How to disable Enterprise Manager auditing for the SYSMAN user?
(Doc ID 872802.1)
Last updated on DECEMBER 13, 2019
Applies to:
Enterprise Manager Base Platform - Version 10.2.0.2 to 10.2.0.5 [Release 10.2]Information in this document applies to any platform.
Symptoms
Auditing of the 'sysman' user has created a large amount of audit records. After disabling the auditing there are lots of execute procedure records, that cannot be removed with noaudit. For example:-
<148><timestamp> Oracle Audit[22228]: [ID 748625 local2.warning] LENGTH: "323" SESSIONID:[8] "32332812" ENTRYID:[1] "1" STATEMENT:[1] "1" USERID:[6] "SYSMAN" USERHOST:[20] "<hostname>" TERMINAL:[7] "unknown" ACTION:[3] "100" RETURNCODE:[4] "1017" COMMENT$TEXT:[99] "Authenticated by: DATABASE; OS$USERID:[6] "user"
<148><timestamp> Oracle Audit[22497]: [ID 748625 local2.warning] LENGTH: "323" SESSIONID:[8] "32332831" ENTRYID:[1] "1" STATEMENT:[1] "1" USERID:[6] "SYSMAN" USERHOST:[20] "<hostname>" TERMINAL:[7] "unknown" ACTION:[3] "100" RETURNCODE:[4] "1017" COMMENT$TEXT:[99] "Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=<ipaddress>)(PORT=port))" OS$USERID:[6] "user"
<148><timestamp> Oracle Audit[22497]: [ID 748625 local2.warning] LENGTH: "323" SESSIONID:[8] "32332831" ENTRYID:[1] "1" STATEMENT:[1] "1" USERID:[6] "SYSMAN" USERHOST:[20] "<hostname>" TERMINAL:[7] "unknown" ACTION:[3] "100" RETURNCODE:[4] "1017" COMMENT$TEXT:[99] "Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=<ipaddress>)(PORT=port))" OS$USERID:[6] "user"
These audit entries are observed in audit log located at "/var/log/ORACLE_SID/audit.log"
Cause
To view full details, sign in with your My Oracle Support account. |
|
Don't have a My Oracle Support account? Click to get started! |
In this Document
| Symptoms |
| Cause |
| Solution |