Re: is it possible to see who dropped a DB link or would 9i do it on its own due to bug?

Hi

If you are in archivelog mode you could use LogMiner to look through the logs between 9am and 2pm for a delete from sys.link$. It may give you a clue as to when it disappeared and why. Also search the server and see if any errant scripts attempt to drop or re-create it, perhaps a script is left hanging around that was run by accident. Also check which users have privileges to create / drop database links. If audit session is on check who logged in. Check for access as privileged users in OS audit files (if Unix - event view for windows) in the directory pointed at by audit_file_dest.

There is an example of how to use Log Miner in a paper I wrote "detecting SQL injection on Oracle" - a link is on my white papers page http://www.petefinnigan.com/orasec.htm

hth

kind regards

Pete

-- 
Pete Finnigan
email:pete_at_petefinnigan.com
Web site: http://www.petefinnigan.com - Oracle security audit specialists
Book:Oracle security step-by-step Guide - see http://store.sans.org for details.