Home » SQL & PL/SQL » SQL & PL/SQL » disable Oracle 11 audit (.aud)
disable Oracle 11 audit (.aud) [message #556097] Thu, 31 May 2012 05:28 Go to next message
Shamall
Messages: 12
Registered: May 2012
Junior Member
Hi List,

is it possible to disable audit logging (audit_file)?
(Ora 11)

Best,
Mike
Re: disable Oracle 11 audit (.aud) [message #556099 is a reply to message #556097] Thu, 31 May 2012 05:30 Go to previous messageGo to next message
Michel Cadot
Messages: 68767
Registered: March 2007
Location: Saint-Maur, France, https...
Senior Member
Account Moderator
You cannot disable audit of SYS connections.
Apart from that you can disable everything.
Have a look at "show parameter audit".

Regards
Michel
Re: disable Oracle 11 audit (.aud) [message #556102 is a reply to message #556099] Thu, 31 May 2012 05:37 Go to previous messageGo to next message
Shamall
Messages: 12
Registered: May 2012
Junior Member
yes

SQL> show parameter audit

NAME                                 TYPE        VALUE
------------------------------------ ----------- ------------------------------
audit_file_dest                      string      /u01/app/oracle/admin/XE/adump
audit_sys_operations                 boolean     FALSE
audit_syslog_level                   string
audit_trail                          string      NONE

Re: disable Oracle 11 audit (.aud) [message #556104 is a reply to message #556102] Thu, 31 May 2012 05:38 Go to previous messageGo to next message
Michel Cadot
Messages: 68767
Registered: March 2007
Location: Saint-Maur, France, https...
Senior Member
Account Moderator
So your aud files only contain the sys/sysdba connections which is the minimal auditing.

Regards
Michel
Re: disable Oracle 11 audit (.aud) [message #556108 is a reply to message #556097] Thu, 31 May 2012 05:48 Go to previous messageGo to next message
John Watson
Messages: 8988
Registered: January 2010
Location: Global Village
Senior Member
We have a cusomter whose sys.aud$ table had grown to 6G, in the system tablespace, because of the 11g efault audits. They were not aware that the auditing was happening. This will show you the audits:
select privilege from dba_priv_audit_opts;
and disable them with
noaudit .....
Re: disable Oracle 11 audit (.aud) [message #556109 is a reply to message #556108] Thu, 31 May 2012 06:09 Go to previous messageGo to next message
Michel Cadot
Messages: 68767
Registered: March 2007
Location: Saint-Maur, France, https...
Senior Member
Account Moderator
But his audit_trail parameter is set to NONE, so all audits are disabled.

Regards
Michel
Re: disable Oracle 11 audit (.aud) [message #556110 is a reply to message #556108] Thu, 31 May 2012 06:10 Go to previous messageGo to next message
Shamall
Messages: 12
Registered: May 2012
Junior Member
noaudit create .... ? did not work here Sad
Seems that minimal auditing can not be disabled.

What about: audit_file_dest=/dev/null Cool

[Updated on: Thu, 31 May 2012 06:14]

Report message to a moderator

Re: disable Oracle 11 audit (.aud) [message #556114 is a reply to message #556110] Thu, 31 May 2012 06:31 Go to previous messageGo to next message
Michel Cadot
Messages: 68767
Registered: March 2007
Location: Saint-Maur, France, https...
Senior Member
Account Moderator
Try it!

Regards
Michel
Re: disable Oracle 11 audit (.aud) [message #556115 is a reply to message #556114] Thu, 31 May 2012 06:32 Go to previous messageGo to next message
Shamall
Messages: 12
Registered: May 2012
Junior Member
Problem solved, tnx.
Re: disable Oracle 11 audit (.aud) [message #556117 is a reply to message #556115] Thu, 31 May 2012 06:34 Go to previous messageGo to next message
Michel Cadot
Messages: 68767
Registered: March 2007
Location: Saint-Maur, France, https...
Senior Member
Account Moderator
With /dev/null?

Regards
Michel
Re: disable Oracle 11 audit (.aud) [message #556122 is a reply to message #556117] Thu, 31 May 2012 07:32 Go to previous messageGo to next message
Shamall
Messages: 12
Registered: May 2012
Junior Member
... not really, because the db don´t start anymore
Could not open audit file: /dev/null/xe_ora
Re: disable Oracle 11 audit (.aud) [message #556125 is a reply to message #556122] Thu, 31 May 2012 07:49 Go to previous messageGo to next message
Michel Cadot
Messages: 68767
Registered: March 2007
Location: Saint-Maur, France, https...
Senior Member
Account Moderator
This is what I thought.
You cannot redirect to a device, you must point to a directory/file system.
So use a cron job and remove the files every minute if you REALLY don't want them but they are there to protect you.

