My Oracle Support Banner

EM13c : Alert Mismatch For "Audited User" Metric For User SYS (Doc ID 2690568.1)

Last updated on MARCH 01, 2022

Applies to:

Enterprise Manager for Oracle Database - Version and later
Information in this document applies to any platform.


In Enterprise Manager(EM) Cloud Control, Mismatch in Warning alert on "Audited User" metric from Enterprise Manager Cloud Control and event logged in Windows Events Log.

Receives several warning alerts from Cloud Control installation for "User Audit -> Audited User" Metric.

EM Event: Warning:<Target_Name> - User SYS logged on from <Host>
Event Type=Metric Alert
Event name=UserAudit:username
Metric Group=User Audit
Metric=Audited User
Metric value=SYS

However, when inspected the Windows Events Log, do not find that the SYS user logged on around the time the metric alert is received from Enterprise Manager Cloud Control.

Note: For Windows Database Auditing logs audit events in Windows Events Log instead of File System.


To view full details, sign in with your My Oracle Support account.

Don't have a My Oracle Support account? Click to get started!

In this Document

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.