Auditing SYS.AUD$ in Oracle 10g

We created a new 10g database and imported our 9i database schema into it. One of our application teams, used to run reports on the SYS.AUD$ table in Oracle 9i.
Currently in the new 10g database, they said they get an error saying table does not exist, which is probably to do with privileges and easily sorted.
However, when I checked the SYS.AUD$ table, there were no records in the table. When I then did a SHOW PARAMETER AUDIT, I got the following output
SQL> show parameter audit
NAME                                 TYPE        VALUE
audit_file_dest                      string      /Oracle10/admin/hpmslive/adump
audit_sys_operations                 boolean     FALSE
audit_syslog_level                   string
audit_trail                          string      DBI checked the /Oracle10/admin/hpmslive/adump directory and it contained lots of .aud files. So basically I think that is where the audit data is going. However why is it going to the OS, inspite of me having clearly said AUDIT_TRAIL=DB. I checked the AUDIT_FILE_DEST parameter and it says AUDIT_FILE_DEST specifies the operating system directory into which the audit trail is written when the AUDIT_TRAIL initialization parameter is set to os, xml, or xml,extended.
Considering that the AUDIT_TRAIL is set to DB, why is the audit being written to the AUDIT_FILE_DEST?
Regards
S Dhavan

You can answer the question on why audit_file_destination is set by looking in the Reference manual:
AUDIT_FILE_DEST specifies the operating system directory into which the audit trail is
written when the AUDIT_TRAIL initialization parameter is set to os, xml, or xml,extended.
The audit records will be written in XML format if the AUDIT_TRAIL initialization parameter
is set to XML. It is also the location to which mandatory auditing information is written and,
if so specified by the AUDIT_SYS_OPERATIONS initialization parameter, audit records for
user SYS.It is not a factor for your issue as you are writing to sys.aud$ based on whatever audit rules you have configured on the new instance.
HTH -- Mark D Powell --
edit (twice) in attemp to add CR to eliminate need to scrool
Edited by: Mark D Powell on Dec 22, 2009 9:14 AM
Edited by: Mark D Powell on Dec 22, 2009 9:16 AM

Similar Messages

AUDIT SYS.AUD$

Hi All,
We have audit in our database and we execute the following commands:
SQL> AUDIT ALL on SYS.AUD$;
Audit succeeded.
SQL> SELECT * from DBA_OBJ_AUDIT_OPTS;
OWNER                          OBJECT_NAME                    OBJECT_TYPE             ALT AUD COM DEL GRA IND INS LOC REN SEL UPD REF EXE CRE REA WRI FBK
SYS                            AUD$                           TABLE                   S/S S/S S/S S/S S/S S/S S/S S/S S/S S/S S/S -/- -/- -/- -/- -/- S/S
SQL> show parameter audit
NAME                                 TYPE        VALUE
audit_file_dest                      string      /opt/oracle/admin/INS_D_PS_NGB
                                                 _OFM/adump
audit_sys_operations                 boolean     FALSE
audit_syslog_level                   string
audit_trail                          string      DB
The problem is, client is saying audit is not completed as its not showing for all actions :
WRI REA CRE EXE REF it still showing -/-
how to enable audit for all above actions also?
Please suggest. thanks.
Regards,
Ankit

Ankit, not all auditable operations apply to all object types such as you cannot use the execute privilege against a table. Take another look at the what privileges are not showing.
HTH -- Mark D Powell --

Audit settings link in oracle 10g r1 enterprise manager

Hello,
Can anybody direct me where can I find "*Audit settings*" link in Enterprise manager?
Oracle version is *10g r1*.
In the book it's written, that "Audit settings" link is located in Administration tab, under Users & Privileges region. But the version of Oracle described in the book is 10g r2. I assume the name and location of the link is different in previous version.
thanks.

