Re: constant logging in as / as sysdba ?

From: Stefan Knecht <knecht.stefan_at_gmail.com>
Date: Thu, 16 Apr 2009 00:28:50 +0200
Message-ID: <486b2b610904151528t387ab224jd005a6e0eefe5440_at_mail.gmail.com>

The reason why you're not seeing anything in your audit files is because SYS is exempt from the "audit_trail" parameters functionality scope. You need to set audit_sys_operations to true. Then you'll see what's going on in those sessions.

Cheers

---

Stefan P Knecht
CEO & Founder
s_at_10046.ch

10046 Consulting GmbH
Schwarzackerstrasse 29
CH-8304 Wallisellen
Switzerland

Phone +41-(0)8400-10046
Cell +41 (0) 79 571 36 27
info_at_10046.ch
http://www.10046.ch

---

On Wed, Apr 15, 2009 at 8:56 PM, Dba DBA <oracledbaquestions_at_gmail.com>wrote:

> I am trying to figure out what is logging in constantly as / as sysdba. We
> are on Solaris iwth Oracle 10.1. We are using Solaris clustering(this is OS
> clustering and not RAC). However, I turned the cluster off and then turned
> Oracle on manually. The / as sysdba connection continues to happen every
> minute.
>
> By default Oracle logs all / as sysdba connections. I then increased my
> auditing to try to find out what is going on.
>
> So I did
>
> audit all by access
> and I set my audit_trail to the OS.
>
> I am I am getting is the following:
>
> Wed Apr 15 14:54:17 2009
> ACTION : 'CONNECT'
> DATABASE USER: '/'
> PRIVILEGE : SYSDBA
> CLIENT USER: oracle
> CLIENT TERMINAL:
> STATUS: 0
>
>
> The session does not appear to do anything. I would think audit all by
> access would catch this. To test it, I logged in as / as sysdba and shutdown
> the database. my actions were logged.
>
> We do not have kron jobs running. anyone experience this before ? anything
> about solaris? could it be an oracle process logging in?
>

--
http://www.freelists.org/webpage/oracle-l

Received on Wed Apr 15 2009 - 17:28:50 CDT