How to audit create user and drop user privs ?

[Copernicus]

Hi,

I have enabled auditing and want to check who is using "create user" and "drop user" privs ?

Plz let me know how to do this ?

Thanks,
Sal

[AOrehek]

Try auditing create,drop and audit user stmt

AUDIT CREATE USER
AUDIT ALTER USER
AUDIT DROP USER

[robertbalmer]

or you can execute

AUDIT CREATE USER BY ACCESS WHENEVER SUCCESSFUL
AUDIT CREATE USER BY ACCESS WHENEVER NOT SUCCESSFUL

OR

AUDIT CREATE USER BY SESSION

Are you suspicious of administrators or normal users?
Which parameter(s) did you enable?...
1.AUDIT_SYS_OPERATIONS=TRUE
2.AUDIT_TRAIL=DB/OS
3.GOTO
http://download-west.oracle.com/docs...t.htm#ADMIN026
for more detail