user467515 wrote:
Hello,
Can anybody direct me where can I find "*Audit settings*" link in Enterprise manager?
Oracle version is *10g r1*.
In the book it's written, that "Audit settings" link is located in Administration tab, under Users & Privileges region. But the version of Oracle described in the book is 10g r2. I assume the name and location of the link is different in previous version.
thanks.V10.1 was very buggy.
V10.1 & V10.2 are obsoleted & unsupported
consider upgrading to supported version V11.2

Regarding Auditing in Oracle 10g

Hi all,
i want to enable auditing for particular tables in oracle 10g(linux)..To enable auditing i have put
audit_trail=db
in init.ora files found in "/proc/4310/cwd" and "/proc/self/cwd/app/oracle/product/10.2.0/server/config/scripts"...
but im not getting any values in sys.aud$ table...
please tell me the way to get rid of this problem...
Thanx
in advance..

For Oracle 9 and later:
alter system set audit_trail = DB;
If you want to audit a specific user run the following:
audit alter table, select table, insert table, update table, delete table, grant table, grant
procedure by USERNAME;
To stop audit for that user run:
noaudit alter table, select table, insert table, update table, delete table, grant table,
grant procedure by USERNAME;
To enable auditing for a specific object do:
AUDIT SELECT, INSERT, UPDATE, DELETE ON SCHEMA.TABLE;
To stop auditing:
NOAUDIT SELECT, INSERT, UPDATE, DELETE ON SCHEMA.TABLE;
To see the results:
SQL> select * from dba_audit_trail;

Auditing in Oracle 10g

Hi,
OS = HP Unix
Datbase = 10.2.0.1
My management want me to enable auditing at database level.....It means, once i enabled the auditing at db level...it captures all the uses login,logout, what they are doing at database..everything in sys.aud$ table, dba_audit_trail tables...right...
If i enable it, i heard that there is performance problem...
Friends please share your experience....how are you maintaining auditing at your companies...
Please share your experience

There are so many levels of enabling auditing.
The "audit session" will be hardly noticed and will audit connections but as for auditing as you say "what they are doing" "everything" then you will consume large amounts of space and system resource and may need to move the AUD$ table from the SYSTEM tablespace into an AUDIT tablespace. How long will this audit data be kept; a purge job will be needed.? How much spare CPU capacity do you have. You will need to clear up the specific requirements from your management otherwise you will end up with GIG's of audit data very quickly. You may even want to think of placing it on own separate fast storage.
http://www.stanford.edu/dept/itss/docs/oracle/10g/server.101/b10759/statements_4007.htm
Review the examples in the manual.
N.B. Oracle do support moving AUD$ but refer to metalink for details they have docs showing how to......
Message was edited by:
triggb

How to find SQL Statement fired using SYS.AUD$ - Database Auditing

Dear Friends
I am having Oracle 9i Database and have configured it with database auditing option by setting the following parameter in init.ora file
AUDIT_TRAIL = "DB"
I want to audit SELECT, INSERT , UPDATE and DELETE operations on PRACTICE.EMP table for which I did :
1) Logged in as SYS
2) SQL> AUDIT SELECT, INSERT, UPDATE, DELETE
ON PRACTICE.EMP
BY ACCESS
WHENEVER SUCCESSFUL;
Audit Succedded
Now how should I find out the SQL statement that does the insert, update or delete operation on the EMP table using SYS.AUD$ table
Thanks

Hi,
It's contents can be viewed directly or via the following views:
* DBA_AUDIT_EXISTS
* DBA_AUDIT_OBJECT
* DBA_AUDIT_SESSION
* DBA_AUDIT_STATEMENT
* DBA_AUDIT_TRAIL
* DBA_OBJ_AUDIT_OPTS
* DBA_PRIV_AUDIT_OPTS
* DBA_STMT_AUDIT_OPTS
The audit trail contains a lot of data, but the following are most likely to be of interest:
* Username : Oracle Username.
* Terminal : Machine that the user performed the action from.
* Timestamp : When the action occured.
* Object Owner : The owner of the object that was interacted with.
* Object Name : The name of the object that was interacted with.
* Action Name : The action that occured against the object. (INSERT, UPDATE, DELETE, SELECT, EXECUTE)
So, take a look at action_name column from DBA_AUDIT_TRAIL view.
Cheers
Legatti

