Hi,
I have a database with os level audit enabled. Database version is 11.2.0.3
SQL> show parameter audit
NAME TYPE VALUE
------------------------------------ ----------- ------------------------------
audit_file_dest string /dboracle01/orabase/product/11
.2.0.3/rdbms/audit
audit_sys_operations boolean TRUE
audit_syslog_level string
audit_trail string OS
SQL> SELECT * FROM DBA_OBJ_AUDIT_OPTS;
OWNER OBJECT_NAME OBJECT_TYPE ALT AUD COM DEL GRA IND INS LOC REN SEL UPD REF EXE CRE REA WRI FBK
------------------------------ ------------------------------ ----------------------- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- --- ---
TEST EMP TABLE -/- -/- -/- S/S -/- -/- S/S -/- -/- S/S S/S -/- -/- -/- -/- -/- -/-
Audit trail files are all located under /dboracle01/orabase/product/11.2.0.3/rdbms/audit folder.
Now i need to find out a user who deleted one row from the table EMP. From the dict view i got to know that action code for delete is 7
So i made a search below.
from the directory of audit files > grep -i 'ACTION:[3] "7"' *.aud
Hoping that would give me the audit file where the deletion was mentioned. I did not get any records. However from the statistics i could make out that there were like 15 deletions in the past month. Where i am doing wrong? Please help.
Thanks,
Arun