Audit sys logins

[craig322]

I have auditing turned on in order to capture logins to the database in the sys.aud$ table. I noticed that it is not capturing logins as sys. Does anyone know how I can capture this as well?

Thanks

 

[SantaMufasa]

Craig,

To respond to your question re: SYS-login auditing, let me propose this scenario:

Your file system to which you are writing your audits becomes full, thus suspending your auditing, in turn, allowing no logins (since Oracle knows it must successfully audit all logins.) You, as SYS, want to instruct Oracle to suspend auditing for the time being, so that work on your database instance can proceed.

Yet, if Oracle must audit SYS logins, and Oracle cannot successfully audit SYS's connection due to 100%-full audit target, then SYS cannot log in to turn off auditing.

This is Oracle's rationale for why you cannot audit SYS logins using the standard AUDIT feature.

Sorry to be the bearer of news that you didn't want to hear.

Mufasa
(aka Dave of Sandy, Utah, USA)
[I can provide you with low-cost, remote Database Administration services: see our website and contact me via www.dasages.com]