Auditing in oracle 10g database and oracle 10g application server

Dear friends,
We have oracle 10g application server and oracle 10g database server in place.My criteria is to audit users connected using oracle application user credentials to the database.
Can you please tell me how can i do it.
Thanks & regards,

Its the database connection you want to track. The session audit will show where it came from.
Auditing is turned using this command:
alter system set audit_trail = DB scope=spfile;
Note: The use of spfile will require a DB bounce before audit starts
To audit Sessions:
audit create session;
Query by Audit Type:
SELECT A.USERNAME,
OS_USERNAME,
A.TIMESTAMP,
A.RETURNCODE,
TERMINAL,
USERHOST
FROM DBA_AUDIT_SESSION A
WHERE USERHOST = <replace with iAS servername> ;
By User
SELECT USERNAME,OBJ_NAME,ACTION_NAME , TIMESTAMP
FROM DBA_AUDIT_TRAIL WHERE USERNAME = 'SCOTT';
Check for users sharing database accounts
select count(distinct(terminal)),username
from dba_audit_session
having count(distinct(terminal))>1
group by username;
Attempts to access the database at unusual hours
SELECT username, terminal, action_name, returncode,
TO_CHAR (TIMESTAMP, 'DD-MON-YYYY HH24:MI:SS'),
TO_CHAR (logoff_time, 'DD-MON-YYYY HH24:MI:SS')
FROM dba_audit_session
WHERE TO_DATE (TO_CHAR (TIMESTAMP, 'HH24:MI:SS'), 'HH24:MI:SS') <
TO_DATE ('08:00:00', 'HH24:MI:SS')
OR TO_DATE (TO_CHAR (TIMESTAMP, 'HH24:MI:SS'), 'HH24:MI:SS') >
TO_DATE ('19:30:00', 'HH24:MI:SS');
Attempts to access the database with non-existent users
SELECT username, terminal, TO_CHAR (TIMESTAMP, 'DD-MON-YYYY HH24:MI:SS')
FROM dba_audit_session
WHERE returncode <> 0
AND NOT EXISTS (SELECT 'x'
FROM dba_users
WHERE dba_users.username = dba_audit_session.username);
Other audits you might consider:
audit grant any object privilege;
audit alter user;
audit create user;
audit drop user;
audit drop tablespace;
audit grant any role;
audit grant any privilege;
audit alter system;
audit alter session;
audit delete on AUD$ by access;
audit insert on AUD$ by access;
audit update on AUD$ by access;
audit delete table;
audit create tablespace;
audit alter database;
audit create role;
audit create table;
audit alter any procedure;
audit create view;
audit drop any procedure;
audit drop profile;
audit alter profile;
audit alter any table;
audit create public database link;
Best Regards
mseberg

Oracle 10g DB connecting for sys,system but not for other users

Hi,
I have oracle 10g in Windows XP. I am able to connect to database using sys/pwd@db as sysdba. All SYSDBA users able to connect DB.
When I try to connect using user, Its not throwing any error but not connecting. Just the cursor is blinking...
How to fix this issue.
Thanks in advance
-Mani

