Re: audit insert, delete, update on sys.aud$

<premmehrotra_at_hotmail.com> wrote in message news:1112296106.249082.240780_at_l41g2000cwc.googlegroups.com...
>I am using Oracle 8.1.6.2 32 bit on HP UNIX 11.
>
> I want to audit insert, delete, update on sys.aud$ by anyone other than
> sys (I know sys actions are not written in audit trail).
>
> I run following statement:
>
> audit delete, insert, update on sys.aud$ by session
>
> I verify that object auditing has been turned on:
> SYS AUD$ TABLE
> -/- -/-
> -/- S/S -/- -/- S/S -/- -/- -/- S/S -/- -/- -/- -/- -/-
>
>
> When I run a test for insert, update and delete, I only see audit
> records in sys.aud$ created for update and delete and not for insert:
>
> PREMDBA SYS AUD$ SESSION REC UPDATE ANY TABLE
> 0 ----------S----- 03/31/2005 13:46:29
> PREMDBA SYS AUD$ SESSION REC DELETE ANY TABLE
> 0 ---S------------ 03/31/2005 13:46:29
>
> I have tried similar audit tests on tables in my own schema and
> insert is audited there.
>
> I wonder whether there is anything subtle with insert of sys.aud$.
>
> Prem
>

You want to audit the auditing tables ? Funny ;-) Received on Fri Apr 01 2005 - 12:15:07 CST