haiwu.us_at_gmail.com wrote:
> On Apr 13, 10:29 pm, DA Morgan <damor..._at_psoug.org> wrote:
>> haiwu..._at_gmail.com wrote:
>>> This is Oracle10g RAC, and there are lots of audit log files created
>>> by default under $ORACLE_HOME/rdbms/audit folder, they got created
>>> every one or two second(s) on each node, for each database instance
>>> running on this RAC.
>>> The following is one entry. As you can see, it does not have "CLIENT
>>> TERMINAL" information, and I don't know how to track this to find out
>>> which processes or application or background process is causing this
>>> sys login, so frequently.
>>> Any ideas?
>>> Thanks,
>>> Hai
>>> Audit file /home/oracle/app/product/10.1.0.4/rdbms/audit/ora_17242.aud
>>> Oracle Database 10g Enterprise Edition Release 10.1.0.4.2 - Production
>>> With the Partitioning, Real Application Clusters, OLAP and Data Mining
>>> options
>>> ORACLE_HOME = /home/oracle/app/product/10.1.0.4
>>> System name: Linux
>>> Node name: wpprddb1
>>> Release: 2.4.21-37.ELsmp
>>> Version: #1 SMP Wed Sep 7 13:28:55 EDT 2005
>>> Machine: i686
>>> Instance name: oid1
>>> Redo thread mounted by this instance: 1
>>> Oracle process number: 26
>>> Unix process pid: 17242, image: oracle_at_wpprddb1 (TNS V1-V3)
>>> Fri Apr 13 17:25:06 2007
>>> ACTION : 'CONNECT'
>>> DATABASE USER: '/'
>>> PRIVILEGE : SYSDBA
>>> CLIENT USER: oracle
>>> CLIENT TERMINAL:
>>> STATUS: 0
>> SELECT name, value
>> FROM gv$parameter
>> WHERE name LIKE '%audit%';
>>
>> What are you auditing and how?
>> --
>> Daniel A. Morgan
>> University of Washington
>> damor..._at_x.washington.edu
>> (replace x with u to respond)
>> Puget Sound Oracle Users Groupwww.psoug.org
>
> Even if not enabling audit_trail, Oracle by default will write sysdba
> logon information to ~/rdbms/audit folder. The following are the
> outputs:
>
> audit_sys_operations FALSE
> audit_file_dest /home/oracle/app/product/10.1.0.4/
> rdbms/audit
> audit_trail NONE
> audit_sys_operations FALSE
> audit_file_dest /home/oracle/app/product/10.1.0.4/
> rdbms/audit
> audit_trail NONE
> audit_sys_operations FALSE
> audit_file_dest /home/oracle/app/product/10.1.0.4/
> rdbms/audit
> audit_trail NONE
> audit_sys_operations FALSE
> audit_file_dest /home/oracle/app/product/10.1.0.4/
> rdbms/audit
>
> NAME VALUE
> -----------------------------------
> --------------------------------------------------------------------------------
> audit_trail NONE
> audit_sys_operations FALSE
> audit_file_dest /home/oracle/app/product/10.1.0.4/
> rdbms/audit
> audit_trail NONE
>
> 15 rows selected.
>
> Thanks,
> Hai
I see no evidence of auditing here. So how has the auditing been
implemented?
--
Daniel A. Morgan
University of Washington
damorgan_at_x.washington.edu
(replace x with u to respond)
Puget Sound Oracle Users Group
www.psoug.org
Received on Sat Apr 14 2007 - 15:32:07 CDT
