My Oracle Support Banner

EM13c : Alert Mismatch For "Audited User" Metric For User SYS (Doc ID 2690568.1)

Last updated on JUNE 25, 2024

Applies to:

Enterprise Manager for Oracle Database - Version 13.1.0.0.0 and later
Information in this document applies to any platform.

Symptoms

In Enterprise Manager(EM) Cloud Control, Mismatch in Warning alert on "Audited User" metric from Enterprise Manager Cloud Control and event logged in Windows Events Log.

Receives several warning alerts from Cloud Control installation for "User Audit -> Audited User" Metric.

EM Event: Warning:<Target_Name> - User SYS logged on from <Host>
Event Type=Metric Alert
Event name=UserAudit:username
Metric Group=User Audit
Metric=Audited User
Metric value=SYS


However, when inspected the Windows Events Log, do not find that the SYS user logged on around the time the metric alert is received from Enterprise Manager Cloud Control.

Note: For Windows Database Auditing logs audit events in Windows Events Log instead of File System.

Cause

To view full details, sign in with your My Oracle Support account.

Don't have a My Oracle Support account? Click to get started!

In this Document
Symptoms
Cause
Solution


My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.