Originally posted by maachan If this was issued from OS, then do
last | more
at OS prompt
You can see what was logged on from what IP address at what time.
That might help to narrow it down some.
last only shows who was logged on and not what commands they ran. There was nobody logged in to the box at the time. I would need lastcomm to show me which commands were executed, but that relies on OS accounting to be turned on.
Originally posted by sln81 can you use the PARSING_USER_ID column in the V$SQLAREA and get some result?
The parsing of that statement obviously failed (insufficient privileges ORA error), so that particular statement was realy never put in the library cache. So looking for it in V$SQLAREA is useless, IMHO.
Jurij Modic ASCII a stupid question, get a stupid ANSI
24 hours in a day .... 24 beer in a case .... coincidence?
It was actually in v$sqlarea with the correct timestamp, but since the parsing failed, I don't think the PARSING_USER_ID or PARSING_SCHEMA_ID are reliable (they both indicate SYS did the parsing but SYS would have privs...)