Re: Deleting from sys.aud$

From: Mark D Powell <Mark.Powell2_at_hp.com>
Date: Wed, 23 Dec 2009 12:49:59 -0800 (PST)
Message-ID: <a723c97e-8172-469a-8dd7-50087320d2d8_at_a32g2000yqm.googlegroups.com>

On Dec 23, 11:13 am, GaryA <garyi..._at_yahoo.com> wrote:
> Hoping someone can explain why I am running into the issue seen
> below.  I do a select count(*) from sys.aud$ and get one number, but
> when I do a delete using the same where condition I get a
> substantially different number of records to be deleted.
>
> *******************************
> SQL> select count(*) from sys.aud$ where userid = 'MIKE1';
>
>   COUNT(*)
> ----------
>      33570
>
> SQL> delete from sys.aud$ where userid = 'MIKE1';
>
> 2 rows deleted.
>
> SQL> rollback work;
>
> Rollback complete.
>
> SQL> select count(*) from sys.aud$;
>
>   COUNT(*)
> ----------
>     147042
>
> SQL> delete from sys.aud$;
>
> 12154 rows deleted.
>
> SQL> rollback work;
>
> Rollback complete.
> *******************************
>
> Can anyone offer a reason as to why I am seeing such differing
> results?
>
> Thank you.
> Gary

Who are you connected as? Do you have sys auditing turned on? Do you have extended auditing turned on?

Did you query the dba_audit_trail to see if new audit rows were inserted because of your action to see what information these rows may show?

Post your audit rules.

HTH -- Mark D Powell -- Received on Wed Dec 23 2009 - 14:49:59 CST