On Apr 13, 6:28 pm, haiwu..._at_gmail.com wrote:
> This is Oracle10g RAC, and there are lots of audit log files created
> by default under $ORACLE_HOME/rdbms/audit folder, they got created
> every one or two second(s) on each node, for each database instance
> running on this RAC.
>
> The following is one entry. As you can see, it does not have "CLIENT
> TERMINAL" information, and I don't know how to track this to find out
> which processes or application or background process is causing this
> sys login, so frequently.
>
> Any ideas?
> Thanks,
> Hai
>
> Audit file /home/oracle/app/product/10.1.0.4/rdbms/audit/ora_17242.aud
> Oracle Database 10g Enterprise Edition Release 10.1.0.4.2 - Production
> With the Partitioning, Real Application Clusters, OLAP and Data Mining
> options
> ORACLE_HOME = /home/oracle/app/product/10.1.0.4
> System name: Linux
> Node name: wpprddb1
> Release: 2.4.21-37.ELsmp
> Version: #1 SMP Wed Sep 7 13:28:55 EDT 2005
> Machine: i686
> Instance name: oid1
> Redo thread mounted by this instance: 1
> Oracle process number: 26
> Unix process pid: 17242, image: oracle_at_wpprddb1 (TNS V1-V3)
>
> Fri Apr 13 17:25:06 2007
> ACTION : 'CONNECT'
> DATABASE USER: '/'
> PRIVILEGE : SYSDBA
> CLIENT USER: oracle
> CLIENT TERMINAL:
> STATUS: 0
You could create an after logon database trigger and get some
additional info from that trigger. Enable it briefly to get the info
you need then disable it promptly.
Received on Sat Apr 14 2007 - 19:22:20 CDT
