Export "sys.aud$" table as system user using datapump

Friends,
I want to export (using datapump 'expdp') the sys user's AUD$ table (sys.aud$) as the system
user . But it shows the following error :
bash-3.00$ expdp system/sys123@onlinete directory=test_dir TABLES=sys.AUD$ DUMPFILE=sysaud.$Date.dmp logfile=audit.$date.log
Export: Release 10.2.0.1.0 - 64bit Production on Wednesday, 14 January, 2009 13:30:56
Copyright (c) 2003, 2005, Oracle. All rights reserved.
Connected to: Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - 64bit Production
With the Partitioning, OLAP and Data Mining options
Starting "SYSTEM"."SYS_EXPORT_TABLE_01": system/********@onlinete directory=test_dir TABLES=sys.AUD$ DUMPFILE=sysaud..dmp logfile=audit..log
Estimate in progress using BLOCKS method...
Processing object type TABLE_EXPORT/TABLE/TABLE_DATA
Total estimation using BLOCKS method: 0 KB
ORA-39165: Schema SYS was not found.
ORA-39166: Object AUD$ was not found.
ORA-31655: no data or metadata objects selected for job
Job "SYSTEM"."SYS_EXPORT_TABLE_01" completed with 3 error(s) at 13:31:01
It also shows error when I take it as SYS user :
bash-3.00$ expdp sys/sys123@onlinete directory=test_dir TABLES=sys.AUD$ DUMPFILE=sysaud.$Date.dmp logfile=audit.$date.log
Export: Release 10.2.0.1.0 - 64bit Production on Wednesday, 14 January, 2009 13:35:19
Copyright (c) 2003, 2005, Oracle. All rights reserved.
UDE-00008: operation generated ORACLE error 28009
ORA-28009: connection as SYS should be as SYSDBA or SYSOPER
Username: sys/sys123 as sysdba
Connected to: Oracle Database 10g Enterprise Edition Release 10.2.0.1.0 - 64bit Production
With the Partitioning, OLAP and Data Mining options
Starting "SYS"."SYS_EXPORT_TABLE_01": sys/******** AS SYSDBA directory=test_dir TABLES=sys.AUD$ DUMPFILE=sysaud..dmp logfile=audit..log
Estimate in progress using BLOCKS method...
Processing object type TABLE_EXPORT/TABLE/TABLE_DATA
Total estimation using BLOCKS method: 0 KB
ORA-39165: Schema SYS was not found.
ORA-39166: Object AUD$ was not found.
ORA-31655: no data or metadata objects selected for job
Job "SYS"."SYS_EXPORT_TABLE_01" completed with 3 error(s) at 13:35:29
I dont understand the problem why it is not working . Need advice plz ... ...

But that's not fair..
Imagine the situation, where I figured out that some data was edited a year ago, but I don't know by whom.. Audit was enabled at that time, I was exporting (using the regular exp) AUD$ table during the year, everything is good.. BUT.. Two months ago I upgraded my DB to 11g. Hence I cannot use imp in order to restore the table and see what was going on a year ago.. That means that I always have to have an ability to create 10g database in order to use my AUD$ export??
Is there any other way of backing up this table? Sop far I was doing exp+truncate, but since 11g release where exp/imp are not supported I am trying to think about another way of dealing with the audit...
does anybody have ideas about it?
thanks,
M

Similar Messages

Is there a way to include the sys.aud$ table in a full database dp export?

I am doing an export using the following parfile information:
userid=/
directory=datapump_nightly_export
dumpfile=test_expdp.dmp
logfile=test_expdp.log
full=y
content=all
However when I run this I do not see the sys.aud$ in the log file. I know I can do a seperate export to specifically get the sys.aud$ table but is there any way to include it in with my full export?
Thanks in advance for any suggestion.

here's more background infomation... I have some audits setup on my database for one of my users. Every quarter I have an automated job that runs that creates a usage/statics report for this person using data in aud$. at the end of the job I export the aud$ table and truncate it. However last quarter I found that there was a mistake in my report and my export did not run properly thus my audit data was gone. i also have full datapump exports that run daily but found that aud$ was not there. so that is why I thought I'd like to include sys.aud$ in the full datapump exports.
i understand why other sys tables would be left out of a full export but aud$ data cannot be reproduced so to me it makes sense to include it in a full export.
don't worry, we run our true backups using rman which is eventually how I got the aud$ data back by creating a copy of my database up until the time of the truncate. however this was quite time consuming.

