RE: AUD$ TIMESTAMP and LOGOFF_TIME are equal
Date: Tue, 29 Dec 2009 17:08:57 -0600
Message-ID: <7ED53A68952D3B4C9540B4EFA5C76E3607247B6B_at_CWYMSX04.Corp.Acxiom.net>
Well, at least I was partially correct - "... way off on this ...".
Is there any consistency of the audit rows where TIMESTAMP = LOGOFF_TIME? In other words, is it always the same user? Do they all have the same ACTION_NAME? Is INSTANCE_NUMBER correct (I don't have a RAC to test this on)?
Dave Herring | DBA, Acxiom Database Services
630-944-4762 office | 630-430-5988 cell | 630-944-4989 fax 1501 Opus Pl | Downers Grove, IL, 60515 | U.S.A. | www.acxiom.com Service Desk: 888-243.4566
From: Jared Still [mailto:jkstill_at_gmail.com] Sent: Tuesday, December 29, 2009 11:18 AM To: Herring Dave - dherri
Cc: ric.van.dyke_at_hotsos.com; Oracle L Subject: Re: AUD$ TIMESTAMP and LOGOFF_TIME are equal
On Tue, Dec 29, 2009 at 7:41 AM, Herring Dave - dherri <Dave.Herring_at_acxiom.com> wrote: Maybe I'm way off on this, but for session auditing, isn't there just 1 row per session? So for the most part, if the session ends properly, TIMESTAMP and LOGOFF_TIME should be the same. If these dates aren't the same, then the session abnormally terminated in some way.
Dave, that has not been my experience.
Here's an example from 10.2.0.4
EXIT USERNAME LOGON TIME LOGOFF TIME OS_USERNAME TERMINAL ACTION_NAME CODE
---------- -------------------- -------------------- --------------- --------------- ---------------------------- ------
ABC 12/18/2008 09:21:22 12/18/2008 09:25:02 dr349816 TERMINAL1 LOGOFF 0 ABC 12/18/2008 09:24:40 12/18/2008 09:26:59 dhjkss TERMINAL2 LOGOFF 0 ABC 12/18/2008 09:25:20 12/18/2008 09:27:00 hjksse TERMINAL3 LOGOFF 0 ABC 12/18/2008 09:26:07 12/18/2008 12:13:21 dr349816 TERMINAL1 LOGOFF BY CLEANUP 0 ABC 12/18/2008 09:27:02 12/18/2008 11:27:02 dr349816 TERMINAL1 LOGOFF BY CLEANUP 0 ABC 12/18/2008 09:30:22 12/18/2008 10:45:03 dxydd TERMINAL4 LOGOFF 0 ABC 12/18/2008 09:39:36 12/18/2008 11:28:54 sp003928 TERMINAL6 LOGOFF 0 ABC 12/18/2008 09:50:03 12/18/2008 17:08:28 xkimmerd XKIMMERD LOGOFF 0
Jared Still
Certifiable Oracle DBA and Part Time Perl Evangelist
Oracle Blog: http://jkstill.blogspot.com
Home Page: http://jaredstill.com
The information contained in this communication is confidential, is intended only for the use of the recipient named above, and may be legally privileged.
If the reader of this message is not the intended recipient, you are hereby notified that any dissemination, distribution or copying of this communication is strictly prohibited.
If you have received this communication in error, please resend this communication to the sender and delete the original message or any copy of it from your computer system.
Thank You.
--
http://www.freelists.org/webpage/oracle-l
Received on Tue Dec 29 2009 - 17:08:57 CST