Sql_text in Dba_audit_trail view

Hi everyone,
We are using oracle 10g in windows platform. We have enabled auditing for the particular user.
If we execute any Sp belongs that user, audit trail view shows the details.
details of the Sp:
CREATE OR REPLACE procedure test_proc
myval in number,
mychar in varchar2,
cout out sys_refcursor
as
begin
open cout for select * from testt where num=myval and str=mychar;
end;
The select statement of the sql_text column view shows the select statement as 'SELECT * FROM TESTT WHERE NUM=:B2 AND STR=:B1 '
My doubt is , In which order the oracle assign the bind variables (:B1,:B2) in the select statements.(Why the statement not like 'SELECT * FROM TESTT WHERE NUM=:B1 AND STR=:B2'.
anyone guide me please...
Thanks & regards,
Jai

The assignment order does not really matter; what matters is that PL/SQL engine assigns the right value to the right bind variable.
You should not worry about that and you should trust PL/SQL engine for that.

Similar Messages

  • Utl_file + query

    Hi guys.
    I am really newbie in procedures.
    I am trying to implement a procedure, using utl_dir :
    create or replace procedure UTL_FILE_EXAMPLE is
    FILE_HANDLE utl_file.file_type;
    COL1 varchar2;
    RETRIEVED_BUFFER varchar2(100);
    DIR_NAME varchar2(40) := 'UTF_DIR';
    FILE_NAME varchar2(40) := 'myfile.txt';
    begin
    FILE_HANDLE := utl_file.fopen(DIR_NAME,FILE_NAME,'W');
    utl_file.put_line(FILE_HANDLE, 'auditing and testing');
    cursor CUR_EMISOR is
    SELECT username,
    extended_timestamp,
    owner,
    obj_name,
    action_name,
    sql_text
    FROM dba_audit_trail
    ORDER BY timestamp;
    utl_file.putf (
    FILE_HANDLE, CUR_EMISOR
    utl_file.fclose(FILE_HANDLE);
    file_handle := utl_file.fopen(DIR_NAME,FILE_NAME,'R');
    utl_file.get_line (FILE_HANDLE, RETRIEVED_BUFFER);
    dbms_output.put_line(RETRIEVED_BUFFER);
    utl_file.fclose(FILE_HANDLE);
    end;
    I am trying to get the results of the query and put it on a .txt file.
    Could anybody gimme a hint ?
    Thanks!

    Hello guys.
    I've Tried to follow user11181920´s hint
    create or replace procedure UTL_FILE_EXAMPLE is
    FILE_HANDLE utl_file.file_type;
    COL1 varchar2(10);
    RETRIEVED_BUFFER varchar2(100);
    DIR_NAME varchar2(40) := 'UTF_DIR';
    FILE_NAME varchar2(40) := 'myfile.txt';
    begin
    FILE_HANDLE := utl_file.fopen(DIR_NAME,FILE_NAME,'W');
    FOR C in (
    SELECT username,extended_timestamp,owner,obj_name,action_name,sql_text FROM dba_audit_trail
    ORDER BY timestamp)
    LOOP
    utl_file.put_line(FILE_HANDLE,C.username||','||C.extended_timestamp||','||C.owner);
    END LOOP;
    utl_file.fclose(FILE_HANDLE);
    end;
    I had some errors:
    At line 11: PL/SQL: ORA-00942: table or view does not exist
    At Line 11: PL/SQL: sql statement ignored
    At line 15: PLS-00364: loop index variable 'C' use in invalid
    At line 15: PL/SQL: sql statement ignored
    Ps.: Normally i can do this select, i have access on the table, the table has this columns mentioned on the query.
    Thanks.

