SYS.AUD$ USERHOST column all NULL?

I am trying to create a report that will identify inappropriate access against SYS.AUD$ across many databases. In order to do this I am reporting on any access except SELECT and DELETE (where the delete originates from a known job used to maintain the audit table).

To determine if the delete originates from the known job used to maintain the audit table, I am using a selection criteria including columns OS_USERNAME, USERNAME and USERHOST. This works fine in most cases except that, for a handful of 9i databases, I have noticed that USERHOST is always NULL which breaks my strategy...

SQL> select version from v$instance;

VERSION

SQL> select count(*) from sys.aud$;

  COUNT(*)

     54229

SQL> select count(*) from sys.aud$ where userhost is null;

  COUNT(*)

     54229

This is on Solaris 9. I checked MOS and google but did not get any hits. This is occurring for about 10 databases that are all 9.2.0.6, 9.2.0.7, 9.2.0.8. Has anyone seen this behavior? Any fix?

Thanks,
Ken.
--

http://www.freelists.org/webpage/oracle-l Received on Mon Apr 16 2012 - 10:09:08 CDT