AUDIT Confusion

845641

I am on 11g R2 Linun redhat-5 , i found a strange thing today, i fired audit all on scott.emp by session but when when i see dba_Audit_Trail it is showing me everytime time the command is executed, means if command select * from emp is executed as scott 5 times it is showing me 5 times the rows in dba_Audit_trail, just like by access option. Note i have not executed audit all on scott.emp by access. I just said audit all on scott.emp by session means it should be audit once even if i execute 10 times

Rafi (Oracle DBA)

Hi ,
For Oracle 11g rel2 there are few changes in auditing.Check the below link for details


2309084



Best regards,

Rafi.

Hemant K Chitale

See the explanation for "BY SESSION" in the 11.2 documentation on the AUDIT command at
http://docs.oracle.com/cd/E11882_01/server.112/e26088/statements_4007.htm#i2059073

In earlier releases, BY SESSION caused the database to write a single record for all SQL statements or operations of the same type executed on the same schema objects in the same session. Beginning with this release of Oracle Database, both BY SESSION and BY ACCESS cause Oracle Database to write one audit record for each audited statement and operation. BY SESSION continues to populate different values to the audit trail compared with BY ACCESS. Oracle recommends that you include the BY ACCESS clause for all AUDIT statements, which results in a more detailed audit record. If you specify neither clause, then BY SESSION is the default.



Hemant K Chitale