  • Documentation links

    Hello,
    I am looking only documentation link for aud$ table; i mean the official defination of aud$ column. I did'nt find in
    http://download.oracle.com/docs/cd/B19306_01/server.102/b14237/toc.htm link. Please give me doc link for
    1.aud$
    2.x$<tables>
    Thanks and regards

    In general you can also find additional info in scripts executed by catalog.sql that calls other scripts sometimes documented such as cataudit.sql in <ORACLE_HOME>/rdbms/admin. For example:
    remark
    remark  FAMILY "AUDIT_TRAIL"
    remark  DBA_AUDIT_TRAIL
    remark  The raw audit trail of all audit trail records in the system. Some
    remark  columns are only filled in by certain statements. This view isis
    remark  accessible only to dba's.
    remark
    remark  USER_AUDIT_TRAIL
    remark  The raw audit trail of all information related to the user
    remark  or the objects owned by the user.  Some columns are only filled
    remark  in by certain statements. This view is created by selecting from
    remark  the DBA_AUDIT_TRAIL view, and retricting the rows.
    remark '
    create or replace view DBA_AUDIT_TRAIL
             OS_USERNAME,
             USERNAME,
             USERHOST,
             TERMINAL,
             TIMESTAMP,
             OWNER,
             OBJ_NAME,
             ACTION,
             ACTION_NAME,
             NEW_OWNER,
             NEW_NAME,
             OBJ_PRIVILEGE,
             SYS_PRIVILEGE,
             ADMIN_OPTION,
             GRANTEE,
             AUDIT_OPTION,
             SES_ACTIONS,
             LOGOFF_TIME,
             LOGOFF_LREAD,
             LOGOFF_PREAD,
             LOGOFF_LWRITE,
             LOGOFF_DLOCK,
             COMMENT_TEXT,
             SESSIONID,
             ENTRYID,
             STATEMENTID,
             RETURNCODE,
             PRIV_USED,
             CLIENT_ID,
             ECONTEXT_ID,
             SESSION_CPU,
             EXTENDED_TIMESTAMP,
             PROXY_SESSIONID,
             GLOBAL_UID,
             INSTANCE_NUMBER,
             OS_PROCESS,
             TRANSACTIONID,
             SCN,
             SQL_BIND,
             SQL_TEXT
    as
    select spare1           /* OS_USERNAME */,
           userid           /* USERNAME */,
           userhost         /* USERHOST */,
           terminal         /* TERMINAL */,
           cast (           /* TIMESTAMP */
               (from_tz(ntimestamp#,'00:00') at local) as date),
           obj$creator      /* OWNER */,
           obj$name         /* OBJECT_NAME */,
           aud.action#      /* ACTION */,
           act.name         /* ACTION_NAME */,
           new$owner        /* NEW_OWNER */,
           new$name         /* NEW_NAME */,
           decode(aud.action#,
                  108 /* grant  sys_priv */, null,
                  109 /* revoke sys_priv */, null,
                  114 /* grant  role */, null,
                  115 /* revoke role */, null,
                  auth$privileges) 
                            /* OBJ_PRIVILEGE */,
           decode(aud.action#,
                  108 /* grant  sys_priv */, spm.name,
                  109 /* revoke sys_priv */, spm.name,
                  null)
                            /* SYS_PRIVILEGE */,
           decode(aud.action#,
                  108 /* grant  sys_priv */, substr(auth$privileges,1,1),
                  109 /* revoke sys_priv */, substr(auth$privileges,1,1),
                  114 /* grant  role */, substr(auth$privileges,1,1),
                  115 /* revoke role */, substr(auth$privileges,1,1),
                  null)
                            /* ADMIN_OPTION */,
           auth$grantee     /* GRANTEE */,
           decode(aud.action#,
                  104 /* audit   */, aom.name,
                  105 /* noaudit */, aom.name,
                  null)
                            /* AUDIT_OPTION  */,
           ses$actions      /* SES_ACTIONS   */,
           logoff$time      /* LOGOFF_TIME   */,
           logoff$lread     /* LOGOFF_LREAD  */,
           logoff$pread     /* LOGOFF_PREAD  */,
           logoff$lwrite    /* LOGOFF_LWRITE */,
           decode(aud.action#,
                  104 /* audit   */, null,
                  105 /* noaudit */, null,
                  108 /* grant  sys_priv */, null,
                  109 /* revoke sys_priv */, null,
                  114 /* grant  role */, null,
                  115 /* revoke role */, null,
                  aud.logoff$dead)
                             /* LOGOFF_DLOCK */,
           comment$text      /* COMMENT_TEXT */,
           sessionid         /* SESSIONID */,
           entryid           /* ENTRYID */,
           statement         /* STATEMENTID */,
           returncode        /* RETURNCODE */,
           spx.name          /* PRIVILEGE */,
           clientid          /* CLIENT_ID */,
           auditid           /* ECONTEXT_ID */,
           sessioncpu        /* SESSION_CPU */,
           from_tz(ntimestamp#,'00:00') at local,
                                       /* EXTENDED_TIMESTAMP */
           proxy$sid                      /* PROXY_SESSIONID */,
           user$guid                           /* GLOBAL_UID */,
           instance#                      /* INSTANCE_NUMBER */,
           process#                            /* OS_PROCESS */,
           xid                              /* TRANSACTIONID */,
           scn                                        /* SCN */,
           to_nchar(substr(sqlbind,1,2000))      /* SQL_BIND */,
           to_nchar(substr(sqltext,1,2000))      /* SQL_TEXT */
    from sys.aud$ aud, system_privilege_map spm, system_privilege_map spx,
         STMT_AUDIT_OPTION_MAP aom, audit_actions act
    where   aud.action#     = act.action    (+)
      and - aud.logoff$dead = spm.privilege (+)
      and   aud.logoff$dead = aom.option#   (+)
      and - aud.priv$used   = spx.privilege (+)
    /I also think that AUD$ is physical table stored on disk and not a view of some SGA memory structure.
    Edited by: P. Forstmann on 19 févr. 2010 09:55