Sys.aud$ table

Hi,
I need to get the auditing information for the last seven days fron the auditing table for users other than apps.I tried the below query.Please correct me if it is wrong.The query takes
a long time to execute and no output dispayed.Please inform me whether the below query is correct and inform me if i need to do any modifications.
select userid,userhost,terminal,action#,obj$name, NTIMESTAMP# from sys.aud$ where action#=3 and timestamp# >=(sysdate-7) and userid not in ('APPS') order by ntimestamp# desc;
Regards
Aram

You are SELECTing and ORDERing using column NTIMESTAMP#, but WHERE clause is using TIMESTAMP# (different column), most likely leading to a poor execution plan. Is the statement you posted syntactically correct ?
MOS Doc 1025314.6 - Descriptions of Action Code and Privileges Used in Fields in SYS.AUD$ Table
HTH
Srini

Sys.aud$ Table not accesible over PL/SQL ?

I try to do the follow.
When you start the auditing with specific command like AUDIT
SESSION; it will produce many many rows in the sys.aud$ table.
This is the reason while we need to maintain the data witch exist
then in thsi table.
I did try it to do this with a separate user like AUDITER.
I gave them from the sys user the follow permissions:
GRANT select, delete, update , insert to AUDITER;
If i try now to select from SYS.AUD$ it works if i do it with a
separet select statement like :
SELECT * FROM SYS.AUD$.
If i make a PROCEDURE like folow :
PROCEDURE proceed_audit as
CURSOR audtab is select * from sys.aud$
BEGIN
END;
Oracle generate the message :
PLS-00201: identifier 'SYS.AUD$' must be declared
I don't anderstand this message, becose this object exists and in
"SQL" i can use it.
Can anyone help me ?
Thanks
P.S. it's the Oracle version 8.1.7i

Are you sure the user that is executing the PL/SQL block has
direct grants to the tables you are referencing? I.E. NOT
through a role? PL/SQL requires the user to have direct grants
to the object it references. Granting DBA to the user won't have
any affect on the execution of the PL/SQL

Strange issue on deleting some rows on SYS.AUD$ table

I just found out this strange thing happened on my 10gR2 database. I created a user called AUDIT_LOG and GRANT DELETE, REFERENCES, SELECT ON SYS.AUD$ TO AUDIT_LOG when I logged on as SYS dba.
(1) Then I logged on as AUDIT_LOG user, tested the following statements:
SELECT count(*) from sys.aud$ where ntimestamp# < TRUNC (SYSDATE-14);
COUNT(*)
2
DELETE from sys.aud$ where ntimestamp# < TRUNC(SYSDATE-14);
0 rows deleted
(2) When I logged on as SYS account, SYS deleted them all,
DELETE from sys.aud$ where ntimestamp# < TRUNC(SYSDATE-14);
2 rows deleted
I don't understand why the AUDIT_LOG user can't delete that two rows?
Thanks for your help!
lixidon

Apologies for misreading the first time. I am wondering if the rows in question were related to audit actions on sys.aud$ itself as those rows should not be deleted by the AUDIT_LOG user (even if the user has been granted delete).
Here's an excerpt from the Security Guide under the "Protecting the Standard Audit Trail" section:
Audit records generated as a result of object audit options set for the SYS.AUD$ table can only be deleted from the audit trail by someone connected with administrator privileges, which itself has protection against unauthorized use.
Here's a quick example illustrating this:
SQL> connect / as sysdba
Connected.
SQL> grant delete, references, select on sys.aud$ to scott;
Grant succeeded.
SQL> connect scott/tiger
Connected.
SQL> select count(*) from sys.aud$ where sessionid = 30002;
COUNT(*)
2
1 row selected.
SQL> delete from sys.aud$ where sessionid = 30002;
2 rows deleted.
SQL> commit;
-- now try to delete the sys.aud$ rows related to the above delete
-- this will not succeed as user scott even though delete has been granted
-- the session that performed the delete is 422426
SQL> select count(*) from sys.aud$ where obj$name = 'AUD$' and action# = 7 and sessionid = 422426;
COUNT(*)
2
1 row selected.
SQL> delete from sys.aud$ where obj$name = 'AUD$' and action# = 7 and sessionid = 422426;
0 rows deleted.
SQL>Regards,
Mark

Aud$ table in system schema????

