Skip to Main Content

Oracle Database Discussions

Announcement

For appeals, questions and feedback about Oracle Forums, please email oracle-forums-moderators_us@oracle.com. Technical questions should be asked in the appropriate category. Thank you!

Customize Audit Script ( Counting SUCCESSFUL_LOGON and FAILED_LOGON)

FUNG CHUN IPMar 12 2024

Does anyone help to comment any problem as below of scripts ?

#!/usr/bin/ksh
set -u
CTIME=`TZ=aaa16 date +%Y-%m-%d`
AUDITLOG=/home/oracle/scripts/audit/audit_$1.log
TMPFILE=/home/oracle/scripts/audit/tmp_$1.log
FINDPDB="select pdb_name from dba_pdbs where pdb_name != 'PDB\$SEED';"
ALTER="alter session set container=$FINDPDB;"
SCRIPTNAME="`basename $0`"
DBNAME=$1
PRINTDATE()
{
echo `date "+%Y/%m/%d %H:%M:%S"` -- $1 |tee -a $AUDITLOG
}
ps -ef|grep pmon|grep -v grep > /home/oracle/scripts/audit/tmpdb_$1.log
ORACLE_SID=`grep -i $DBNAME /home/oracle/scripts/audit/tmpdb_$1.log |awk '{print ($NF)}'|sed 's/^.*pmon_//g'`
export ORACLE_SID
export ORACLE_PDB_SID=$1
export ORACLE_HOME=`grep $ORACLE_SID /etc/oratab | grep -v "^#"| cut -d':' -f2`
export PATH=$ORACLE_HOME/bin:$PATH
sqlplus -s /nolog <<END
connect /as sysdba
$FINDPDB
$ALTER
spool audit_${ORACLE_SID}.out
select username,
os_username,
userhost,
client_id,
trunc(timestamp),
count(*) failed_logins
from dba_audit_trail
where returncode=1017 and --1017 is invalid username/password
timestamp < sysdate - 365
group by username,os_username,userhost, client_id,trunc(timestamp);
spool off
END
SUCCESSFUL_LOGON=`grep 'successful_logon' audit_$ORACLE_SID.out|awk '{print $2}'`
FAILED_LOGON=`grep 'failed_logins' audit_${ORACLE_SID}.out|awk '{print $2}'`
if [ ! -n "$SUCCESSFUL_LOGON" ]; then
SUCCESSFUL_LOGON=0
fi
if [ ! -n "$FAILED_LOGON" ]; then
FAILED_LOGON=0
fi

Comments
Post Details
Added on Mar 12 2024
0 comments
275 views