Database Software

Announcement

For appeals, questions and feedback about Oracle Forums, please email oracle-forums-moderators_us@oracle.com. Technical questions should be asked in the appropriate category. Thank you!

After reinstall Oracle Grid Infrastructure, the audit file always generate audit log every minutes.

1050342Apr 9 2014 — edited Apr 9 2014

Hi all,

I had reinstall Grid infrastructure, after this implement task completed notice that:

1. The audit log always generated to adump path as below:

[oracle@setav43odb011 adump]$ pwd

/u01/app/oracle/admin/v43ora/adump

-rw-r----- 1 oracle asmadmin 785 Apr 7 09:54 v43ora1_ora_19010_3.aud

-rw-r----- 1 oracle asmadmin 785 Apr 7 09:54 v43ora1_ora_19021_3.aud

-rw-r----- 1 oracle asmadmin 785 Apr 7 09:54 v43ora1_ora_19038_3.aud

-rw-r----- 1 oracle asmadmin 785 Apr 7 09:54 v43ora1_ora_19051_8.aud

-rw-r----- 1 oracle asmadmin 785 Apr 7 09:55 v43ora1_ora_19061_7.aud

-rw-r----- 1 oracle asmadmin 785 Apr 7 09:55 v43ora1_ora_19082_3.aud

-rw-r----- 1 oracle asmadmin 785 Apr 7 09:56 v43ora1_ora_19161_2.aud

Now i have change some audit trail to syslog as below:

NAME TYPE VALUE

------------------------------------ ----------- ------------------------------

audit_file_dest string /u01/app/oracle/admin/v43ora/a

dump

audit_sys_operations boolean TRUE

audit_syslog_level string LOCAL3.DEBUG

audit_trail string OS

Then i tail -f from audit syslog found one session try to check at every minute as below:

Apr 9 09:26:12 setav43odb011 Oracle Audit[5490]: LENGTH : '205' ACTION :[59] 'ALTER SESSION SET EVENTS '10165 TRACE NAME CONTEXT FOREVER'' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[9] '724102840'

Apr 9 09:26:12 setav43odb011 Oracle Audit[5490]: LENGTH : '185' ACTION :[39] 'ALTER SESSION SET "_notify_crs" = false' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[9] '724102840'

Apr 9 09:26:13 setav43odb011 Oracle Audit[5500]: LENGTH : '152' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[9] '724102840'

Apr 9 09:26:13 setav43odb011 Oracle Audit[5500]: LENGTH : '205' ACTION :[59] 'ALTER SESSION SET EVENTS '10165 TRACE NAME CONTEXT FOREVER'' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[9] '724102840'

Apr 9 09:26:13 setav43odb011 Oracle Audit[5500]: LENGTH : '185' ACTION :[39] 'ALTER SESSION SET "_notify_crs" = false' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[9] '724102840'

Apr 9 09:26:15 setav43odb011 Oracle Audit[5513]: LENGTH : '152' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[9] '724102840'

Apr 9 09:26:15 setav43odb011 Oracle Audit[5513]: LENGTH : '205' ACTION :[59] 'ALTER SESSION SET EVENTS '10165 TRACE NAME CONTEXT FOREVER'' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[9] '724102840'

Apr 9 09:26:15 setav43odb011 Oracle Audit[5513]: LENGTH : '185' ACTION :[39] 'ALTER SESSION SET "_notify_crs" = false' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[9] '724102840'

Apr 9 09:26:19 setav43odb011 Oracle Audit[5523]: LENGTH : '152' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[9] '724102840'

Apr 9 09:26:19 setav43odb011 Oracle Audit[5523]: LENGTH : '205' ACTION :[59] 'ALTER SESSION SET EVENTS '10165 TRACE NAME CONTEXT FOREVER'' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[9] '724102840'

Apr 9 09:26:19 setav43odb011 Oracle Audit[5523]: LENGTH : '185' ACTION :[39] 'ALTER SESSION SET "_notify_crs" = false' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[9] '724102840'

Apr 9 09:26:28 setav43odb011 Oracle Audit[5533]: LENGTH : '152' ACTION :[7] 'CONNECT' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[9] '724102840'

Apr 9 09:26:28 setav43odb011 Oracle Audit[5533]: LENGTH : '205' ACTION :[59] 'ALTER SESSION SET EVENTS '10165 TRACE NAME CONTEXT FOREVER'' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[9] '724102840'

Apr 9 09:26:28 setav43odb011 Oracle Audit[5533]: LENGTH : '185' ACTION :[39] 'ALTER SESSION SET "_notify_crs" = false' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[9] '724102840'

Does anyone can suggest me to solve this?

Locked Post

New comments cannot be posted to this locked post.

Locked on May 7 2014

Added on Apr 9 2014

#11gr2, #cluster, #database, #linux, #performance-availability, #real-application-clusters

1 comment

851 views