Audit log files

[johnbabatope]

Some transactions took place in our company and the audit log file was not setup and we would like to know what took place. We hav the user-id but we need to have the ip-address. We use oracle 10g and the database is populated by the application.

[Peter Godron]

Hi,
I suspect you will not get very much information, as only minimal logging takes place with auditing set up.
Check the .history and .sh_history in the user home directory for UNIX commands used.
"last | grep If the oracle connection was made, how about the sqlnet.log file?


For setting auditing up:
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=764349
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=33516
http://forums1.itrc.hp.com/service/forums/questionanswer.do?threadId=1072857

If you found this answer helpful, please see:
http://forums1.itrc.hp.com/service/forums/helptips.do?#28

[spex]

Hi,

$ grep -i 'username' $ORACLE_HOME/network/log/listener.log

By default, Oracle conducts only minimal logging of activities. For after-the-fact analysis, you may want to look into log mining.

PCS