Re: audit insert, delete, update on sys.aud$

>You want to audit the auditing tables ? Funny ;-)
>

Hi,

I wouldn't have said funny, I have seen sites where the audit trail has been deliberately altered, updates, deletes, insertions, to try and hide what the user was actually doing.

It is useful to audit SYS.AUD$ for changes.

kind regards

Pete

-- 
Pete Finnigan (email:pete_at_petefinnigan.com)
Web site: http://www.petefinnigan.com - Oracle security audit specialists
Oracle security blog: http://www.petefinnigan.com/weblog/entries/index.html
Book:Oracle security step-by-step Guide - see http://store.sans.org for details.