On Apr 14, 3:32 pm, DA Morgan <damor..._at_psoug.org> wrote:
> haiwu..._at_gmail.com wrote:
> > On Apr 13, 10:29 pm, DA Morgan <damor..._at_psoug.org> wrote:
> >> haiwu..._at_gmail.com wrote:
> >>> This is Oracle10g RAC, and there are lots of audit log files created
> >>> by default under $ORACLE_HOME/rdbms/audit folder, they got created
> >>> every one or two second(s) on each node, for each database instance
> >>> running on this RAC.
> >>> The following is one entry. As you can see, it does not have "CLIENT
> >>> TERMINAL" information, and I don't know how to track this to find out
> >>> which processes or application or background process is causing this
> >>> sys login, so frequently.
> >>> Any ideas?
> >>> Thanks,
> >>> Hai
> >>> Audit file /home/oracle/app/product/10.1.0.4/rdbms/audit/ora_17242.aud
> >>> Oracle Database 10g Enterprise Edition Release 10.1.0.4.2 - Production
> >>> With the Partitioning, Real Application Clusters, OLAP and Data Mining
> >>> options
> >>> ORACLE_HOME = /home/oracle/app/product/10.1.0.4
> >>> System name: Linux
> >>> Node name: wpprddb1
> >>> Release: 2.4.21-37.ELsmp
> >>> Version: #1 SMP Wed Sep 7 13:28:55 EDT 2005
> >>> Machine: i686
> >>> Instance name: oid1
> >>> Redo thread mounted by this instance: 1
> >>> Oracle process number: 26
> >>> Unix process pid: 17242, image: oracle_at_wpprddb1 (TNS V1-V3)
> >>> Fri Apr 13 17:25:06 2007
> >>> ACTION : 'CONNECT'
> >>> DATABASE USER: '/'
> >>> PRIVILEGE : SYSDBA
> >>> CLIENT USER: oracle
> >>> CLIENT TERMINAL:
> >>> STATUS: 0
> >> SELECT name, value
> >> FROM gv$parameter
> >> WHERE name LIKE '%audit%';
>
> >> What are you auditing and how?
> >> --
> >> Daniel A. Morgan
> >> University of Washington
> >> damor..._at_x.washington.edu
> >> (replace x with u to respond)
> >> Puget Sound Oracle Users Groupwww.psoug.org
>
> > Even if not enabling audit_trail, Oracle by default will write sysdba
> > logon information to ~/rdbms/audit folder. The following are the
> > outputs:
>
> > audit_sys_operations FALSE
> > audit_file_dest /home/oracle/app/product/10.1.0.4/
> > rdbms/audit
> > audit_trail NONE
> > audit_sys_operations FALSE
> > audit_file_dest /home/oracle/app/product/10.1.0.4/
> > rdbms/audit
> > audit_trail NONE
> > audit_sys_operations FALSE
> > audit_file_dest /home/oracle/app/product/10.1.0.4/
> > rdbms/audit
> > audit_trail NONE
> > audit_sys_operations FALSE
> > audit_file_dest /home/oracle/app/product/10.1.0.4/
> > rdbms/audit
>
> > NAME VALUE
> > -----------------------------------
> > --------------------------------------------------------------------------------
> > audit_trail NONE
> > audit_sys_operations FALSE
> > audit_file_dest /home/oracle/app/product/10.1.0.4/
> > rdbms/audit
> > audit_trail NONE
>
> > 15 rows selected.
>
> > Thanks,
> > Hai
>
> I see no evidence of auditing here. So how has the auditing been
> implemented?
> --
> Daniel A. Morgan
> University of Washington
> damor..._at_x.washington.edu
> (replace x with u to respond)
> Puget Sound Oracle Users Groupwww.psoug.org- Hide quoted text -
>
> - Show quoted text -
According to Oracle doc, these audits are implemented by default.
Received on Thu Apr 19 2007 - 18:20:58 CDT
