Database Security Products (MOSC)

MOSC Banner

EE 12.2 sys.aud$ not capturing alter user records

edited Jan 15, 2020 10:26PM in Database Security Products (MOSC) 5 commentsAnswered

Hi, DBAs

This is EE RAC 12.2 on OL 7.4. I'm asked to audit the use of "alter user" commands, so I issued these statements on the database:

AUDIT ALTER USER  BY ACCESS;

AUDIT CREATE USER  BY ACCESS;

AUDIT DROP USER  BY ACCESS;

AUDIT USER  BY ACCESS;

I confirmed that these audit options, by access for success and failure, are in the results from sys.dba_stmt_audit_opts. Parameter audit_trail = 'DB', and unified auditing is FALSE per v$option. I locked a user account to confirm that "alter user" was captured in sys.aud$, but there is no record with action# = 43.

Tagged:

Howdy, Stranger!

Log In

To view full details, sign in to My Oracle Support Community.

Register

Don't have a My Oracle Support Community account? Click here to get started.

Category Leaderboard

Top contributors this month

New to My Oracle Support Community? Visit our Welcome Center

MOSC Help Center