Dear all.
Facts: oracle 9204 enterprise. Data guard config.
OS. AIX 5.3
Some weeks ago i started to manage a database with the facts describe above. Well. I was viewing the config and i saw a strange configuration...
My table AUD$ is in the system schema.
There aren't AUD$ table in SYS schema.
Exists a synonym sys.aud$ for system.aud$.
I knew that this table exists en SYS schema and from time to time we can move the records into another schema for storage and performance. But in SYSTEM schema?
Or exists a parameter in 9i that can i configure that ???
Thanks a lot !!!!
ps. apologize my english is not very well !!! =)

It is quite possible that the AUD$ table was moved from the SYS schema into the SYSTEM schema. See these MOS Docs
1019377.6 - Script to move SYS.AUD$ table out of SYSTEM tablespace
72460.1 - Moving AUD$ to Another Tablespace and Adding Triggers to AUD$
HTH
Srini

What is sessionid field in SYS.AUD$ table

Hi,
Can anyone say,what is sessionid field in sys.aud$ table..It seems different than the sessions

Look at the session value in sys.aud$ table.
QL> select sessionid from sys.aud$ where rownum<10;
SESSIONID
459521060
459521607
459521661
459521901
459521954
459522004
459522052
459522262
459522424
It seems that,its not asession id.Mostly sessionid length ll be in3-4.

Create a new table maintenable by user using SM30 transaction

Hi,
is it possible to create a new table maintenable by user using sm30 transaction with class C without opening the customizing each time there is a modification to do.
thank you.

Hi,
u told u alredy create table and corresponding view. Now u can follw below this process.........
go to se11.
go to menu Utilities ->table maint. generator.
after that u will go to menu -> Environment -> maintence Object -> Generate.
then u select category -> CUSY
Transport -> 2 automatic transport
Adjustment-> automatically adjustment
then save it and create T. code .
I think your problem will be solve.
Regards,
Tarapada D.

How to export and Import table of another user from user system using expdp

Hi All,
How to export a table 'scott.emp' from system user.
expdp system/password directory=expdp dumpfile=scott_emp.dmp ???? ?? tables=emp ??????????????????????????
thank you
---------------------------------------------------------- Posting solution here to make needed users not to scroll down ------------------------------------------------------
Finally I got it right!!!
Task :- Export table_1 of schema_a from database db1 and Import it to schema_b of database db2 as user other than schema owner
Solution :-
expdp system/pwd directory=expdp tables=schema_a.table_1 dumpfile=schema_a.table_1.dmp logfile=expdp_schema_a.table_1.log
impdp system/pwd directory=expdp tables=schema_a.table_1 dumpfile=schema_a.table_1.dmp logfile=impdp_schema_a.table_1.log remap_schema=schema_a:schema_b remap_tablespace=table_1_tablespace:schema_b_tablespace
Thank You All
Edited by: Ven on Mar 9, 2011 7:52 AM