Hi,
I didnt see any error message in alert log. Its not logging any message while connecting DB using SYSDBA.
My DB is in NOARCHIVELOG mode.
Sill non DBA users are not able to login.
what could be the reason for this issue?
Any help....
Below is my alert log......
Dump file d:\oracle\product\10.1.0\admin\orcl10g\bdump\alert_orcl10g.log
Sat Apr 26 13:51:24 2008
ORACLE V10.1.0.2.0 - Production vsnsta=0
vsnsql=13 vsnxtr=3
Windows XP Version V5.1 Service Pack 2
CPU : 2 - type 586
Process Affinity: 0x00000000
Memory (A/P) : PH:270M/1014M, PG:852M/2441M, VA:1959M/2047M
Sat Apr 26 13:51:24 2008
Starting ORACLE instance (normal)
LICENSE_MAX_SESSION = 0
LICENSE_SESSIONS_WARNING = 0
Picked latch-free SCN scheme 2
KCCDEBUG_LEVEL = 0
Using LOG_ARCHIVE_DEST_10 parameter default value as USE_DB_RECOVERY_FILE_DEST
Autotune of undo retention is turned on.
Dynamic strands is set to TRUE
Running with 2 shared and 18 private strand(s). Zero-copy redo is FALSE
IMODE=BR
ILAT =18
LICENSE_MAX_USERS = 0
SYS auditing is disabled
Starting up ORACLE RDBMS Version: 10.1.0.2.0.
System parameters with non-default values:
processes = 150
shared_pool_size = 83886080
large_pool_size = 8388608
java_pool_size = 50331648
resource_manager_plan = INTERNAL_QUIESCE
control_files = D:\ORACLE\PRODUCT\10.1.0\ORADATA\ORCL10G\CONTROL01.CTL, D:\ORACLE\PRODUCT\10.1.0\ORADATA\ORCL10G\CONTROL02.CTL, D:\ORACLE\PRODUCT\10.1.0\ORADATA\ORCL10G\CONTROL03.CTL
db_block_size = 8192
db_cache_size = 25165824
compatible = 10.1.0.2.0
db_file_multiblock_read_count= 16
db_recovery_file_dest = D:\oracle\product\10.1.0\flash_recovery_area
db_recovery_file_dest_size= 2147483648
undo_management = AUTO
undo_tablespace = UNDOTBS1
remote_login_passwordfile= EXCLUSIVE
db_domain =
dispatchers = (PROTOCOL=TCP) (SERVICE=orcl10gXDB)
job_queue_processes = 10
background_dump_dest = D:\ORACLE\PRODUCT\10.1.0\ADMIN\ORCL10G\BDUMP
user_dump_dest = D:\ORACLE\PRODUCT\10.1.0\ADMIN\ORCL10G\UDUMP
core_dump_dest = D:\ORACLE\PRODUCT\10.1.0\ADMIN\ORCL10G\CDUMP
sort_area_size = 65536
db_name = orcl10g
open_cursors = 300
pga_aggregate_target = 25165824
PMON started with pid=2, OS id=1840
MMAN started with pid=3, OS id=4044
DBW0 started with pid=4, OS id=2324
LGWR started with pid=5, OS id=3460
CKPT started with pid=6, OS id=720
SMON started with pid=7, OS id=964
RECO started with pid=8, OS id=1780
Sat Apr 26 13:51:24 2008
starting up 1 dispatcher(s) for network address '(ADDRESS=(PARTIAL=YES)(PROTOCOL=TCP))'...
CJQ0 started with pid=9, OS id=232
Sat Apr 26 13:51:24 2008
starting up 1 shared server(s) ...
Sat Apr 26 13:51:25 2008
alter database mount exclusive
Sat Apr 26 13:51:25 2008
Controlfile identified with block size 16384
Sat Apr 26 13:51:29 2008
Setting recovery target incarnation to 2
Sat Apr 26 13:51:29 2008
Successful mount of redo thread 1, with mount id 837414429
Sat Apr 26 13:51:29 2008
Database mounted in Exclusive Mode.
Completed: alter database mount exclusive
Sat Apr 26 13:51:29 2008
alter database open
Sat Apr 26 13:51:29 2008
Beginning crash recovery of 1 threads
attempting to start a parallel recovery with 2 processes
parallel recovery started with 2 processes
Sat Apr 26 13:51:30 2008
Started first pass scan
Sat Apr 26 13:51:30 2008
Completed first pass scan
2 redo blocks read, 3 data blocks need recovery
Sat Apr 26 13:51:30 2008
Started redo application at
Thread 1: logseq 199, block 6043, scn 0.0
Recovery of Online Redo Log: Thread 1 Group 3 Seq 199 Reading mem 0
Mem# 0 errs 0: D:\ORACLE\PRODUCT\10.1.0\ORADATA\ORCL10G\REDO03.LOG
Sat Apr 26 13:51:30 2008
Completed redo application
Sat Apr 26 13:51:30 2008
Completed crash recovery at
Thread 1: logseq 199, block 6045, scn 0.1325285
3 data blocks read, 3 data blocks written, 2 redo blocks read
Sat Apr 26 13:51:31 2008
Thread 1 advanced to log sequence 200
Maximum redo generation record size = 120832 bytes
Maximum redo generation change vector size = 116476 bytes
Private_strands 7 at log switch
Thread 1 opened at log sequence 200
Current log# 1 seq# 200 mem# 0: D:\ORACLE\PRODUCT\10.1.0\ORADATA\ORCL10G\REDO01.LOG
Successful open of redo thread 1
Sat Apr 26 13:51:31 2008
MTTR advisory is disabled because FAST_START_MTTR_TARGET is not set
Sat Apr 26 13:51:31 2008
SMON: enabling cache recovery
Sat Apr 26 13:51:32 2008
Successfully onlined Undo Tablespace 1.
Sat Apr 26 13:51:32 2008
SMON: enabling tx recovery
Sat Apr 26 13:51:32 2008
Database Characterset is WE8MSWIN1252
Sat Apr 26 13:51:32 2008
Published database character set on system events channel
Sat Apr 26 13:51:33 2008
All processes have switched to database character set
Sat Apr 26 13:51:35 2008
Starting background process QMNC
QMNC started with pid=15, OS id=2160
Sat Apr 26 13:51:37 2008
replication_dependency_tracking turned off (no async multimaster replication found)
Sat Apr 26 13:51:38 2008
Starting background process MMON
Starting background process MMNL
MMON started with pid=16, OS id=3952
MMNL started with pid=17, OS id=3960
Sat Apr 26 13:51:39 2008
Completed: alter database open
Sat Apr 26 13:51:43 2008
db_recovery_file_dest_size of 2048 MB is 0.00% used. This is a
user-specified limit on the amount of space that will be used by this
database for recovery-related files, and does not reflect the amount of
space available in the underlying filesystem or ASM diskgroup.

