'LOGON' Action Entries Does not get recorded. Only LOGOFF entries 10.2.0.3

(Doc ID 2311564.1)

Last updated on OCTOBER 03, 2017

Applies to:

Oracle Database - Enterprise Edition - Version 10.2.0.3 and later
Information in this document applies to any platform.

Symptoms

While auditing LOGON and LOGOFF actions for user 'IOPLREQ' it records only LOGOFF actions. LOGON actions does not seem to record in the aud$ table in 10.2.0.3


The auditing is enabled with below settings.

AUDIT CREATE SESSION BY IOPLREQ;

 

Has audit_trail=DB,EXTENDED or DB configured

 

SQL> show parameter audit;

NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
audit_file_dest string /x/y/z
audit_sys_operations boolean FALSE
audit_syslog_level string
audit_trail string DB, EXTENDED

 

### Auditing enabled and checking for the records ##

SQL> audit create session by IOPLREQ;

Audit succeeded.

SQL> show user;
USER is "SYS"

SQL> connect IOPLREQ/XXXX;
Connected.

SQL> connect /as sysdba
Connected.
SQL>

SQL>
SQL> COLUMN username FORMAT A10
COLUMN owner FORMAT A10
COLUMN obj_name FORMAT A10
COLUMN extended_timestamp FORMAT A35
COLUMN sql_text FORMAT A80
SELECT username,
extended_timestamp,
owner,
action_name,
sql_text,
returncode
FROM dba_audit_trail
WHERE username in('IOPLREQ');
SQL> SQL> SQL> SQL> SQL> 2 3 4 5 6 7 8
USERNAME EXTENDED_TIMESTAMP OWNER ACTION_NAME SQL_TEXT RETURNCODE
---------- ----------------------------------- ---------- ---------------------------- -------------------------------------------------------------------------------- ----------
IOPLREQ 26-SEP-17 08.47.17.752357 AM +00:00 LOGOFF 0

 

Changes

 No changes. It is 10.2.0.3 DB where in there is requirement to audit a particular user.

Cause

Sign In with your My Oracle Support account

Don't have a My Oracle Support account? Click to get started

My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms