Need to Audit 'SYS' user.
595718Apr 2 2008 — edited Apr 7 2008Hi All,
I need to monitor all the activities (DDL and DML) done by 'SYS' user such as user creation and deletion. I tried writing triggers and turning on auditing but it gives me following errors.
ORA-30510: system triggers cannot be defined on the schema of SYS user
ORA-00983: cannot audit or noaudit SYS user actions
Then i set the parameters
audit_file_dest string D:\ORA_DB\ADMIN\ORCL\ADUMP
audit_sys_operations boolean TRUE
audit_trail string DB
I created / dropped some test users and table. I expected these actions to logged to SYS.AUD$. But when i run the following queries i didn't get much of the information except the 'SYS' user logon.
select * from sys.AUD$ where userid='SYS';
select * from dba_audit_trail where username='SYS';
select * from dba_audit_statement;
select * from dba_audit_object; where username='SYS';
Can DDL's and DML's of 'SYS' user be audited and if yes what is the correct way to do it. Can anybody help me.
Thanks in advance.