How to find SQL Statement fired using SYS.AUD$ - Database Auditing

Question

Dear Friends
I am having Oracle 9i Database and have configured it with database auditing option by setting the following parameter in init.ora file
AUDIT_TRAIL = "DB"
I want to audit SELECT, INSERT , UPDATE and DELETE operations on PRACTICE.EMP table for which I did :
1) Logged in as SYS
2) SQL> AUDIT SELECT, INSERT, UPDATE, DELETE
ON PRACTICE.EMP
BY ACCESS
WHENEVER SUCCESSFUL;
Audit Succedded
Now how should I find out the SQL statement that does the insert, update or delete operation on the EMP table using SYS.AUD$ table
Thanks

Answer 1

Hi,
It's contents can be viewed directly or via the following views:
* DBA_AUDIT_EXISTS
* DBA_AUDIT_OBJECT
* DBA_AUDIT_SESSION
* DBA_AUDIT_STATEMENT
* DBA_AUDIT_TRAIL
* DBA_OBJ_AUDIT_OPTS
* DBA_PRIV_AUDIT_OPTS
* DBA_STMT_AUDIT_OPTS
The audit trail contains a lot of data, but the following are most likely to be of interest:
* Username : Oracle Username.
* Terminal : Machine that the user performed the action from.
* Timestamp : When the action occured.
* Object Owner : The owner of the object that was interacted with.
* Object Name : The name of the object that was interacted with.
* Action Name : The action that occured against the object. (INSERT, UPDATE, DELETE, SELECT, EXECUTE)
So, take a look at action_name column from DBA_AUDIT_TRAIL view.
Cheers
Legatti