This content has been marked as final. Show 6 replies
Thanks for you reply and help Manik!
I see that we have audit enable.
Now I see another row with a familiar select statement:
1 170 4t3qn75qda9wu DONE (ALL ROWS) 5.359375 1460843 8161 "select .... "
It is a way to figure out where is this statement coming from? We have many procedures, is this can come from a query outside of oracle?
the first query against the view v$sql_monitor has nothing to do with audit!
Here you will see all SQL queries based on Real-time SQL monitoring
( e.g. http://www.oracle-base.com/articles/11g/real-time-sql-monitoring-11gr1.php ).
It is a way to figure out where is this statement coming from? We have many procedures, is this can come from a query outside of oracle?It is easy to figure out, where these statements are coming from:
the columns USER_NAME, MODULE, CLIENT_INFO, PROGRAM in v$sql_monitor will tell you the origin. These sessions could be
external sessions from outside via SQL*Net.
I see about 75 sessions showing this audit select statement with DONE status.Obviously, you have an active session which execute some sql queries. If they are finished, the status will be "DONE".
Is this ok? why so many sessions?
This is ok.
You sql statement will also be influenced by multiple child cursors. sql id is not unique in either table.
This is quite a well known badly performing query from, I think, OEM
SELECT TO_CHAR(current_timestamp AT TIME ZONE 'GMT', 'YYYY-MM-DD HH24:MI:SS TZD') AS curr_timestamp, COUNT(username) AS failed_count FROM sys.dba_audit_session WHERE returncode != 0 AND TO_CHAR(timestamp, 'YYYY-MM-DD HH24:MI:SS') >= TO_CHAR(current_timestamp - TO_DSINTERVAL('0 0:30:00'), 'YYYY-MM-DD HH24:MI:SS') what this text mean?