How to find the user who dropped the tables

Question

Hi All,
Some one has dropped 5 tables in the production database that has caused a SEV1 but thankfully we are having those tables in recyclebin and we are restored those with out data loss.
But I want to know who has dropped those tables and want to know who has connected to database at that time. Can you please guide me in this how to find out....
Database version: 11.2.0.2 version
Thanks
Kk
Edited by: 908098 on Jan 18, 2012 4:23 AM

Answer 1

Or you can use this kind of audit (i had used this some time ago)
-is pretty detailed but is good for auditing purpuse.
hope this helps
CREATE TABLE AUDITORIA_ESQUEMA (
operation VARCHAR2(30),
os_user VARCHAR2(30),
obj_owner VARCHAR2(30),
object_name VARCHAR2(30),
object_type VARCHAR2(30),
sql_text     VARCHAR2(64),
attempt_by VARCHAR2(30),
attempt_dt DATE,
Ip_adress VARCHAR2(15));
CREATE OR REPLACE TRIGGER AUDITORIA_ESQUEMA
BEFORE CREATE OR ALTER OR DROP OR RENAME or alter
ON DATABASE
DECLARE
oper varchar2(200);
sql_text ora_name_list_t;
i      PLS_INTEGER;
BEGIN
SELECT ora_sysevent
INTO oper
FROM DUAL;
i := sql_txt(sql_text);
IF oper IN ('CREATE', 'DROP','RENAME','ALTER') THEN
     INSERT INTO AUDITORIA_ESQUEMA
     SELECT ora_sysevent,(select sys_context('USERENV','OS_USER') from dual)
, ora_dict_obj_owner,
     ora_dict_obj_name,ora_dict_obj_type, sql_text(1), USER, SYSDATE,
     (select SYS_CONTEXT('USERENV', 'IP_ADDRESS') from dual)
     FROM DUAL;
ELSIF oper = 'ALTER' THEN
     INSERT INTO AUDITORIA_ESQUEMA
     SELECT ora_sysevent,(select sys_context('USERENV','OS_USER') from dual)
, ora_dict_obj_owner,
     ora_dict_obj_name,ora_dict_obj_type, sql_text(1), USER, SYSDATE,
     (select SYS_CONTEXT('USERENV', 'IP_ADDRESS') from dual)
     FROM sys.gv_$sqltext
     WHERE UPPER(sql_text) LIKE 'ALTER%'
     AND UPPER(sql_text) LIKE '%NEW_TABLE%';
END IF;
END AUDITORIA_ESQUEMA;