Skip to Main Content

How to disable audit in operating system files?

D.VegaMay 12 2014 — edited May 21 2014

Hi,

I have this 11.2.0.1 DB in RHEL 5, not configured by me.

I'm setting up the auditory in the audit trail. The AUDIT_TRAIL parameter is 'DB' and everything is working as expected.

However, the DB is auditing a specific standard user login actions (no SYSDBA or SYSOPER user) in operating system files, and there are no "Audit Commit Delay exceeded, written a copy to OS Audit Trail" messages in Audit Trail.

I don't want this log on action audited on operating system files. How can I disable it? What am I missing?

Regards

$ cat *********_ora_5951_1.aud

Audit file /usr/oracle/admin/*********/adump/*********_ora_5951_1.aud

Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production

With the Partitioning, OLAP, Data Mining and Real Application Testing options

ORACLE_HOME = /usr/oracle/product/11.2.0

System name:    Linux

Node name:      #######

Release:        2.6.18-194.el5PAE

Version:        #1 SMP Tue Mar 16 22:00:21 EDT 2010

Machine:        i686

Instance name: *********

Redo thread mounted by this instance: 1

Oracle process number: 27

Unix process pid: 5951, image: oracle@#######

Mon May 12 11:09:01 2014 +02:00

LENGTH: "234"

SESSIONID:[9] "320397462" ENTRYID:[1] "1" USERID:[15] "SCHEMA_USER" ACTION:[3] "102" RETURNCODE:[1] "0" LOGOFF$PREAD:[1] "0" LOGOFF$LREAD:[2] "20" LOGOFF$LWRITE:[1] "5" LOGOFF$DEAD:[1] "0" DBID:[9] "895165006" SESSIONCPU:[1] "1"

$ grep -F -A10000 "Mon May 12 09:43:23" /usr/oracle/diag/rdbms/*********/*********/trace/alert_*********.log | grep "Audit Commit Delay" | wc -l

0

$ sqlplus '/as sysdba'

SQL*Plus: Release 11.2.0.1.0 Production on Lun May 12 11:23:38 2014

Copyright (c) 1982, 2009, Oracle.  All rights reserved.

Conectado a:

Oracle Database 11g Enterprise Edition Release 11.2.0.1.0 - Production

With the Partitioning, OLAP, Data Mining and Real Application Testing options

SYS@*********> show parameter audit

NAME                                 TYPE        VALUE

------------------------------------ ----------- ------------------------------

audit_file_dest                      string      /usr/oracle/admin/*********/adu

                                                 mp

audit_syslog_level                   string

audit_sys_operations                 boolean     TRUE

audit_trail                          string      DB

This post has been answered by JudWilliford on May 21 2014
Jump to Answer
Comments
Post Details
Added on May 12 2014
2 comments
2,618 views