Re: Auditing question

Hi Rich

For your first point, yes if you configure the audit trail to be written to the database (SYS.AUD$) which you have done then attempts to create a table will be logged to the database and be viewable directly from sys.aud$ or one of the Oracle supplied views.

Your second point: If you set the parameter audit_sys_operations to true then actions done by someone connected as SYS or AS SYSDBA will be logged. previously this was not possible as this parameter was added for 9iR2. It is still not possible to log SYS actions to SYS.AUD$ and as such output will be written to an OS file whose location is pointed at by audit_file_dest. On windows output is written to the event log as i said in my last post.

yes, please do test it yourself, i like to check things out myself also as this is the best way to understand how something works!.

hth

kind regards

Pete

-- 
Pete Finnigan
email:pete_at_petefinnigan.com
Web site: http://www.petefinnigan.com - Oracle security audit specialists
Book:Oracle security step-by-step Guide - see http://store.sans.org for details.