My Oracle Support Banner

Sys.aud$ Records Logon And Logoff Activity For SYS User (Doc ID 1935573.1)

Last updated on FEBRUARY 27, 2020

Applies to:

Oracle Database - Enterprise Edition - Version 10.2.0.4 and later
Information in this document applies to any platform.

Goal

During SOX auditing, Some Logon/logoff for SYS records were found in SYS.AUD$:

1 select os_username, USERHOST, TERMINAL, ACTION_NAME, RETURNCODE, count(*)
2 from dba_audit_trail where username='SYS'
3* group by os_username, USERHOST, TERMINAL, ACTION_NAME, RETURNCODE
SQL> /

OS_USERNAM USERHOST TERMINAL ACTION_NAME RETURNCODE COUNT(*)
---------- ---------- -------------------- ---------------------------- ---------- ----------
oracle XXXXXX02 LOGON 1017 1
ora_XXX prod2 LOGOFF 0 54
XXX817 prod1 UNKNOWN LOGOFF 0 42
XXXXfra XXXXXX01 LOGOFF 0 8
XXX10 prod1 LOGOFF 0 1

prod1, prod2 are servers where another databases exists, ora_XXX, XXX817, XXXfra, XXX10 are owners of those databases.

Also, there's no files for these connections at OS audit files which is always the case for SYS AS SYSDBA

Solution

To view full details, sign in with your My Oracle Support account.

Don't have a My Oracle Support account? Click to get started!


In this Document
Goal
Solution


My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.