WLS 8.1 - Entity Beans CMP - Oracle 10g Audit Tool

Hi,
We are defining the architecture of a new application on WebLogic Server 8.1 and Oracle 10g.
We are thinking in using CMP Entity Beans and we need to integrate our system with Oracle Audit Tool.
Can anybody give us some information about this issue ?
Thanks,
Javier Cano

I really don't see the point of using CMP with an expensive, fully featured database like Oracle. MySQL or a flat file maybe. Otherwise it is just a waste of purchased resources.

Oracle 10g R 10.2 for Linux x86-64 - /proc/sys/vm/disable_cap_mlock problem

Hi All,
During installation - Oracle Database Configuration Assistance, I have got below error and thus I stuck. As per Metalink note 293988.1, this will be resolved if I do [root@localhos]# echo 1 > /proc/sys/vm/disable_cap_mlock . But problem is when I do this because I dont have /proc/sys/vm/disable_cap_mlock file in my system, it giving ¨bash: /proc/sys/vm/disable_cap_mlock: No such file or directory¨ error. So I am unable to get rid of this error. I also set SELinux Default and Current mode as permissible and rebooted it.
No use, Its giving same error.
ORA-27125: Unable to create shared memory segment.
DB Details_
Oracle 10g Release 2 (10.2) for Linux x86-64
Choosen Basic Installation
OS Details:_
*[root@localhost vm]# uname -rm*
2.6.32-100.0.19.el5 x86_64
*[root@localhost vm]# uname -a*
Linux localhost.localdomain 2.6.32-100.0.19.el5 #1 SMP Fri Sep 17 17:51:41 EDT 2010 x86_64 x86_64 x86_64 GNU/Linux
*[root@localhost etc]# cat /etc/redhat-release*
Red Hat Enterprise Linux Server release 5.5 (Tikanga)
*[root@localhost etc]# make -v*
GNU Make 3.81
Copyright (C) 2006 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.
There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A
PARTICULAR PURPOSE.
This program built for x86_64-redhat-linux-gnu
This is bugging me since last two days. Any help would be appreciated.
Thanks in advance.
Regards,
Mahi

