7 Replies Latest reply: Oct 22, 2013 5:15 AM by yxes2013 RSS

    Generating lots of audit log at /oracle/admin/PROD/adump/*.aud

    yxes2013

      Hi all,

       

      11.2.0.1

       

      My folder PROD/adump/*.aud  is generating lots of logs , like 1 million+ a day. I do not know what auditing what turned on.

       

      So the check the db.

       

      SQL> show parameter audit

       

       

      NAME                                 TYPE        VALUE

      ------------------------------------ ----------- ------------------------------

      audit_file_dest                      string      /oracle/admin/PROD/adump

      audit_sys_operations                 boolean     FALSE

      audit_syslog_level                   string

      audit_trail                          string      DB

       

      SQL> select count(*) from sys.aud$;

       

       

        COUNT(*)

      ----------

         1891815

       

       

      So the sys.aud$ is not as fast generating logs as the /oracle/admin/PROD/adump. Why is that the adump has more?

      I tried to open the *.aud  file and it has this content only:

       

      Audit file /oracle/admin/PROD/adump/PROD_ora_2801794_7.aud

      Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit Production

      With the Partitioning, OLAP, Data Mining and Real Application Testing options

      ORACLE_HOME = /oracle/product/11.2.0/dbhome_1

      System name:    AIX

      Node name:      server1

      Release:        1

      Version:        6

      Machine:        00CBC2354C00

      Instance name: PROD

      Redo thread mounted by this instance: 1

      Oracle process number: 56

      Unix process pid: 2801794, image: oracle@server1

       

       

      Sun Oct 20 15:17:55 2013 +08:00

      LENGTH: "224"

      SESSIONID:[9] "915275243" ENTRYID:[1] "1" USERID:[6] "ORAPROD" ACTION:[3] "102" RETURNCODE:[1] "0" LOGOFF$PREAD:[1] "0" LOGOFF$LREAD:[3]

      "215" LOGOFF$LWRITE:[1] "4" LOGOFF$DEAD:[1] "0" DBID:[8] "58658374" SESSIONCPU:[1] "0"

       

       

      Is this audit file being logged also at SYS.AUD$?

      How do I stop this?

       

       

      Thanks,

      zxy