Re: Lots of Oracle10g Audit Log Files, Created every one or two second(s)

This looks like it is is a connect / as sysdba which is always audited. I think that kind of connect can only come from the Linux database server. You might be able to identify the Linux process by listing all processes owned by oracle and trying to match it with the pid in the .aud file. In HPUX, this is
ps -ef|grep oracle

HTH,
Andy Young

haiwu.us_at_gmail.com wrote in news:1176503310.079589.89440 @w1g2000hsg.googlegroups.com:

> This is Oracle10g RAC, and there are lots of audit log files created
> by default under $ORACLE_HOME/rdbms/audit folder, they got created
> every one or two second(s) on each node, for each database instance
> running on this RAC.
>
> The following is one entry. As you can see, it does not have "CLIENT
> TERMINAL" information, and I don't know how to track this to find out
> which processes or application or background process is causing this
> sys login, so frequently.
>
> Any ideas?
> Thanks,
> Hai
>
> Audit file /home/oracle/app/product/10.1.0.4/rdbms/audit/ora_17242.aud
> Oracle Database 10g Enterprise Edition Release 10.1.0.4.2 - Production
> With the Partitioning, Real Application Clusters, OLAP and Data Mining
> options
> ORACLE_HOME = /home/oracle/app/product/10.1.0.4
> System name: Linux
> Node name: wpprddb1
> Release: 2.4.21-37.ELsmp
> Version: #1 SMP Wed Sep 7 13:28:55 EDT 2005
> Machine: i686
> Instance name: oid1
> Redo thread mounted by this instance: 1
> Oracle process number: 26
> Unix process pid: 17242, image: oracle_at_wpprddb1 (TNS V1-V3)
>
> Fri Apr 13 17:25:06 2007
> ACTION : 'CONNECT'
> DATABASE USER: '/'
> PRIVILEGE : SYSDBA
> CLIENT USER: oracle
> CLIENT TERMINAL:
> STATUS: 0
>
Received on Mon Apr 16 2007 - 00:31:17 CDT