  • How to get a subset of text from a varchar2 field

    Hello.  I am trying to select a subset of text from a varchar2 field.  This is login information from dba_audit_trail view.  Here's an example of the field (comment_text from dba_audit_trail):
    Authenticated by: DIRECTORY PASSWORD;EXTERNAL NAME: cn=orcladmin,cn=Users,dc=idacorp,dc=local; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=555.555.555.555)(PORT=99999))
    I am trying to just select the "orcladmin" text - i.e. everything after the first "=" up to the first ","
    I can get everything after the first "=" with this:
    select substr(comment_text, instr(comment_text, '=') + 1) from dba_audit_trail
    ... but I don't know how to stop at the first ","
    Any help would be greatly appreciated.
    Thanks!
    Message was edited by: DRC

    Hi,
    Here's one way to do it:
    WITH got_pos    AS
        SELECT  comment_text    -- and whatever other columns you need
        ,       INSTR (cooment_text, '=')   AS equal_pos
        ,       INSTR (cooment_text, ',')   AS comma_pos
        FROM    dba_auit_trail
        WHERE   ...             -- any filtering goes here
    SELECT  SUBSTR ( comment_text
                   , equal_pos + 1
                   , comma_pos - (equal_pos + 1)
                   )   AS first_cn
    FROM    got_pos
    You could do it without a sub-query; you'd just have to do the exact same INSTR 2 times, where I used equal_pos 2 times.
    You could also get the results you want using regular expressions, such as:
    SELECT  REGEXP_SUBSTR ( comment_text
                          , '=([^,]*),'
                          , 1
                          , 1
                          , NULL
                          , 1
                          )      AS first_cn
    FROM    dba_audit_trail
    Although this uses less code, it's slower than using INSTR and SUBSTR .

  • How to find SQL Statement fired using SYS.AUD$ - Database Auditing

    Dear Friends
    I am having Oracle 9i Database and have configured it with database auditing option by setting the following parameter in init.ora file
    AUDIT_TRAIL = "DB"
    I want to audit SELECT, INSERT , UPDATE and DELETE operations on PRACTICE.EMP table for which I did :
    1) Logged in as SYS
    2) SQL> AUDIT SELECT, INSERT, UPDATE, DELETE
    ON PRACTICE.EMP
    BY ACCESS
    WHENEVER SUCCESSFUL;
    Audit Succedded
    Now how should I find out the SQL statement that does the insert, update or delete operation on the EMP table using SYS.AUD$ table
    Thanks

