Content-class: urn:content-classes:message
MIME-Version: 1.0
Subject: RE: Oracle Auditing Recommendations
Date: Tue, 8 Aug 2006 15:01:06 -0500
Message-ID: <B39B7B7D8C8CEA419D0ED45FD7FA4C53017A5076@CWYMSX06.Corp.Acxiom.net>
Thread-Topic: Oracle Auditing Recommendations
From: "Wolfson Larry - lwolfs" <lawrence.wolfson@acxiom.com>
To: "Alex Gorbachev" <gorbyx@gmail.com>
Cc: <oracle-l@freelists.org>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 8bit
Sender: oracle-l-bounce@freelists.org
Errors-to: oracle-l-bounce@freelists.org
Precedence: normal
Reply-to: lawrence.wolfson@acxiom.com

Alex,
     Thanks a lot.  Probably should have had another thread,  just
forgot to change subject. 

Ran
 SELECT DISTINCT    USERNAME
       ,         OS_USERNAME, COUNT(*)
   FROM DBA_AUDIT_SESSION
   WHERE USERNAME IN ('XXX'
                     ,'yyy'
                     )
   GROUP BY    USERNAME
           ,OS_USERNAME
 ;

	and got what I wanted.   Can't seem to get userhost info.
Found jbdc connections coming in from app server as "oracle"
It's an older version of ARIBA and I don't know how the jbdc part works.
Rather see the app connections as something like "buyerX" 

-----Original Message-----
From: Alex Gorbachev [mailto:gorbyx@gmail.com] 
Sent: Tuesday, August 08, 2006 3:19 AM
To: Wolfson Larry - lwolfs
Cc: oracle-l@freelists.org
Subject: Re: Oracle Auditing Recommendations

You should have a look at DBA_AUDIT_SESSION. Obviously, AUDIT_TRAIL must
be set to DB.


2006/8/7, Wolfson Larry - lwolfs <lawrence.wolfson@acxiom.com>:
>         I looked at AUD$ thinking I'd see the osusers/servers and see 
> if any weren't coming from valid osusers/servers.  But all I saw was 
> userhost and that not populated.


--
Best regards,
Alex Gorbachev

http://blog.oracloid.com
*************************************************************************
The information contained in this communication is confidential, is
intended only for the use of the recipient named above, and may be
legally privileged.

If the reader of this message is not the intended recipient, you are 
hereby notified that any dissemination, distribution or copying of this
communication is strictly prohibited.

If you have received this communication in error, please resend this
communication to the sender and delete the original message or any copy
of it from your computer system.

Thank you.
*************************************************************************
--
http://www.freelists.org/webpage/oracle-l