userhost of unified_audit_trail shown as cryptic string

From: Yong Huang <"Yong>
Date: Thu, 26 Apr 2018 13:55:47 +0000 (UTC)
Message-ID: <>


Column userhost of unified_audit_trail sometimes shows strange values for some client hosts, e.g. the first one below  

SQL> select os_username, userhost, event_timestamp, return_code, authentication_type   2 from unified_audit_trail
  3 where event_timestamp > sysdate - 1/1440 and action_name='LOGON'   4 order by 3;

OS_USERNAME          USERHOST                            EVENT_TIMESTAMP                RETURN_CODE
-------------------- ----------------------------------- ------------------------------ -----------
root                 8621ecdafb91                        26-APR-18 AM             0

novlua               dosrlidmig1                         26-APR-18 AM             0



I can find the actual client from the IP address shown in the authentication_type string. In this case, IP is reverse resolved to dcsrlcs2 plus our domain name. But what is the string under userhost? That value is not the MAC address of the host (86-21-ec is not a vendor code), not host ID (Linux host ID is 4 bytes instead of 6), not ASCII values of part of the host name (ec maps to a non-ASCII character). So what is it? We don't have this problem in 11g, and this only happens to certain hosts connecting to 12c.

Yong Huang

Received on Thu Apr 26 2018 - 15:55:47 CEST

Original text of this message