    Hi,
    It's contents can be viewed directly or via the following views:
    * DBA_AUDIT_EXISTS
    * DBA_AUDIT_OBJECT
    * DBA_AUDIT_SESSION
    * DBA_AUDIT_STATEMENT
    * DBA_AUDIT_TRAIL
    * DBA_OBJ_AUDIT_OPTS
    * DBA_PRIV_AUDIT_OPTS
    * DBA_STMT_AUDIT_OPTS
    The audit trail contains a lot of data, but the following are most likely to be of interest:
    * Username : Oracle Username.
    * Terminal : Machine that the user performed the action from.
    * Timestamp : When the action occured.
    * Object Owner : The owner of the object that was interacted with.
    * Object Name : The name of the object that was interacted with.
    * Action Name : The action that occured against the object. (INSERT, UPDATE, DELETE, SELECT, EXECUTE)
    So, take a look at action_name column from DBA_AUDIT_TRAIL view.
    Cheers
    Legatti

  • Fine Grained Audit records to syslog

    Hello experts,
    I am working on Standard Auditing and Fine Grained Auditing on 11.2.0.3 databases on Red Hat x86_64.
    I am trying to send Fine Grained Audit records to syslog as for my Standard Audit records with audit_trail set to OS, but can't find any appropriate option.
    When I create FGA policies with the ADD_POLICY procedure of the DBMS_FGA package, the audit_trail parameter can only be set to DB or XML, as stated in [PL/SQL Packages and Types Reference|http://docs.oracle.com/cd/E11882_01/appdev.112/e25788/d_fga.htm#CDEIECAG].
    Does somebody know if it is possible to send FGA audit records to syslog directly:
    1. without using any additional product (e.g. Oracle Audit Vault)?
    2. without doing manual extraction from fga_log$ or DBA_COMMON_AUDIT_TRAIL?
    Thanks for any suggestion.

    Hi,
    Well, i did not used FGA yet.
    I used audit_Trail=db and the query SELECT username,extended_timestamp,owner,obj_name,action_name,sql_text FROM dba_audit_trail WHERE to_char(extended_timestamp, 'DD/MM/RR') = to_char(SYSDATE - 1, 'DD/MM/RR') ORDER BY timestamp)
    Then i wrote a procedure, and exported the results using utl_file .
    And i scheduled this procedure to run daily.
    It works pretty good, if you like the solution as ask for details.
    Hope that helps,
    Regards.

  • Howto capture/replay workload (for performance testing purposes)

    Hi,
    We have a customer that will buy new hardware for his Oracle database server. Because he is hesitating between 2 possible storage solutions and is not convinced that solution A will be significantly better than solution B he wants a proof of concept.
    So this is what we will do:
    - Set up a test environment with hardware solution A and another one with hardware solution B.
    - We will backup and restore his database on both test servers.
    - We will run a workload on both servers and monitor performance with AWR and ADDM
    - Compare performance
    I would like to:
    - Make a consistent backup of the production database
    - Capture 24 hours work on the customers production database
    - Restore database on both test servers.
    - Replay the captured workload on both test servers.
    - Compare performance
    Does anyone know what tools I can use to do the capture/replay part?
    All suggestions are appreciated.
    Thank You,
    Pieter

    I have been playing with logminer and auditing but these don't solve the problem for 100%...
    Start logminer:
    EXECUTE DBMS_LOGMNR.START_LOGMNR(-
    STARTSCN => 404809, -
    ENDSCN   => 404975, -
    OPTIONS  => DBMS_LOGMNR.DICT_FROM_ONLINE_CATALOG + -
    DBMS_LOGMNR.CONTINUOUS_MINE + -
    DBMS_LOGMNR.COMMITTED_DATA_ONLY + -
    DBMS_LOGMNR.NO_ROWID_IN_STMT);Get SQL:
    SELECT SQL_REDO FROM V$LOGMNR_CONTENTS WHERE USERNAME != 'SYS'
    AND SEG_OWNER IS NULL OR SEG_OWNER NOT IN ('SYS', 'SYSTEM', 'SYSMAN');This works for insert/update/delete, but it can't capture selects...
    Auditing:
    AUDIT SELECT TABLE, INSERT TABLE, DELETE TABLE, EXECUTE PROCEDURE BY ACCESS;
    SELECT SQL_TEXT FROM DBA_AUDIT_TRAIL;These sql_text statements show the bind variables
    eg: SELECT TO_NUMBER(PARAMETER_VALUE) FROM MGMT_PARAMETERS WHERE PARAMETER_NAME = :B1
    This is not executable, I need an executable result...
    Does anyone has a better way to accomplish what I need?
    Thank You.

