Database Software

Announcement

For appeals, questions and feedback about Oracle Forums, please email oracle-forums-moderators_us@oracle.com. Technical questions should be asked in the appropriate category. Thank you!

How to disable audit in operating system files?

D.VegaMay 12 2014 — edited May 21 2014

Hi,

I have this 11.2.0.1 DB in RHEL 5, not configured by me.

I'm setting up the auditory in the audit trail. The AUDIT_TRAIL parameter is 'DB' and everything is working as expected.

However, the DB is auditing a specific standard user login actions (no SYSDBA or SYSOPER user) in operating system files, and there are no "Audit Commit Delay exceeded, written a copy to OS Audit Trail" messages in Audit Trail.

I don't want this log on action audited on operating system files. How can I disable it? What am I missing?

Regards

$ cat *********_ora_5951_1.aud

Audit file /usr/oracle/admin/*********/adump/*********_ora_5951_1.aud

Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production

With the Partitioning, OLAP, Data Mining and Real Application Testing options

ORACLE_HOME = /usr/oracle/product/11.2.0

System name: Linux

Node name: #######

Release: 2.6.18-194.el5PAE

Version: #1 SMP Tue Mar 16 22:00:21 EDT 2010

Machine: i686

Instance name: *********

Redo thread mounted by this instance: 1

Oracle process number: 27

Unix process pid: 5951, image: oracle@#######

Mon May 12 11:09:01 2014 +02:00

LENGTH: "234"

SESSIONID:[9] "320397462" ENTRYID:[1] "1" USERID:[15] "SCHEMA_USER" ACTION:[3] "102" RETURNCODE:[1] "0" LOGOFF$PREAD:[1] "0" LOGOFF$LREAD:[2] "20" LOGOFF$LWRITE:[1] "5" LOGOFF$DEAD:[1] "0" DBID:[9] "895165006" SESSIONCPU:[1] "1"

$ grep -F -A10000 "Mon May 12 09:43:23" /usr/oracle/diag/rdbms/*********/*********/trace/alert_*********.log | grep "Audit Commit Delay" | wc -l

$ sqlplus '/as sysdba'

SQL*Plus: Release 11.2.0.1.0 Production on Lun May 12 11:23:38 2014

Conectado a:

Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production

With the Partitioning, OLAP, Data Mining and Real Application Testing options

SYS@*********> show parameter audit

NAME TYPE VALUE

------------------------------------ ----------- ------------------------------

audit_file_dest string /usr/oracle/admin/*********/adu

audit_syslog_level string

audit_sys_operations boolean TRUE

audit_trail string DB

This post has been answered by JudWilliford on May 21 2014

Jump to Answer

Locked Post

New comments cannot be posted to this locked post.

Locked on Jun 18 2014

Added on May 12 2014

#11g, #audit, #database-security, #database-security-general, #linux

2 comments

3,369 views