Re: How to get the user login history???

From: Pete Finnigan <pete_at_peterfinnigan.demon.co.uk>
Date: Tue, 4 Sep 2001 10:03:09 +0100
Message-ID: <nWTcNUANjJl7EwJB_at_peterfinnigan.demon.co.uk>


Hi

Just to point out, you have the choice of writing your audit trail to the database in the table sys.aud$ or to the OS. If you set audit_trail to OS then you should also set the init.ora parameter audit_trail_dest to a directory of your choice for an OS audit trail. It defaults to $ORACLE_HOME/rdbms/audit.

If you choose the DB option then you should move the SYS.AUD$ table from the SYSTEM tablespace so that you don't fragment the system tablespace and so that more importantly you don't fill the SYSTEM tablespace with audit records. If this happens then the database will hang.

hope this helps

Pete Finnigan
www.pentest-limited.com

In article <tp7n2ft9pcfq64_at_news.demon.nl>, Sybrand Bakker <postbus_at_sybrandb.demon.nl> writes
>
>"K.P, Ng" <kpng_at_sywg.com.hk> wrote in message
>news:9munhs$qrv4_at_imsp212.netvigator.com...
>> How can I get the user login history, since oracle instance shows the only
>> current login information.
>>
>> Pang
>>
>>
>
>Sigh no version again. It seems like crossposting to groups not supported by
>all providers (my provider doesn't support comp.databases.oracle) is
>definitely more easy than to type those 3 digits and 2 dots.
>
>The easiest solution, as it is already provided by Oracle, is to enable
>audit
>(init.ora parameter audit_trail has to be changed to 'db' instead of none,
>and the database bounced), after which an 'audit connect' will audit every
>individual connect and disconnect. The audit record is written on (normal)
>disconnect!
>In Oracle 8i you can use the on-logon trigger to develop your own audit
>system.
>
>Hth,
>
>Sybrand Bakker, Senior Oracle DBA
>
>
>
 

-- 
Pete Finnigan
IT Security Consultant
PenTest Limited

Office  01565 830 990
Fax     01565 830 889
Mobile  07974 087 885

pete.finnigan_at_pentest-limited.com

www.pentest-limited.com
Received on Tue Sep 04 2001 - 11:03:09 CEST

Original text of this message