  • Audit input parameters in package by access

    Hi Gurus,
    I recently activated the audit_trail parameter in init.ora file so i can audit the database. I want to audit de input parameters of a package. This could be possible ??...
    Regards!!
    Pablo.-
    Edited by: PabloArroyo on Nov 7, 2012 6:09 PM

    Yes, it is recorded in sql_text.dba_audit_trail. See demo :
    C:\Windows\system32>sqlplus scott/tiger
    SQL*Plus: Release 11.2.0.1.0 Production on Thu Nov 8 10:20:42 2012
    Copyright (c) 1982, 2010, Oracle.  All rights reserved.
    Connected to:
    Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - 64bit Production
    With the Partitioning, OLAP, Data Mining and Real Application Testing options
    SQL> show parameter audit_trail;
    NAME                                 TYPE        VALUE
    audit_trail                          string      DB_EXTENDED
    SQL> set line 200;
    SQL> create or replace procedure sp(num in number)
      2  is
      3  begin
      4  dbms_output.put_line(num);
      5  end;
      6  /
    Procedure created.
    SQL> create or replace package p is
      2  procedure sp(num in number);
      3  end;
      4  /
    Package created.
    SQL> create or replace package body p is
      2  procedure sp(num in number)
      3  is
      4  begin
      5  dbms_output.put_line('Executing Package:');
      6  end;
      7  end;
      8  /
    Package body created.
    SQL> audit execute on sp by access;
    Audit succeeded.
    SQL> audit execute on p by access;
    Audit succeeded.
    SQL> exec sp(12);
    12
    PL/SQL procedure successfully completed.
    SQL> exec p.sp(15);
    Executing Package:
    PL/SQL procedure successfully completed.
    SQL> alter session set nls_date_format='DD-MON-YYYY HH24:MI:SS';
    Session altered.
    SQL> column timestamp format a20
    SQL> column owner format a10
    SQL> column obj_name format a10
    SQL> column action_name format a20
    SQL> column sql_text format a20
    SQL> select timestamp, owner, obj_name, action_name,sql_text from dba_audit_trail
      2  where obj_name='P'
      3  and owner='SCOTT';
    TIMESTAMP            OWNER      OBJ_NAME   ACTION_NAME          SQL_TEXT
    08-NOV-2012 10:43:19 SCOTT      P          EXECUTE PROCEDURE    BEGIN p.sp(15); END;
    SQL> select timestamp, owner, obj_name, action_name,sql_text from dba_audit_trail
      2  where obj_name='SP'
      3  and owner='SCOTT';
    TIMESTAMP            OWNER      OBJ_NAME   ACTION_NAME          SQL_TEXT
    08-NOV-2012 10:43:00 SCOTT      SP         EXECUTE PROCEDURE    BEGIN sp(12); END;
    SQL>So, we can get the package's procedure input parameter value from sql_text column of dba_audit_trail.
    Regards
    Girish Sharma

  • Database Auditing to record DELETE operation on a schema for all tables.

    Hi,
    I am using ORACLE DATABASE 11g. I want to apply the AUDIT feature to record all the DELETE operations happening on the schema tables.
    I did the following steps but dint got the proper output :-
    I logged into the SYS as sysdba user and set
    alter system set audit_trail=DB,EXTENDED scope=spfile;then i executed this command to record the sql which will use the DELETE privileges
    AUDIT DELETE ANY TABLE;Then i bounced back my DB and for testing purpose i created a table in SCOTT schema and inserted 10 rows in it and then DELETE all the rows from it.
    As per expectation i check the view
    select * from aud$
    where spare1 like '%MACHINE1%'
    and USERID='SCOTT'
    order by ntimestamp#;The output i got is :-
    34     168368     1     1          SCOTT     I-DOMAIN\MACHINE1     MACHINE1     100     0                                                                      Authenticated by: DATABASE; Client address: (ADDRESS=(PROTOCOL=tcp)(HOST=127.0.0.1)(PORT=2565))          MACHINE1                    5          21-DEC-11 07.02.58.621000 AM               0     928:5024     0000000000000000               983697018     <CLOB>     <CLOB>     But here i don't see the SQL generated in the last column.
    What i was expecting is that if i fire a DELETE statement in the schema it will get logged here and with the help of this view i will be able to see that which user from which machine executed a DELETE statement and what that statement was?
    Please let me know what step i have missed here.
    PS:- The ACTION# column shows 100 , is it the code for DELETE action. I also accessed the DBA_AUDIT_TRAIL view but din't found any usefull info their.
    Thanks in advance.

