AUDIT_SYS_OPERATIONS Set To FALSE Yet Audit Files Are Generated

Subject: AUDIT_SYS_OPERATIONS Set To FALSE Yet Audit Files Are Generated
Doc ID: Note:308066.1 Type: PROBLEM
Last Revision Date: 04-JUL-2007 Status: MODERATED

In this Document
Symptoms
Cause
Solution
References



--------------------------------------------------------------------------------


This document is being delivered to you via Oracle Support's Rapid Visibility (RaV) Rapid Visibility (RaV) process, and therefore has not been subject to an independent technical review.



Applies to:
Oracle Server - Enterprise Edition - Version: 9.2.0.1 to 10.1.0.3
This problem can occur on any platform.

Symptoms
Users find audit file are generated at Audit_File_Dest location. They can see database instance has the following setting .



1. audit_sys_operations=FALSE
2. audit_file_dest=/oracle10g/10.1.0/rdbms/audit
3. audit_trail=NONE

Although the audit_sys_operations is set to FALSE, the audit files were still been generated audit_file_dest.

AUDIT FILE ( *.aud ) output includes


Wed May 4 09:23:30 2005
ACTION : 'CONNECT'
DATABASE USER: '/'
PRIVILEGE : SYSDBA
CLIENT USER: oracle10g
CLIENT TERMINAL: pts/3
STATUS: 0



Cause
Expected behavior. Regardless of whether database auditing is enabled, Oracle always audits certain database-related operations and writes them to the operating system audit file.
Solution
These operations include the following operations are audited:

Connections to the instance with administrator privileges

An audit record is generated that lists the operating system user connecting to Oracle as SYSOPER
or SYSDBA. This provides for accountability of users with administrative privileges. Full auditing
for these users can be enabled as explained in "Auditing Administrative Users".

Database startup

An audit record is generated that lists the operating system user starting the instance, the user's terminal identifier, the date and time stamp, and whether database auditing was enabled or disabled. This is stored in the operating system audit trail because the database audit trail is not available until after startup has successfully completed. Recording the state of database auditing at startup helps detect when an administrator has restarted a database with database auditing disabled (thus enabling the administrator to perform unaudited actions).

Database shutdown

An audit record is generated that lists the operating system user shutting down the instance, the
user's terminal identifier, and the date and time stamp.


References
http://download-west.oracle.com/docs/cd/B10501_01/server.920/a96521/audit.htm#13370
http://download-west.oracle.com/docs/cd/B14117_01/network.101/b10773/auditing.htm#1008218
Oracle9i Database Administrator's Guide Release 2 (9.2) Part Number A96521-01 - Actions Audited By Default
Oracle® Database Security Guide 10g Release 1 (10.1) Part Number B10773-01 - Records Always in the Operating System Audit Trail

Keywords
'AUDIT_TRAIL' 'AUDIT_FILE_DEST' 'AUDIT_SYS_OPERATIONS'