Audit Trail
DBAsupport.com Forums - Powered by vBulletin
Page 1 of 2 12 LastLast
Results 1 to 10 of 11

Thread: Audit Trail

  1. #1
    Join Date
    Mar 2002
    Posts
    25
    Is it possible for auditing to be on even though the init.ora shows none??

    Is there a view/table that I can check to see if Oracle thinks it is turned on??

    Oracle 8.16

    Thanks,Ali

  2. #2
    Join Date
    Jan 2002
    Location
    Up s**t creek
    Posts
    1,525
    You can check the AUDIT_TRAIL parameter:

    SQL>show parameter audit

    Or look at the views

    DBA_AUDIT_EXISTS
    DBA_AUDIT_OBJECT
    DBA_AUDIT_SESSION
    DBA_AUDIT_STATEMENT
    DBA_AUDIT_TRAIL

    Regards
    Jim
    Oracle Certified Professional
    "Build your reputation by helping other people build theirs."

    "Sarcasm may be the lowest form of wit but its still funny"

    Click HERE to vist my website!

  3. #3
    Join Date
    Jan 2002
    Location
    Netherlands
    Posts
    1,587
    and these as well
    DBA_OBJ_AUDIT_OPTS
    DBA_PRIV_AUDIT_OPTS
    DBA_STMT_AUDIT_OPTS
    And about the parameter ,oracle does audit database events(like instance startup,shutdown,user connections with admin privs) irrespective of the audit_trail parameter setting.
    Tarry Singh
    I'm a JOLE(JavaOracleLinuxEnthusiast)
    TarryBlogging
    --- Everything was meant to be---

  4. #4
    Join Date
    Jan 2002
    Location
    Up s**t creek
    Posts
    1,525
    Originally posted by Tarry
    And about the parameter ,oracle does audit database events(like instance startup,shutdown,user connections with admin privs) irrespective of the audit_trail parameter setting.
    Are you sure about that Tarry, if so where are these records added? It was my understanding that if the value was NONE or FALSE no recoreds are written.

    Regards
    Jim
    Oracle Certified Professional
    "Build your reputation by helping other people build theirs."

    "Sarcasm may be the lowest form of wit but its still funny"

    Click HERE to vist my website!

  5. #5
    Join Date
    Jan 2002
    Location
    Netherlands
    Posts
    1,587
    Jim,
    I wrote a litte lazily, checking on the oracle docs here's what may clarify and also correct my statement...
    Oracle always records some database-related actions into the operating system audit trail
    from here
    http://otn.oracle.com/docs/products/...7audit.htm#272

    Tarry Singh
    I'm a JOLE(JavaOracleLinuxEnthusiast)
    TarryBlogging
    --- Everything was meant to be---

  6. #6
    Join Date
    Mar 2002
    Posts
    25
    I have checked the init file and audit_trail is set to none, my query is can I see if this is the case by running something to show me whether it is recording or not??!! The reason being a job fell over last night doing inserts and the error was because it could not write into the audit trail, well I have confirmed that it is not running by checking the init, but these guys are not convinced and now I'm not.

    Please can someone advise, I need definite proof!!


    Thanks, Ali

  7. #7
    Join Date
    Jan 2002
    Location
    Up s**t creek
    Posts
    1,525
    What was the exact error you received? It may shed a bit more light on the problem you are experiencing

    Regards
    Jim
    Oracle Certified Professional
    "Build your reputation by helping other people build theirs."

    "Sarcasm may be the lowest form of wit but its still funny"

    Click HERE to vist my website!

  8. #8
    Join Date
    Mar 2002
    Posts
    25
    Hi Jim

    I think the error was 'ORA-02002 Error while writing to audit trail' , I'm not definite as the guy did not take a copy of the error at the time!

    What I don't understand is why would his procedure get this error message if auditing had been turned off??!!, I'm right in thinking that NOAUDIT ALL would turn auditing off? Would it matter who you were logged on as to turn it off?

    Is there a way of checking some table/view to see what Oracle parameters are currently set from the init file, i.e even though the init file shows the correct parameter how do you know that it is running with the init file you are looking at??!!

    Thanks again Ali



  9. #9
    Join Date
    Jan 2002
    Location
    Up s**t creek
    Posts
    1,525
    You can see what values are associated with parameters from the v$parameter view or by typing SHOW PARAMETER AUDIT at the sql prompt.

    Regards
    Jim
    Oracle Certified Professional
    "Build your reputation by helping other people build theirs."

    "Sarcasm may be the lowest form of wit but its still funny"

    Click HERE to vist my website!

  10. #10
    Join Date
    Jan 2002
    Location
    Netherlands
    Posts
    1,587
    If you haven't checked out hte error spec's

    ORA-02002 error while writing to audit trail

    Cause: The auditing facility is unable to write to the AUDIT_TRAIL table. If this error occurs, SQL statements that are currently being audited may also fail. This error will occur if the SYSTEM tablespace runs out of disk space.

    Action: Add space to the SYSTEM tablespace or delete rows from the AUDIT_TRAIL table. If these operations fail or do not eliminate the problem, shut down and restart Oracle with auditing disabled. This is done by setting the initialization parameter AUDIT_TRAIL to FALSE.


    It might have been that the auditing was on, then turned off by someone else besides you, due to the possible system files error(I'm not blaming anyone but ,although out of good intent, too many people tend to participate in many issues). Check out with the developers nad for all you know you might be able to run that job..)

    HTH

    Tarry

    Tarry Singh
    I'm a JOLE(JavaOracleLinuxEnthusiast)
    TarryBlogging
    --- Everything was meant to be---

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  



Click Here to Expand Forum to Full Width