Regards
Michel
Re: disable Oracle 11 audit (.aud) [message #556128 is a reply to message #556125] Thu, 31 May 2012 07:51 Go to previous messageGo to next message
BlackSwan
Messages: 26766
Registered: January 2009
Location: SoCal
Senior Member
>Could not open audit file: /dev/null/xe_ora
/tmp is writable by every process.
Re: disable Oracle 11 audit (.aud) [message #556133 is a reply to message #556128] Thu, 31 May 2012 07:57 Go to previous messageGo to next message
Shamall
Messages: 12
Registered: May 2012
Junior Member
but I am not able to set audit_file_dest back to /tmp or something else
Re: disable Oracle 11 audit (.aud) [message #556135 is a reply to message #556133] Thu, 31 May 2012 08:04 Go to previous messageGo to next message
BlackSwan
Messages: 26766
Registered: January 2009
Location: SoCal
Senior Member
>but I am not able to set audit_file_dest back to /tmp or something else


Please read and follow the forum guidelines, to enable us to help you:

http://www.orafaq.com/forum/t/88153/0/


my car won't go.
tell me how to make my car go.
Re: disable Oracle 11 audit (.aud) [message #556141 is a reply to message #556135] Thu, 31 May 2012 08:10 Go to previous messageGo to next message
Shamall
Messages: 12
Registered: May 2012
Junior Member
when I start oracle the log file still shows:
Could not open audit file: /dev/null/xe_ora_4457_1.aud
Retry Iteration No: 1   OS Error: 20
Retry Iteration No: 2   OS Error: 20
Retry Iteration No: 3   OS Error: 20
Retry Iteration No: 4   OS Error: 20
Retry Iteration No: 5   OS Error: 20
OS Audit file could not be created; failing after 5 retries


that´s all. I just have to change from /dev/null back to the old path, but how ....
there is no init.ora in admin/XE/dbs

[Updated on: Thu, 31 May 2012 08:11]

Report message to a moderator

Re: disable Oracle 11 audit (.aud) [message #556143 is a reply to message #556141] Thu, 31 May 2012 08:13 Go to previous messageGo to next message
BlackSwan
Messages: 26766
Registered: January 2009
Location: SoCal
Senior Member
post results from following OS command (as below)

ls -ltr $ORACLE_HOME/dbs

bcm@bcm-laptop:~$ ls -ltr $OH/dbs
total 9712
-rw-r--r-- 1 oracle dba    2851 2009-05-15 14:35 init.ora
-rw-r----- 1 oracle dba      24 2010-05-07 11:17 lkV112
-rw-r----- 1 oracle dba 9912320 2010-05-20 18:33 snapcf_v112.f
-rw-rw---- 1 oracle dba    1544 2010-06-09 08:31 hc_DBUA0.dat
-rw-r--r-- 1 oracle dba    1075 2011-09-10 19:18 init_110910.ora
-rw-r--r-- 1 oracle dba       0 2011-09-26 17:50 Alter
-rw-r----- 1 oracle dba    2048 2012-05-09 14:11 orapwv112
-rw-r--r-- 1 oracle dba    1038 2012-05-30 21:47 initv112.ora
-rw-r----- 1 oracle dba    3584 2012-05-31 05:45 spfilev112.ora
-rw-rw---- 1 oracle dba    1544 2012-05-31 05:45 hc_v112.dat
bcm@bcm-laptop:~$ 

Re: disable Oracle 11 audit (.aud) [message #556144 is a reply to message #556141] Thu, 31 May 2012 08:16 Go to previous messageGo to next message
Michel Cadot
Messages: 68767
Registered: March 2007
Location: Saint-Maur, France, https...
Senior Member
Account Moderator
You have not to start/open the database, you can change the parameter in nomount mode.

Regards
Michel
Re: disable Oracle 11 audit (.aud) [message #556151 is a reply to message #556144] Thu, 31 May 2012 08:45 Go to previous messageGo to next message
Shamall
Messages: 12
Registered: May 2012
Junior Member
my env is only:
USER=oracle
MAIL=/var/spool/mail/oracle
PWD=/u01/app/oracle
HOME=/u01/app/oracle
LOGNAME=oracle


p.s. user root / ORACLE_HOME=/u01/app/oracle/product/11.2.0/xe

while changing the parameter the db was not running. Now I have restored my backup and the db is running again. But I still don´t know which init.ora I a´m using.

