determining how
legitimate
users access the database.

Keep in mind that the value in v$session.program is easily spoofed by any
user
with nefarious purposes simply by renaming the executable.

eg.  C:> move toad.exe sqlplus.exe

Something that anyone with ill intent is likely to know about.

On Tue, Mar 11, 2008 at 12:41 PM, Mary Elizabeth McNeely <
mary_mcneely@yahoo.com> wrote:

> Hello all,
>
> I am tasked with auditing who accesses the database with what program
> (equivalent of v$session.program) upon database login.  I can get everything
> I want into the audit trail by using "audit connect", except the equivalent
> of v$session.program.
>
> (a) Does anyone know of a supported way to push the program information
> into sys.aud$, and if not,
>
> (b) Does anyone know of a way to accomplish this other than a login
> trigger?  Any sample code available?
>
> Thanks in advance for any hints you can offer.
>
> Mary Elizabeth McNeely
> --
> http://www.freelists.org/webpage/oracle-l
>
>
>


-- 
Jared Still
Certifiable Oracle DBA and Part Time Perl Evangelist

------=_Part_5504_24994458.1205277244789
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

This information might be good for troubleshooting, or determining how legitimate <br>users access the database.<br><br>Keep in mind that the value in v$session.program is easily spoofed by any user<br>with nefarious purposes simply by renaming the executable.<br>
<br>eg.&nbsp; C:&gt; move toad.exe sqlplus.exe<br><br>Something that anyone with ill intent is likely to know about.<br><br><div class="gmail_quote">On Tue, Mar 11, 2008 at 12:41 PM, Mary Elizabeth McNeely &lt;<a href="mailto:mary_mcneely@yahoo.com">mary_mcneely@yahoo.com</a>&gt; wrote:<br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">Hello all,<br>
<br>
I am tasked with auditing who accesses the database with what program (equivalent of v$session.program) upon database login. &nbsp;I can get everything I want into the audit trail by using &quot;audit connect&quot;, except the equivalent of v$session.program.<br>

<br>
(a) Does anyone know of a supported way to push the program information into sys.aud$, and if not,<br>
<br>
(b) Does anyone know of a way to accomplish this other than a login trigger? &nbsp;Any sample code available?<br>
<br>
Thanks in advance for any hints you can offer.<br>
<br>
Mary Elizabeth McNeely<br>
<font color="#888888">--<br>
<a href="http://www.freelists.org/webpage/oracle-l" target="_blank">http://www.freelists.org/webpage/oracle-l</a><br>
<br>
<br>
</font></blockquote></div><br><br clear="all"><br>-- <br>Jared Still<br>Certifiable Oracle DBA and Part Time Perl Evangelist<br>

------=_Part_5504_24994458.1205277244789--
--
http://www.freelists.org/webpage/oracle-l