Audit Trail

[abutler]

Is it possible for auditing to be on even though the init.ora shows none??

Is there a view/table that I can check to see if Oracle thinks it is turned on??

Oracle 8.16

Thanks,Ali

[jovery]

You can check the AUDIT_TRAIL parameter:

SQL>show parameter audit

Or look at the views

DBA_AUDIT_EXISTS
DBA_AUDIT_OBJECT
DBA_AUDIT_SESSION
DBA_AUDIT_STATEMENT
DBA_AUDIT_TRAIL

Regards

[Tarry]

and these as well
DBA_OBJ_AUDIT_OPTS
DBA_PRIV_AUDIT_OPTS
DBA_STMT_AUDIT_OPTS
And about the parameter ,oracle does audit database events(like instance startup,shutdown,user connections with admin privs) irrespective of the audit_trail parameter setting.

[jovery]

Originally posted by Tarry
And about the parameter ,oracle does audit database events(like instance startup,shutdown,user connections with admin privs) irrespective of the audit_trail parameter setting.

Are you sure about that Tarry, if so where are these records added? It was my understanding that if the value was NONE or FALSE no recoreds are written.

Regards

[Tarry]

Jim,
I wrote a litte lazily, checking on the oracle docs here's what may clarify and also correct my statement...

Oracle always records some database-related actions into the operating system audit trail

from here
http://otn.oracle.com/docs/products/...7audit.htm#272

[abutler]

I have checked the init file and audit_trail is set to none, my query is can I see if this is the case by running something to show me whether it is recording or not??!! The reason being a job fell over last night doing inserts and the error was because it could not write into the audit trail, well I have confirmed that it is not running by checking the init, but these guys are not convinced and now I'm not.

Please can someone advise, I need definite proof!!


Thanks, Ali

[jovery]

What was the exact error you received? It may shed a bit more light on the problem you are experiencing

Regards

[abutler]

Hi Jim

I think the error was 'ORA-02002 Error while writing to audit trail' , I'm not definite as the guy did not take a copy of the error at the time!

What I don't understand is why would his procedure get this error message if auditing had been turned off??!!, I'm right in thinking that NOAUDIT ALL would turn auditing off? Would it matter who you were logged on as to turn it off?

Is there a way of checking some table/view to see what Oracle parameters are currently set from the init file, i.e even though the init file shows the correct parameter how do you know that it is running with the init file you are looking at??!!

Thanks again Ali

[jovery]

You can see what values are associated with parameters from the v$parameter view or by typing SHOW PARAMETER AUDIT at the sql prompt.

Regards

[Tarry]

If you haven't checked out hte error spec's

ORA-02002 error while writing to audit trail

Cause: The auditing facility is unable to write to the AUDIT_TRAIL table. If this error occurs, SQL statements that are currently being audited may also fail. This error will occur if the SYSTEM tablespace runs out of disk space.

Action: Add space to the SYSTEM tablespace or delete rows from the AUDIT_TRAIL table. If these operations fail or do not eliminate the problem, shut down and restart Oracle with auditing disabled. This is done by setting the initialization parameter AUDIT_TRAIL to FALSE.


It might have been that the auditing was on, then turned off by someone else besides you, due to the possible system files error(I'm not blaming anyone but ,although out of good intent, too many people tend to participate in many issues). Check out with the developers nad for all you know you might be able to run that job..)

HTH

Tarry