Simple auditing question...

Question

Hello,
We are running 11.2.0.2 on AIX 7.1.
I'm trying to understand why our auditing is not behaving the way I think it should.
First, we have the default auditing turned on as part of 11GR2.
It seems to be capturing some things, but not always everything.
In some cases, it captures the creation of a table by a user, but in other cases, it may not.
Even though the same user created a table, or dropped a table.
Today, trying to figure this out, I created a test user and logged in as that test user (in SQL*Plus) and created a simple table, then inserted a record into it and did a commit. I then logged out.
But when I check the audit views, I don't see the audit actions, or even the session logon information.
I've checked using both Toad and by selecting from the dba_audit_objects and dba_audit_session views in SQL*Plus.
What am I missing?
That last DDL statement I see that was captured in the audit records was on July 20th.
In this case, it captured the drop and creation of a public synonym, but not of the underlying table that was also dropped.
I don't believe anyone has changed any of the audit settings.
First, let's confirm everything:
sho parameter audit
NAME                                 TYPE        VALUE
audit_file_dest                      string      /u01/app/oracle/admin/xxxxxxxx
                                                 /adump
audit_sys_operations                 boolean     FALSE
audit_syslog_level                   string
audit_trail                          string      DB
SQL> SELECT privilege from dba_priv_audit_opts where user_name is NULL;
PRIVILEGE
ALTER SYSTEM
AUDIT SYSTEM
CREATE SESSION
CREATE USER
ALTER USER
DROP USER
CREATE ANY TABLE
ALTER ANY TABLE
DROP ANY TABLE
CREATE PUBLIC DATABASE LINK
GRANT ANY ROLE
ALTER DATABASE
CREATE ANY PROCEDURE
ALTER ANY PROCEDURE
DROP ANY PROCEDURE
ALTER PROFILE
DROP PROFILE
GRANT ANY PRIVILEGE
CREATE ANY LIBRARY
EXEMPT ACCESS POLICY
GRANT ANY OBJECT PRIVILEGE
CREATE ANY JOB
CREATE EXTERNAL JOB
23 rows selected.
SQL> select object_name, object_type, owner, created from dba_objects where object_name = 'EXPENDABLE_USE';
OBJECT_NAME                      OBJECT_TYPE         OWNER                    CREATED
EXPENDABLE_USE                   SYNONYM             PUBLIC                   20-JUL-11
EXPENDABLE_USE                   TABLE               SISI                     20-JUL-11
2 rows selected.
Now, view the dba_audit_objects view:
  1   select os_username, username, timestamp, action_name from dba_audit_object where timestamp > sysdate-9
  2* order by timestamp desc
SQL> /
OS_USERNAME          USERNAME                 TIMESTAMP         ACTION_NAME
scmsrvacct           SISI                     20-JUL-2011 11:44 CREATE PUBLIC SYNONYM
scmsrvacct           SISI                     19-JUL-2011 19:40 DROP PUBLIC SYNONYM
scmsrvacct           SISI                     19-JUL-2011 19:40 DROP PUBLIC SYNONYM
3 rows selected.Notice that the table created on 20-JUL-2011 is not included above.
why not?
Any why isn't my test user shown, or the creation of the simple table created by the test user?

Answer 1

Well, I can't exactly do what you asked because 'privilege' is not a column.
But I'm guessing this is what you are asking for:
  1* select * from dba_stmt_audit_opts where user_name is NULL
SQL> /
USER_NAME PROXY_NAME AUDIT_OPTION                             SUCCESS    FAILURE
                     ALTER ANY TABLE                          BY ACCESS  BY ACCESS
                     SYSTEM GRANT                             BY ACCESS  BY ACCESS
                     DROP ANY TABLE                           BY ACCESS  BY ACCESS
                     CREATE ANY PROCEDURE                     BY ACCESS  BY ACCESS
                     DROP ANY PROCEDURE                       BY ACCESS  BY ACCESS
                     ALTER ANY PROCEDURE                      BY ACCESS  BY ACCESS
                     GRANT ANY PRIVILEGE                      BY ACCESS  BY ACCESS
                     GRANT ANY OBJECT PRIVILEGE               BY ACCESS  BY ACCESS
                     GRANT ANY ROLE                           BY ACCESS  BY ACCESS
                     SYSTEM AUDIT                             BY ACCESS  BY ACCESS
                     CREATE EXTERNAL JOB                      BY ACCESS  BY ACCESS
                     CREATE ANY JOB                           BY ACCESS  BY ACCESS
                     CREATE ANY LIBRARY                       BY ACCESS  BY ACCESS
                     CREATE PUBLIC DATABASE LINK              BY ACCESS  BY ACCESS
                     EXEMPT ACCESS POLICY                     BY ACCESS  BY ACCESS
                     ALTER USER                               BY ACCESS  BY ACCESS
                     CREATE USER                              BY ACCESS  BY ACCESS
                     ROLE                                     BY ACCESS  BY ACCESS
                     CREATE SESSION                           BY ACCESS  BY ACCESS
                     DROP USER                                BY ACCESS  BY ACCESS
                     ALTER DATABASE                           BY ACCESS  BY ACCESS
                     ALTER SYSTEM                             BY ACCESS  BY ACCESS
                     ALTER PROFILE                            BY ACCESS  BY ACCESS
                     DROP PROFILE                             BY ACCESS  BY ACCESS
                     DATABASE LINK                            BY ACCESS  BY ACCESS
                     PROFILE                                  BY ACCESS  BY ACCESS
                     PUBLIC SYNONYM                           BY ACCESS  BY ACCESS
                     CREATE ANY TABLE                         BY ACCESS  BY ACCESS
28 rows selected.also
SQL> select distinct(user_name) from dba_stmt_audit_opts;
USER_NAME
1 row selected.