My Oracle Support Banner

'LOGON' Action Entries Does not get recorded. Only LOGOFF entries 10.2.0.3 (Doc ID 2311564.1)

Last updated on MARCH 15, 2019

Applies to:

Oracle Database - Enterprise Edition - Version 10.2.0.3 and later
Oracle Database Cloud Schema Service - Version N/A and later
Oracle Database Exadata Cloud Machine - Version N/A and later
Oracle Cloud Infrastructure - Database Service - Version N/A and later
Oracle Database Cloud Exadata Service - Version N/A and later
Information in this document applies to any platform.

Symptoms

NOTE: In the images and/or the document content below, the user information and data used represents fictitious data from the Oracle sample schema(s) or Public Documentation delivered with an Oracle database product. Any similarity to actual persons, living or dead, is purely coincidental and not intended in any manner. 

While auditing LOGON and LOGOFF actions for user 'USER1' it records only LOGOFF actions. LOGON actions does not seem to record in the aud$ table in 10.2.0.3


The auditing is enabled with below settings.

AUDIT CREATE SESSION BY USER1;

 

Has audit_trail=DB,EXTENDED or DB configured

 

SQL> show parameter audit;

NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
audit_file_dest string /x/y/z
audit_sys_operations boolean FALSE
audit_syslog_level string
audit_trail string DB, EXTENDED

 

### Auditing enabled and checking for the records ##

SQL> audit create session by USER1;

Audit succeeded.

SQL> show user;
USER is "SYS"

SQL> connect USER1/XXXX;
Connected.

SQL> connect /as sysdba
Connected.
SQL>

SQL>
SQL> COLUMN username FORMAT A10
COLUMN owner FORMAT A10
COLUMN obj_name FORMAT A10
COLUMN extended_timestamp FORMAT A35
COLUMN sql_text FORMAT A80
SELECT username,
extended_timestamp,
owner,
action_name,
sql_text,
returncode
FROM dba_audit_trail
WHERE username in('USER1');
SQL> SQL> SQL> SQL> SQL> 2 3 4 5 6 7 8
USERNAME EXTENDED_TIMESTAMP OWNER ACTION_NAME SQL_TEXT RETURNCODE
---------- ----------------------------------- ---------- ---------------------------- -------------------------------------------------------------------------------- ----------
USER1 26-SEP-17 08.47.17.752357 AM +00:00 LOGOFF 0

 

Changes

 No changes. It is 10.2.0.3 DB where in there is requirement to audit a particular user.

Cause

To view full details, sign in with your My Oracle Support account.

Don't have a My Oracle Support account? Click to get started!


In this Document
Symptoms
Changes
Cause
Solution
References


My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.