    Try instead:
    audit delete table;AUDIT DELETE ANY TABLE is auditing use of DELETE ANY TABLE privilege.

  • Does oracle record table drops/purges ?

    Hello,
    I am using Oracle 11.2.0.3 Enterprise Edition and recently found certain users tables are missing. Does oracle record anything with respect to tables purged ? And in my case these are external tables. Pls revert back if I have to lookup in alert log or any v$ view. As far as I know if table is just dropped it can be found in dba_recyclebin ( not sure about retention) but I didn't find any information in that view. Any help would be great !  Thanks

    Hi,
    I am using Oracle 11.2.0.3
    By default, some DDL commands are audited by default in Oracle 11g.
    SQL> SELECT privilege from dba_priv_audit_opts where user_name is NULL;
    PRIVILEGE
    CREATE EXTERNAL JOB
    CREATE ANY JOB
    GRANT ANY OBJECT PRIVILEGE
    EXEMPT ACCESS POLICY
    CREATE ANY LIBRARY
    GRANT ANY PRIVILEGE
    DROP PROFILE
    ALTER PROFILE
    DROP ANY PROCEDURE
    ALTER ANY PROCEDURE
    CREATE ANY PROCEDURE
    ALTER DATABASE
    GRANT ANY ROLE
    CREATE PUBLIC DATABASE LINK
    DROP ANY TABLE
    ALTER ANY TABLE
    CREATE ANY TABLE
    DROP USER
    ALTER USER
    CREATE USER
    CREATE SESSION
    AUDIT SYSTEM
    ALTER SYSTEM
    So, maybe you can try find out if another user dropped your tables making use of DROP ANY TABLE privilege. For this, you need to take a look at DBA_AUDIT_TRAIL view:
    select * from dba_audit_trail where action_name = 'DROP TABLE' order by 5 desc;
    Cheers
    Legatti

  • Log invalid/valid login attempts into a Table

    Hi,
    I need to log all invalid / valid login attempts into the Oracle DB into a Table in the DB. I am using forms front-end.
    What is the best approach to achieve this ?
    Thanks
    s

    Hello,
    I am getting this error below:
    SQL> audit connect;
    Audit succeeded.
    SQL> desc dba_audit_session;
    ERROR:
    ORA-24372: invalid object for describe
    SQL> desc dba_audit_trail;
    ERROR:
    ORA-24372: invalid object for describe
    OWNER                          OBJECT_NAME                    OBJECT_TYPE
    SYS                            DBA_AUDIT_TRAIL                VIEW
    PUBLIC                         DBA_AUDIT_TRAIL                SYNONYM
    SYS                            DBA_AUDIT_SESSION              VIEW
    PUBLIC                         DBA_AUDIT_SESSION              SYNONYMFrom the login I am using I can query :
    dba_objects
    dba_views
    all_objects
    etc
    Why can't I view the above two views ?
    Thanks
    s

  • New columns and tables

    Hello All,
    I need to know the new created tables on my database and the added columns:
    I used the below query so i can get the NEW created tables
    select * from dba_objects d where to_date(d.created,'dd/mm/yyyy') = to_Date(sysdate-1,'dd/mm/yyyy')  and d.object_type = 'TABLE'and owner = 'MyOwner';
    Is there any way to know what are the new added columns to a table, in the below i can know the last DDL, but what i need is to know the added colums
    select * from dba_objects d where to_date(d.Last_Ddl_Time,'dd/mm/yyyy') = to_Date(sysdate -1 ,'dd/mm/yyyy') and owner = 'MyOwner';
    Thanks in Advance.