Just a example
SQL> $expdp system/sys directory=data_pump_dir dumpfile=tests.dmp tables=scott.emp
Export: Release 11.2.0.1.0 - Production on Tue Mar 8 10:39:57 2011
Copyright (c) 1982, 2009, Oracle and/or its affiliates. All rights reserved.
Connected to: Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
Starting "SYSTEM"."SYS_EXPORT_TABLE_01": system/******** directory=data_pump_dir dumpfile=tests.dmp tables=scott.emp
Estimate in progress using BLOCKS method...
Processing object type TABLE_EXPORT/TABLE/TABLE_DATA
Total estimation using BLOCKS method: 64 KB
Processing object type TABLE_EXPORT/TABLE/TABLE
Processing object type TABLE_EXPORT/TABLE/INDEX/INDEX
Processing object type TABLE_EXPORT/TABLE/CONSTRAINT/CONSTRAINT
Processing object type TABLE_EXPORT/TABLE/INDEX/STATISTICS/INDEX_STATISTICS
Processing object type TABLE_EXPORT/TABLE/CONSTRAINT/REF_CONSTRAINT
Processing object type TABLE_EXPORT/TABLE/STATISTICS/TABLE_STATISTICS
. . exported "SCOTT"."EMP" 8.570 KB 14 rows
Master table "SYSTEM"."SYS_EXPORT_TABLE_01" successfully loaded/unloaded
Dump file set for SYSTEM.SYS_EXPORT_TABLE_01 is:
C:\APP\MAZAR\ADMIN\ACEME\DPDUMP\TESTS.DMP
Job "SYSTEM"."SYS_EXPORT_TABLE_01" successfully completed at 10:40:01
SQL>

Unable to describe the table as system user

Hi,
I'm able to describe the below table as sys user but not able to do so as system user.
SQL> desc IA_MBR_ID_D;
Name Null? Type
MBR_ID_EDW_SK NOT NULL NUMBER
MBR_ID NOT NULL CHAR(3)
MBR_SBSCR_ALTN_ID NOT NULL VARCHAR2(13)
MBR_LST_NM VARCHAR2
MBR_FRST_NM VARCHAR2
MBR_MID_INIT VARCHAR2
MBR_EFF_DT DATE
MBR_CANC_DT DATE
MBR_BTH_DT DATE
MBR_GNDR_CD NOT NULL CHAR(1)
MBR_RLNSP_CD NOT NULL CHAR(1)
MBR_TYP_OF_CONTR_CD NOT NULL VARCHAR2(3)
MBR_UNIQ_MBR_ID NOT NULL VARCHAR2(26)
MBR_SHRT_UNIQ_MBR_ID NOT NULL VARCHAR2(16)
SQL> conn system/.....@<DB>
Connected.
SQL> desc IA_MBR_ID_D;
ERROR:
ORA-04043: object IA_MBR_ID_D does not exist
SEGMENT_NAME SEGMENT_TYPE OWNER
IA_MBR_ID_D TABLE EDW
IA_MBR_ID_D TABLE EDWSTG
Please share your thoughts.Not sure if this is a privilege issue as I'm not able to dec this as system user.
Regards,
VN

user7202581 wrote:
Hi,
I'm able to describe the below table as sys user but not able to do so as system user.
SQL> desc IA_MBR_ID_D;
Name Null? Type
MBR_ID_EDW_SK NOT NULL NUMBER
MBR_ID NOT NULL CHAR(3)
MBR_SBSCR_ALTN_ID NOT NULL VARCHAR2(13)
MBR_LST_NM VARCHAR2
MBR_FRST_NM VARCHAR2
MBR_MID_INIT VARCHAR2
MBR_EFF_DT DATE
MBR_CANC_DT DATE
MBR_BTH_DT DATE
MBR_GNDR_CD NOT NULL CHAR(1)
MBR_RLNSP_CD NOT NULL CHAR(1)
MBR_TYP_OF_CONTR_CD NOT NULL VARCHAR2(3)
MBR_UNIQ_MBR_ID NOT NULL VARCHAR2(26)
MBR_SHRT_UNIQ_MBR_ID NOT NULL VARCHAR2(16)
SQL> conn system/.....@<DB>
Connected.
SQL> desc IA_MBR_ID_D;
ERROR:
ORA-04043: object IA_MBR_ID_D does not exist
SEGMENT_NAME SEGMENT_TYPE OWNER
IA_MBR_ID_D TABLE EDW
IA_MBR_ID_D TABLE EDWSTG
Please share your thoughts.Not sure if this is a privilege issue as I'm not able to dec this as system user.
Regards,
VNconnect / as sysdba
SELECT OBJECT_TYPE, OWNER FROM DBA_OBJECTS WHERE OBJECT_NAME = 'IA_MBR_ID_D';
post results from SQL above

Querying the sys.aud$ table

can any one tell me which column of the sys.aud$ (audit trail) table is the one that shows when the grant occurred.
I did a desc sys.aud$ ,but i cannot tell which one is the right column.
thanks in advance

you can see view DBA_AUDIT_TRAIL, column timestamp.

