RE: constant logging in as / as sysdba ?

From: Mercadante, Thomas F (LABOR) <"Mercadante,>
Date: Wed, 15 Apr 2009 15:32:32 -0400
Message-ID: <ABB9D76E187C5146AB5683F5A07336FF023CA5C5_at_EXCNYSM0A1AJ.nysemail.nyenet>

My guess is it's either pmon or smon. Is it happening like every few minutes?  

Put a database logon trigger in place and capture the program name.  

---

From: oracle-l-bounce_at_freelists.org
[mailto:oracle-l-bounce_at_freelists.org] On Behalf Of Dba DBA Sent: Wednesday, April 15, 2009 2:56 PM
To: oracle-l_at_freelists.org
Subject: constant logging in as / as sysdba ?  

I am trying to figure out what is logging in constantly as / as sysdba. We are on Solaris iwth Oracle 10.1. We are using Solaris clustering(this is OS clustering and not RAC). However, I turned the cluster off and then turned Oracle on manually. The / as sysdba connection continues to happen every minute.  

By default Oracle logs all / as sysdba connections. I then increased my auditing to try to find out what is going on.  

So I did  

audit all by access

and I set my audit_trail to the OS.  

I am I am getting is the following:  

Wed Apr 15 14:54:17 2009
ACTION : 'CONNECT'
DATABASE USER: '/'
PRIVILEGE : SYSDBA
CLIENT USER: oracle
CLIENT TERMINAL:
STATUS: 0     The session does not appear to do anything. I would think audit all by access would catch this. To test it, I logged in as / as sysdba and shutdown the database. my actions were logged.  

We do not have kron jobs running. anyone experience this before ? anything about solaris? could it be an oracle process logging in?

--
http://www.freelists.org/webpage/oracle-l

Received on Wed Apr 15 2009 - 14:32:32 CDT