A Query Has Generated Multiple Audit Records. Is This Expected ?
(Doc ID 2064300.1)
Last updated on OCTOBER 10, 2022
Applies to:
Oracle Database - Enterprise Edition - Version 9.2.0.1 to 12.1.0.2 [Release 9.2 to 12.1]Oracle Database Exadata Cloud Machine - Version N/A and later
Oracle Cloud Infrastructure - Database Service - Version N/A and later
Oracle Database Exadata Express Cloud Service - Version N/A and later
Oracle Database Cloud Exadata Service - Version N/A and later
Information in this document applies to any platform.
Symptoms
You have configured database auditing using Standard Auditing and observe that a query has generated many similar audit records in the view dba_audit_trail. At first glance, these audit records appear to be identical.
For example:
SQL> connect / as sysdba
SQL> grant connect, dba to USER1 identified by xxxxx;
SQL> AUDIT SELECT TABLE BY USER1 BY ACCESS ;
SQL> connect USER1/xxxxx
SQL> select username, account_status from dba_users;
SQL> connect / as sysdba
SQL> column username format a15
SQL> column sql_text format a50
SQL> select USERNAME, SQL_TEXT, to_char(timestamp, 'DD/MM/RRRR HH:MI') from dba_audit_trail where username='USER1' and sql_text like 'select username%';
USERNAME SQL_TEXT TO_CHAR(TIMESTAM
--------------- ------------------------------------------------------- -----------------------
USER1 select username, account_status from dba_users 08/10/2015 01:15
USER1 select username, account_status from dba_users 08/10/2015 01:15
USER1 select username, account_status from dba_users 08/10/2015 01:15
USER1 select username, account_status from dba_users 08/10/2015 01:15
USER1 select username, account_status from dba_users 08/10/2015 01:15
USER1 select username, account_status from dba_users 08/10/2015 01:15
USER1 select username, account_status from dba_users 08/10/2015 01:15
USER1 select username, account_status from dba_users 08/10/2015 01:15
USER1 select username, account_status from dba_users 08/10/2015 01:15
9 rows selected.
SQL> grant connect, dba to USER1 identified by xxxxx;
SQL> AUDIT SELECT TABLE BY USER1 BY ACCESS ;
SQL> connect USER1/xxxxx
SQL> select username, account_status from dba_users;
SQL> connect / as sysdba
SQL> column username format a15
SQL> column sql_text format a50
SQL> select USERNAME, SQL_TEXT, to_char(timestamp, 'DD/MM/RRRR HH:MI') from dba_audit_trail where username='USER1' and sql_text like 'select username%';
USERNAME SQL_TEXT TO_CHAR(TIMESTAM
--------------- ------------------------------------------------------- -----------------------
USER1 select username, account_status from dba_users 08/10/2015 01:15
USER1 select username, account_status from dba_users 08/10/2015 01:15
USER1 select username, account_status from dba_users 08/10/2015 01:15
USER1 select username, account_status from dba_users 08/10/2015 01:15
USER1 select username, account_status from dba_users 08/10/2015 01:15
USER1 select username, account_status from dba_users 08/10/2015 01:15
USER1 select username, account_status from dba_users 08/10/2015 01:15
USER1 select username, account_status from dba_users 08/10/2015 01:15
USER1 select username, account_status from dba_users 08/10/2015 01:15
9 rows selected.
Changes
Cause
To view full details, sign in with your My Oracle Support account. |
|
Don't have a My Oracle Support account? Click to get started! |
In this Document
| Symptoms |
| Changes |
| Cause |
| Solution |
| References |