From what I can gather form your post, the ORA-27125: Unable to create shared memory segment is probably the result of:
a) not enough physical memory available.
b) /dev/shm not configured properly.
c) kernel parameters are not set according to Oracle requirements.
Since this is happening during the installation of Oracle I suggest to check the SHMMAX kernel parameter. This is all mentioned in the pre-installation steps. Oracle 11g will actually check these kernel parameters prior to installing. Not sure about 10g now, which you are trying to install.
The most common, easiest way to prepare the system for Oracle RDBMS is to install the "oracle-validated" package. If you don't have access to ULN, you can setup public yum.
http://public-yum.oracle.com/ Then you can simply type as the root user: yum install oracle-validated
Edited by: waldorfm on Nov 3, 2010 1:18 PM

Audit in Oracle 10g

Hello,
Just a quick question,
I setup the audit for one oracle user on Oracle 10G :
AUDIT ALL BY myuser BY ACCESS;
AUDIT SELECT TABLE, UPDATE TABLE, INSERT TABLE, DELETE TABLE BY myuser BY ACCESS;
AUDIT EXECUTE PROCEDURE BY myuser BY ACCESS;
now, Where can I found the information about the audit? in which views?
Thanks all,;

SQL> show parameter audit
NAME                                 TYPE        VALUE
audit_file_dest                      string      /u01/app/oracle/admin/TEST/adump
audit_syslog_level                   string
audit_sys_operations                 boolean     FALSE
audit_trail                          string      NONE
SQL>

Disable audit in oracle 10g R2

can any one help me out how to disable audit in oracle 10g R2 ...
I've executed following commands
SQL> noaudit session by DEBIT;
Noaudit succeeded.
SQL> noaudit session by DEBIT;
Noaudit succeeded.
but audit is still running

What does this have to do with Audit Vault?
Where are you looking and what are you seeing that makes you believe auditing was not stopped?
We can not see you monitor.

SYS packages are invalid in oracle 10g (10.2.0.4)

I am using Oracle 10g (10.2.0.4) in AIX 6.1 server . According to OEM advice I remove the 'utl_file' privelege
from PUBLIC user . In that moment I get some packages of the 'SYS' schema invalid . I again give the
grant permission of the 'UTL_FILE' to PUBLIC user but packages of the SYS schema are remain invalid .
I compile the packages several times but the problem in not solved . If one package make valid
then other package goes to INVALID during compiling . In this moment, How can I Enable the
SYS user's package .The problem is related only with the packages & views now ...
Would anybody plz help me now ...

shipon_97 wrote:
I am using Oracle 10g (10.2.0.4) in AIX 6.1 server . According to OEM advice I remove the 'utl_file' privelege
from PUBLIC user . In that moment I get some packages of the 'SYS' schema invalid . I again give the
grant permission of the 'UTL_FILE' to PUBLIC user but packages of the SYS schema are remain invalid .
I compile the packages several times but the problem in not solved . If one package make valid
then other package goes to INVALID during compiling . In this moment, How can I Enable the
SYS user's package .The problem is related only with the packages & views now ...
Would anybody plz help me now ...Try compiling all the objects with "UTLRP.sql" on the server, then check invalid objects.
conn / as sysdba
@?/rdbms/admin/utlrp.sql Regards
Z.K.
http://oracleendeavor.blogspot.com/

ORACLE 10g generate reports for audit trail

HELP ORACLE 10 g
I am a beginner about the oracle 10g
anybody can guide me how to start with
generate reports for audit trail , top ten url
, no of hits in the portlets ......
=(
thank you ....

