How to know who and when someone is connected to Oracle through internal

This script shows you how to detect when someone is connected to Oracle through internal means.

In Unix, Oracle creates a ora_.aud file whenever you connect to Oracle through internal means. By default this

file is created in the $ORACLE_HOME/rdbms/audit directory. There is no need to turn the audit on.

In the following example, I connected to hpux through my client. The ora_2147.aud file is created in my $ORACLE_HOME/rdbms/audit directory.

STEP 1. Execute the following from a client machine:

SamSQL :> connect internal/oracle@nghpuxl1k
Connected.

STEP 2. Look for thr file on the server at $ORACLE_HOME/rdbms/audit dir. Check for the latest ora_ .aud file:

nghpux01 : cat ora_2147.aud

Here is the listing of ora_2147.aud file:

Audit file /app/oracle/product/8.1.6/rdbms/audit/ora_2147.aud
Oracle8i Enterprise Edition Release 8.1.6.0.0, 64 bit - Production 
With the Partitioning option
JServer Release 8.1.6.0.0 - Production
ORACLE_HOME = /app/oracle/product/8.1.6
System name:    HP-UX
Node name:      nghpux01
Release:        B.11.00
Version:        A
Machine:        9000/785
Instance name: nguv5
Redo thread mounted by this instance: 1
Oracle process number: 8
Unix process pid: 2147, image: oracle@nghpux01 (TNS V1-V3)

Tue Jun 19 11:54:21 2001
ACTION : 'connect internal' OSPRIV : DBA
CLIENT USER: wadhwas
CLIENT TERMINAL: MS032000D0009

The following file is generated when you connect to internal from the server:

nghpux01 74: cat ora_2107.aud
Audit file /app/oracle/product/8.1.6/rdbms/audit/ora_2107.aud
Oracle8i Enterprise Edition Release 8.1.6.0.0, 64 bit - Production
With the Partitioning option
JServer Release 8.1.6.0.0 - Production
ORACLE_HOME = /app/oracle/product/8.1.6
System name:    HP-UX
Node name:      nghpux01
Release:        B.11.00
Version:        A
Machine:        9000/785
Instance name: nguv5
Redo thread mounted by this instance: 1
Oracle process number: 0
2107

Tue Jun 19 11:48:07 2001
ACTION : 'connect INTERNAL' OSPRIV : OPER
CLIENT USER: oracle
CLIENT TERMINAL: pts/ta

Tue Jun 19 11:48:07 2001
ACTION : 'connect internal' OSPRIV : DBA
CLIENT USER: oracle
CLIENT TERMINAL: pts/ta

Tue Jun 19 11:48:17 2001
ACTION : 'connect internal' OSPRIV : DBA
CLIENT USER: oracle
CLIENT TERMINAL: pts/ta

For More Information


This was first published in June 2001

Dig deeper on Oracle database security

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

SearchDataManagement

SearchBusinessAnalytics

SearchSAP

SearchSQLServer

TheServerSide

SearchDataCenter

SearchContentManagement

SearchFinancialApplications

Close