Re: audit messages

From: Wolf <wolf_at_mrsoxx.com>
Date: Sat, 1 Jan 2000 14:07:41 -0500
Message-ID: <posb4.7033$zp.105284@news3.mia>

Though there is no option to turn auditing off in this case, you can use the audit_file_dest setting in the init.ora parameter file to have the audit files written to an alternate location (e.g., /ora01/oracle/admin/<ORACLE_SID>/audit).

A UNIX cron job can be used to automatically clean up the audit_file_dest directory on a periodic basis. I suggest using the find command with an mtime arugment as in the following script:

#!/usr/bin/ksh
# cln_aud.sh
# usage: cln_aud.sh <ORACLE_SID>
# assumes ops$ login
##################################################

DB=$1
ORATAB=/var/opt/oracle/oratab
IFS=:
line=$(grep -i "^$DB" ${ORATAB})
set $line

export ORACLE_SID=$1
export ORACLE_HOME=$2
export ORACLE_BASE=$(cd ${ORACLE_HOME}/../.. ; pwd)

oraup=$(ps -ef | grep -v grep | grep ora_lgwr_${ORACLE_SID} | wc -l) if [ "$oraup" = 0 ]
then
echo "Oracle not running"
exit 99
fi

export tmpsql=${ORACLE_BASE}/admin/dba/tmp/cln_aud_$ORACLE_SID.sql
> ${tmpsql}

echo "set pages 0" >> ${tmpsql}
echo "set feedback off" >> ${tmpsql}
echo "set trimspool on" >> ${tmpsql}
echo "select value from v\$parameter where name = 'audit_file_dest';" >>

${tmpsql}
echo "exit" >> ${tmpsql}

export AUDDEST=$(sqlplus -s / @${tmpsql}) cd ${AUDDEST}

if ! [ $? = 0 ]
then
echo "AUDDEST bad argument"
exit 98
fi

find . -name '*.aud' -mtime +30 -exec rm {} \;

This will delete all files in the audit_file_dest directory greater than thirty days old. The script itself can be used in cron with a different entry for each database on the server as follows:

00 00 * * 0 /ora01/oracle/admin/dba/bin/cln_aud.sh ORAA
1>/ora01/oracle/admin/dba/log/cln_aud_ORAA.log 2>&1
00 00 * * 0 /ora01/oracle/admin/dba/bin/cln_aud.sh ORAB
1>/ora01/oracle/admin/dba/log/cln_aud_ORAB.log 2>&1
00 00 * * 0 /ora01/oracle/admin/dba/bin/cln_aud.sh ORAC
1>/ora01/oracle/admin/dba/log/cln_aud_ORAC.log 2>&1
----------------------------------------------------------------------------

Kenneth C Stahl <BlueSax_at_Unforgettable.com> wrote in message news:386A6E94.76725649_at_Unforgettable.com... > In my $ORACLE_HOME/rdbms/audit there is a *.aud file created every time I > use svrmgrl to "connect internal". Is there any way of turning this off? Received on Sat Jan 01 2000 - 13:07:41 CST