In a nutshell:
1 - You will have to have the portal database schema as your data source.
2 - You will have to design a target database schema with the target data bjects (tables, dimensions and fact tables - cubes) where the data will be loaded for reporting purposes.
3 - Then you will have to model the loading process by defining mappings (mappings will translate into generated code for the load process) and process flows to run the mappings in the right order etc.
4 - You will deploy the sources, targets and processing entities to the target schema.
5 - You will run the deployed code periodically as needed and maintain the source, target and loading entities which might change with time.
One observetion - OWB does not produce reports. It creates and maintains the data infrastructure for a reporting/analysis system (a data warehouse, data mart or an operational data store). To produce reports (for example, the top-10 report mentioned by you), you will have to run a reporting tool on top of the data structures created and maintained by OWB.
Regards:
Igor

Export "sys.aud$" table as system user using datapump

Friends,
I want to export (using datapump 'expdp') the sys user's AUD$ table (sys.aud$) as the system
user . But it shows the following error :
bash-3.00$ expdp system/sys123@onlinete directory=test_dir TABLES=sys.AUD$ DUMPFILE=sysaud.$Date.dmp logfile=audit.$date.log
Export: Release 10.2.0.1.0 - 64bit Production on Wednesday, 14 January, 2009 13:30:56
Copyright (c) 2003, 2005, Oracle. All rights reserved.
Connected to: Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - 64bit Production
With the Partitioning, OLAP and Data Mining options
Starting "SYSTEM"."SYS_EXPORT_TABLE_01": system/********@onlinete directory=test_dir TABLES=sys.AUD$ DUMPFILE=sysaud..dmp logfile=audit..log
Estimate in progress using BLOCKS method...
Processing object type TABLE_EXPORT/TABLE/TABLE_DATA
Total estimation using BLOCKS method: 0 KB
ORA-39165: Schema SYS was not found.
ORA-39166: Object AUD$ was not found.
ORA-31655: no data or metadata objects selected for job
Job "SYSTEM"."SYS_EXPORT_TABLE_01" completed with 3 error(s) at 13:31:01
It also shows error when I take it as SYS user :
bash-3.00$ expdp sys/sys123@onlinete directory=test_dir TABLES=sys.AUD$ DUMPFILE=sysaud.$Date.dmp logfile=audit.$date.log
Export: Release 10.2.0.1.0 - 64bit Production on Wednesday, 14 January, 2009 13:35:19
Copyright (c) 2003, 2005, Oracle. All rights reserved.
UDE-00008: operation generated ORACLE error 28009
ORA-28009: connection as SYS should be as SYSDBA or SYSOPER
Username: sys/sys123 as sysdba
Connected to: Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - 64bit Production
With the Partitioning, OLAP and Data Mining options
Starting "SYS"."SYS_EXPORT_TABLE_01": sys/******** AS SYSDBA directory=test_dir TABLES=sys.AUD$ DUMPFILE=sysaud..dmp logfile=audit..log
Estimate in progress using BLOCKS method...
Processing object type TABLE_EXPORT/TABLE/TABLE_DATA
Total estimation using BLOCKS method: 0 KB
ORA-39165: Schema SYS was not found.
ORA-39166: Object AUD$ was not found.
ORA-31655: no data or metadata objects selected for job
Job "SYS"."SYS_EXPORT_TABLE_01" completed with 3 error(s) at 13:35:29
I dont understand the problem why it is not working . Need advice plz ... ...

But that's not fair..
Imagine the situation, where I figured out that some data was edited a year ago, but I don't know by whom.. Audit was enabled at that time, I was exporting (using the regular exp) AUD$ table during the year, everything is good.. BUT.. Two months ago I upgraded my DB to 11g. Hence I cannot use imp in order to restore the table and see what was going on a year ago.. That means that I always have to have an ability to create 10g database in order to use my AUD$ export??
Is there any other way of backing up this table? Sop far I was doing exp+truncate, but since 11g release where exp/imp are not supported I am trying to think about another way of dealing with the audit...
does anybody have ideas about it?
thanks,
M

Auditing SYS.AUD$ in Oracle 10g

Similar Messages

Maybe you are looking for