Oracle 8.1.7.2
Solaris

I got a lovely ORA-1031 error message in my alert.log this morning stating:
Code:
Tue Feb 12 07:28:21 2002
ALTER DATABASE RECOVER    
Tue Feb 12 07:28:21 2002
ORA-1031 signalled during: ALTER DATABASE RECOVER    ...
None of my DBA's have owned up to issuing this command nor have any of the users. Obviously, the user didn't know what they were doing, and Oracle handled it correctly, but I still want to know WHO did it.

I looked at the alert.log, listener.log, backup logs and other OS logs without any concrete proof. I can't use Logminer as this is a DDL command and I'm only on 8.1.7.2. I'm not running auditing on this database.

Any suggestions?