[Updated on: Thu, 31 May 2012 08:47]

Report message to a moderator

Re: disable Oracle 11 audit (.aud) [message #556152 is a reply to message #556151] Thu, 31 May 2012 08:49 Go to previous messageGo to next message
BlackSwan
Messages: 26766
Registered: January 2009
Location: SoCal
Senior Member
Please read and follow the forum guidelines, to enable us to help you:

http://www.orafaq.com/forum/t/88153/0/


I don't know what you have.
I don't know what you do.
I don't know what you see.
It is really, Really, REALLY difficult to fix a problem that can not be seen.
use COPY & PASTE so we can see what you do & how Oracle responds.
Re: disable Oracle 11 audit (.aud) [message #556157 is a reply to message #556152] Thu, 31 May 2012 09:12 Go to previous messageGo to next message
Shamall
Messages: 12
Registered: May 2012
Junior Member
funny, but dit not help; I think you did not read my question
tnx to Michel
case is closed

[Updated on: Thu, 31 May 2012 09:15]

Report message to a moderator

Re: disable Oracle 11 audit (.aud) [message #556158 is a reply to message #556099] Thu, 31 May 2012 09:32 Go to previous messageGo to next message
Solomon Yakobson
Messages: 3305
Registered: January 2010
Location: Connecticut, USA
Senior Member
Michel Cadot wrote on Thu, 31 May 2012 06:30
You cannot disable audit of SYS connections.


audit_sys_operations = FALSE

SY.
Re: disable Oracle 11 audit (.aud) [message #556159 is a reply to message #556158] Thu, 31 May 2012 10:09 Go to previous messageGo to next message
Michel Cadot
Messages: 68767
Registered: March 2007
Location: Saint-Maur, France, https...
Senior Member
Account Moderator
No, this does not disable SYS connections audit, only SYS session operations audit.

Regards
Michel
Re: disable Oracle 11 audit (.aud) [message #556161 is a reply to message #556159] Thu, 31 May 2012 11:21 Go to previous messageGo to next message
Solomon Yakobson
Messages: 3305
Registered: January 2010
Location: Connecticut, USA
Senior Member
So what do you mean by sys connection audit?

SY.

[Updated on: Thu, 31 May 2012 11:28]

Report message to a moderator

Re: disable Oracle 11 audit (.aud) [message #556162 is a reply to message #556161] Thu, 31 May 2012 11:36 Go to previous messageGo to next message
Michel Cadot
Messages: 68767
Registered: March 2007
Location: Saint-Maur, France, https...
Senior Member
Account Moderator
Connect / as sysdba


Regards
Michel
Re: disable Oracle 11 audit (.aud) [message #556165 is a reply to message #556162] Thu, 31 May 2012 11:55 Go to previous messageGo to next message
Solomon Yakobson
Messages: 3305
Registered: January 2010
Location: Connecticut, USA
Senior Member
I understand that. Where this will be audited? What file/table? For example, on Windows (XP) nothing gets written to EventLog if audit_sys_operations = FALSE

SY.
Re: disable Oracle 11 audit (.aud) [message #556168 is a reply to message #556165] Thu, 31 May 2012 12:19 Go to previous messageGo to next message
Michel Cadot
Messages: 68767
Registered: March 2007
Location: Saint-Maur, France, https...
Senior Member
Account Moderator
In file or syslog depending on the OS.

In windows XP it is in event log, section "application".
I just connected on 11.2 and 10.2 databases and I got the following events (terminal is removed for confidentiality).
/forum/fa/10205/0/
/forum/fa/10206/0/

On Unix, we have it in files in adump directory.

Regards
Michel

Edit: Check if you have not some key in registry that prevent from this, I know they are some undocumented parameters on Windows.

  • Attachment: OraFAQ112.JPG
    (Size: 34.04KB, Downloaded 4466 times)
  • Attachment: OraFAQ102.JPG
    (Size: 32.95KB, Downloaded 4482 times)

[Updated on: Thu, 31 May 2012 12:21]

Report message to a moderator

Re: disable Oracle 11 audit (.aud) [message #556176 is a reply to message #556168] Thu, 31 May 2012 12:48 Go to previous message
Solomon Yakobson
Messages: 3305
Registered: January 2010
Location: Connecticut, USA
Senior Member
Yeap, you are right, I was able to reproduce it. Learned something new today. Thanks.

SY.
Previous Topic: Select query in database
Next Topic: How To use a Grouping query (2 Merged)
Goto Forum:
  


Current Time: Thu Aug 28 05:34:32 CDT 2025