-
Oracle 8.1.7.2
Solaris
I got a lovely ORA-1031 error message in my alert.log this morning stating:
Code:
Tue Feb 12 07:28:21 2002
ALTER DATABASE RECOVER
Tue Feb 12 07:28:21 2002
ORA-1031 signalled during: ALTER DATABASE RECOVER ...
None of my DBA's have owned up to issuing this command nor have any of the users. Obviously, the user didn't know what they were doing, and Oracle handled it correctly, but I still want to know WHO did it.
I looked at the alert.log, listener.log, backup logs and other OS logs without any concrete proof. I can't use Logminer as this is a DDL command and I'm only on 8.1.7.2. I'm not running auditing on this database.
Any suggestions?
Jeff Hunter
-
Start cleaning your gun!
How many people were still there at 7:30 pm and how many have the rights , knowledge (or lack therof) to issue this command?
If it is NT the event viewer may provide some info, any other "who was logged in" type logs.
Hire honest employees, I would have told you ASAP.
MH
I remember when this place was cool.
-
That's kind of the thing. My DBA's have the power to issue this command, but if they did, it would give a different error message.
I think it is a user, but I can't prove it.
I'm on Solaris and accounting is not turned on either.
Jeff Hunter
-
Hi,
What about audit log?
Baliga
-
Originally posted by Mr.Hanky
Hire honest employees, I would have told you ASAP.
If it IS one of my DBA's, I might have an opening soon ...
Jeff Hunter
-
Originally posted by mbaliga
Hi,
What about audit log?
Baliga
Auditing is not turned on.
Jeff Hunter
-
Jeff; Is there a possibility that Oracle issued this command at startup, something to do with cache recovery?
MH
I remember when this place was cool.
-
Originally posted by Mr.Hanky
Jeff; Is there a possibility that Oracle issued this command at startup, something to do with cache recovery?
Database has been up since Oct 13, 2001.
Jeff Hunter
-
I know the v$sqlarea.address of the command, but since the user has logged out, I can't correlate it back to v$session.
Jeff Hunter
-
Jeff,
listener.log will tell you which machine and time request came from (if it was different machine).
np70
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
Click Here to Expand Forum to Full Width
|