Moving sys.aud$ to a different tablespace other than system

Hi,
I have a 10g RAC database system with a high volume of activity and would like to monitor a large slice of it using audit.
I have reviewed all options of audit trails and chose db, extended to be the most suitable for my purposes!
Ive noticed that all audit data goes to sys.aud$ table in system tablespace.
I have 3 questions:
1. What is the logic behind putting this table in systems tablespace and not sysaux (10g)?
2. Can I move sys.aud$ table to a different tablespace (should I expect trouble for doing so)?
3. Is there any RAC implication if I move sys.aud$ table to a different tablespace?
Regards,
Tal Olier
[email protected]

That's true, it's not recommanded to move a sys table... but we can find some good explanation for this one for aud$ table.<br>
See Metalink Note 72460.1 : Moving AUD$ to another tablespace and adding triggers to AUD$<br>
Or google search give some good results.<br>
Nicolas.

How to find SQL Statement fired using SYS.AUD$ - Database Auditing

Dear Friends
I am having Oracle 9i Database and have configured it with database auditing option by setting the following parameter in init.ora file
AUDIT_TRAIL = "DB"
I want to audit SELECT, INSERT , UPDATE and DELETE operations on PRACTICE.EMP table for which I did :
1) Logged in as SYS
2) SQL> AUDIT SELECT, INSERT, UPDATE, DELETE
ON PRACTICE.EMP
BY ACCESS
WHENEVER SUCCESSFUL;
Audit Succedded
Now how should I find out the SQL statement that does the insert, update or delete operation on the EMP table using SYS.AUD$ table
Thanks

Hi,
It's contents can be viewed directly or via the following views:
* DBA_AUDIT_EXISTS
* DBA_AUDIT_OBJECT
* DBA_AUDIT_SESSION
* DBA_AUDIT_STATEMENT
* DBA_AUDIT_TRAIL
* DBA_OBJ_AUDIT_OPTS
* DBA_PRIV_AUDIT_OPTS
* DBA_STMT_AUDIT_OPTS
The audit trail contains a lot of data, but the following are most likely to be of interest:
* Username : Oracle Username.
* Terminal : Machine that the user performed the action from.
* Timestamp : When the action occured.
* Object Owner : The owner of the object that was interacted with.
* Object Name : The name of the object that was interacted with.
* Action Name : The action that occured against the object. (INSERT, UPDATE, DELETE, SELECT, EXECUTE)
So, take a look at action_name column from DBA_AUDIT_TRAIL view.
Cheers
Legatti

AUD$ table export

Hi All,
Please help to export sys.aud$ and also how to find the size of aud$ table .Please suggest the query to execute these...
thanks

SQL> select sum(bytes)/(1024*1024) "Table size(MB)" from dba_segments where segment_name='AUD$' and owner='SYS';
Table size(MB)
6
C:\>exp 'sys/oracle as sysdba' tables=aud$ file=d:/aud$.dmp
Export: Release 11.2.0.1.0 - Production on Fri Jun 8 21:43:18 2012
Copyright (c) 1982, 2009, Oracle and/or its affiliates. All rights reserved.
Connected to: Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production
With the Partitioning, OLAP, Data Mining and Real Application Testing options
Export done in WE8MSWIN1252 character set and AL16UTF16 NCHAR character set
About to export specified tables via Conventional Path ...
. . exporting table AUD$ 64 rows exported
Export terminated successfully without warnings.But can I know why you want to export this table?

EM shows alert "User SYS logged on from node but no entry in SYS.AUD$

Hello,
When i look on the alert page of my databases i see sometimes the following message "User SYS logged on from <node>.
I have setup several audit actions, like "create session" to track sessions.
But in table SYS.AUD$ i see many records, but not the one of user SYS.
Why? Anyone an idea?
Best regards,
hvdtol

i understand it is comming from metrics, but i don't understand why i can see it in the sys.aud$ table.
hvdtol

Export "sys.aud$" table as system user using datapump

Similar Messages

Maybe you are looking for