I had posted on this in an earlier thread (https://community.oracle.com/thread/3634898 then had to abandon it due to more pressing issues. That thread has since been archived, so with a bit of a slack period thought I’d take up the subject again.
Oracle 11.2.0.4 Std. Ed. ONE - 64bit
Oracle Linux 5.6 64-bit
I see a lot of audit trail entries for action_name='SESSION REC'.
Everything I've read says this is for statements that are audited 'by session' instead of 'by access'. Yet I find nothing being audited 'by session'. At this point I see no benefit to having these records in my audit logs, so I'd like to understand what is triggering them and what I can learn from that.
SQL> select distinct failure from dba_priv_audit_opts;
FAILURE
----------
BY ACCESS
1 row selected.
SQL> select distinct success from dba_priv_audit_opts;
SUCCESS
----------
BY ACCESS
1 row selected.
SQL> select distinct failure from dba_stmt_audit_opts;
FAILURE
----------
BY ACCESS
1 row selected.
SQL> select distinct success from dba_stmt_audit_opts;
SUCCESS
----------
BY ACCESS
1 row selected.
SQL> select * from dba_obj_audit_opts;
no rows selected
SQL> select * from all_def_audit_opts;
ALT AUD COM DEL GRA IND INS LOC REN SEL UPD REF EXE FBK REA
--- --- --- --- --- --- --- --- --- --- --- --- --- --- ---
-/- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/- -/-
1 row selected.
SQL> select count(*) from dba_audit_trail where action_name='SESSION REC';
COUNT(*)
----------
87411
1 row selected.
SQL>