My Oracle Support Banner

A Query Has Generated Multiple Audit Records. Is This Expected ? (Doc ID 2064300.1)

Last updated on MARCH 02, 2019

Applies to:

Oracle Database - Enterprise Edition - Version 9.2.0.1 to 12.1.0.2 [Release 9.2 to 12.1]
Oracle Database Exadata Cloud Machine - Version N/A and later
Oracle Cloud Infrastructure - Database Service - Version N/A and later
Oracle Database Exadata Express Cloud Service - Version N/A and later
Oracle Database Cloud Exadata Service - Version N/A and later
Information in this document applies to any platform.

Symptoms

You have configured database auditing using Standard Auditing and observe that a query has generated many similar audit records in the view dba_audit_trail. At first glance, these audit records appear to be identical.

For example:

SQL> connect / as sysdba
SQL> grant connect, dba to USER1 identified by xxxxx;
SQL> AUDIT SELECT TABLE BY USER1 BY ACCESS ;

SQL> connect USER1/xxxxx
SQL> select username, account_status from dba_users;

SQL> connect / as sysdba
SQL> column username format a15
SQL> column sql_text format a50
SQL> select USERNAME,  SQL_TEXT, to_char(timestamp, 'DD/MM/RRRR HH:MI') from dba_audit_trail where username='USER1' and sql_text like 'select username%';

USERNAME     SQL_TEXT                                                                  TO_CHAR(TIMESTAM
--------------- -------------------------------------------------------           -----------------------
USER1            select username, account_status from dba_users     08/10/2015 01:15
USER1            select username, account_status from dba_users     08/10/2015 01:15
USER1            select username, account_status from dba_users     08/10/2015 01:15
USER1            select username, account_status from dba_users     08/10/2015 01:15
USER1            select username, account_status from dba_users     08/10/2015 01:15
USER1            select username, account_status from dba_users     08/10/2015 01:15
USER1            select username, account_status from dba_users     08/10/2015 01:15
USER1            select username, account_status from dba_users     08/10/2015 01:15
USER1            select username, account_status from dba_users     08/10/2015 01:15

9 rows selected.

 

Changes

 

Cause

To view full details, sign in with your My Oracle Support account.

Don't have a My Oracle Support account? Click to get started!


In this Document
Symptoms
Changes
Cause
Solution
References


My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.