    consider:
    SQL> alter system set audit_trail='db_extended' scope=spfile;
    System altered.
    SQL> startup force
    ORACLE instance started.
    Total System Global Area  431038464 bytes
    Fixed Size                  1375088 bytes
    Variable Size             301991056 bytes
    Database Buffers          121634816 bytes
    Redo Buffers                6037504 bytes
    Database mounted.
    Database opened.
    SQL> audit alter table;
    Audit succeeded.
    SQL> conn ami/ami
    Connected.
    SQL> create table a as select * from dual;
    Table created.
    SQL> alter table a add b date;
    Table altered.
    SQL> select sql_text  from dba_audit_trail where sql_text is not null;
    SQL_TEXT
    alter table a add b dateAmiel Davis

  • Trace IP address / machine of user logging in database with wrong password

    Hello All,
    I would like to find the IP address or machine information of the user who is attempting to login the database with the wrong password.
    I am on 11g. Please can I know if it is possible to get this information and if yes then how to configure it.
    Thanks.

    1. Enable audit in database with pararameter AUDIT_TRAIL
    SQL> show parameter audit_trail;
    NAME                                 TYPE        VALUE
    audit_trail                          string      DB_EXTENDED2. Enable session auditing
    SQL> audit session;
    Audit succeeded.3. Check DBA_AUDIT_TRAIL view:
    SQL> select os_username, userhost, username, action_name, timestamp, returncode
      2  from dba_audit_trail
      3  where returncode=1017;
    OS_USERNAME
    USERHOST
    USERNAME                       ACTION_NAME                  TIMESTAMP RETURNCODE
    pierre
    WORKGROUP\PC-de-pierre
    HR                             LOGON                        22-FEB-11       10171017 stands for ORA-1017 Oracle error:
    oerr ora 1017
    01017, 00000, "invalid username/password; logon denied"
    // *Cause:
    // *Action:OS_USERNAME is OS account name of user that is trying to connect to Oracle
    USERHOST is the machine name where executable has tried to connect.
    Edited by: P. Forstmann on 22 févr. 2011 13:39
    Edited by: P. Forstmann on 22 févr. 2011 13:41

  • How to find auditing SQL Text query information

    Hi,
    I am using auditing:
    SQL>select object_name,action_name,sql_text from dba_audit_trail;
    UPDATE SIS_STUDENT_COURSES SET DENIAL_DATE = :B5 , LETTER_GRADE = :B2 WHERE SEMESTER = :B4 AND COURSE_NO = 4035 AND STUDENT_ID = :B3 AND NVL(LETTER_GRADE, 'x') NOT IN(:B2 , :B1 );In the above query, I am unable to understand the B5,B1,B2,B3 etc..
    as my understand its bind variables but the in actual database query is not using any bind variable.
    How can I find the exact SQL Text? I mean what exact sql statement was raised by database user.

    Hi JIC,
    the bind values are in the sql_bind column in dba_audit_trail, the binds you see look like being generated by your application,
    however they may be system generated bind values if parameter cursor_sharing is being used. It is not recommended to
    disable cursor sharing just to see the original sql statement in the audit records. It generally makes no sense to try to reconstruct
    the statement 'as if' no binds were being used.
    greetings,
    Harm ten Napel

  • To trace the users connecting to database

    Hi ,
    can any body help me on tracing the users who are connected to a database at a particular period of time.?
    thanks

    soundar wrote:
    these details on the audit where it gets recorded..?
    it's in audit trail file in the same directory as background process trace files or some where else..?It depends on the setting. If it is set to DB then it will be sent to the SYS.AUD$ table. This table doesn't need to be accessed directly. You can use the DBA_AUDIT_TRAIL view to get a more friendly look at the audit information.
    If it is set to OS it will go to the operating systems audit trail.
    It may be worth it to look at the documentation :)
    [Initialization Parameters: AUDIT_TRAIL|http://download.oracle.com/docs/cd/A84870_01/doc/server.816/a76961/ch111.htm]

Maybe you are looking for