eTRM uses javascript that opens and focuses a separate window to display reports. Your browser does not appear to support javascript. This should not prevent you from using eTRM but it does mean the window focus feature will not work. Please check the contents of other windows on your desktop if you click on a link that does not appear to do anything.

VIEW: SYS.DBA_AUDIT_TRAIL

Source

View Text - Preformatted


select spare1           /* OS_USERNAME */,
       userid           /* USERNAME */,
       userhost         /* USERHOST */,
       terminal         /* TERMINAL */,
       cast (           /* TIMESTAMP */
           (from_tz(ntimestamp#,'00:00') at local) as date),
       obj$creator      /* OWNER */,
       obj$name         /* OBJECT_NAME */,
       aud.action#      /* ACTION */,
       act.name         /* ACTION_NAME */,
       new$owner        /* NEW_OWNER */,
       new$name         /* NEW_NAME */,
       decode(aud.action#,
              108 /* grant  sys_priv */, null,
              109 /* revoke sys_priv */, null,
              114 /* grant  role */, null,
              115 /* revoke role */, null,
              auth$privileges)
                        /* OBJ_PRIVILEGE */,
       decode(aud.action#,
              108 /* grant  sys_priv */, spm.name,
              109 /* revoke sys_priv */, spm.name,
              null)
                        /* SYS_PRIVILEGE */,
       decode(aud.action#,
              108 /* grant  sys_priv */, substr(auth$privileges,1,1),
              109 /* revoke sys_priv */, substr(auth$privileges,1,1),
              114 /* grant  role */, substr(auth$privileges,1,1),
              115 /* revoke role */, substr(auth$privileges,1,1),
              null)
                        /* ADMIN_OPTION */,
       auth$grantee     /* GRANTEE */,
       decode(aud.action#,
              104 /* audit   */, aom.name,
              105 /* noaudit */, aom.name,
              null)
                        /* AUDIT_OPTION  */,
       ses$actions      /* SES_ACTIONS   */,
       cast((from_tz(cast(logoff$time as timestamp),'00:00') at local) as date)
                        /* LOGOFF_TIME   */,
       logoff$lread     /* LOGOFF_LREAD  */,
       logoff$pread     /* LOGOFF_PREAD  */,
       logoff$lwrite    /* LOGOFF_LWRITE */,
       decode(aud.action#,
              104 /* audit   */, null,
              105 /* noaudit */, null,
              108 /* grant  sys_priv */, null,
              109 /* revoke sys_priv */, null,
              114 /* grant  role */, null,
              115 /* revoke role */, null,
              aud.logoff$dead)
                         /* LOGOFF_DLOCK */,
       comment$text      /* COMMENT_TEXT */,
       sessionid         /* SESSIONID */,
       entryid           /* ENTRYID */,
       statement         /* STATEMENTID */,
       returncode        /* RETURNCODE */,
       spx.name          /* PRIVILEGE */,
       clientid          /* CLIENT_ID */,
       auditid           /* ECONTEXT_ID */,
       sessioncpu        /* SESSION_CPU */,
       from_tz(ntimestamp#,'00:00') at local,
                                   /* EXTENDED_TIMESTAMP */
       proxy$sid                      /* PROXY_SESSIONID */,
       user$guid                           /* GLOBAL_UID */,
       instance#                      /* INSTANCE_NUMBER */,
       process#                            /* OS_PROCESS */,
       xid                              /* TRANSACTIONID */,
       scn                                        /* SCN */,
       to_nchar(substr(sqlbind,1,2000))      /* SQL_BIND */,
       to_nchar(substr(sqltext,1,2000))      /* SQL_TEXT */,
       obj$edition                   /* OBJ_EDITION_NAME */,
       dbid                                      /* DBID */
from sys.aud$ aud, system_privilege_map spm, system_privilege_map spx,
     STMT_AUDIT_OPTION_MAP aom, audit_actions act
where   aud.action#     = act.action    (+)
  and - aud.logoff$dead = spm.privilege (+)
  and   aud.logoff$dead = aom.option#   (+)
  and - aud.priv$used   = spx.privilege (+)

View Text - HTML Formatted

SELECT SPARE1 /* OS_USERNAME */
, USERID /* USERNAME */
, USERHOST /* USERHOST */
, TERMINAL /* TERMINAL */
, CAST ( /* TIMESTAMP */ (FROM_TZ(NTIMESTAMP#
, '00:00') AT LOCAL) AS DATE)
, OBJ$CREATOR /* OWNER */
, OBJ$NAME /* OBJECT_NAME */
, AUD.ACTION# /* ACTION */
, ACT.NAME /* ACTION_NAME */
, NEW$OWNER /* NEW_OWNER */
, NEW$NAME /* NEW_NAME */
, DECODE(AUD.ACTION#
, 108 /* GRANT SYS_PRIV */
, NULL
, 109 /* REVOKE SYS_PRIV */
, NULL
, 114 /* GRANT ROLE */
, NULL
, 115 /* REVOKE ROLE */
, NULL
, AUTH$PRIVILEGES) /* OBJ_PRIVILEGE */
, DECODE(AUD.ACTION#
, 108 /* GRANT SYS_PRIV */
, SPM.NAME
, 109 /* REVOKE SYS_PRIV */
, SPM.NAME
, NULL) /* SYS_PRIVILEGE */
, DECODE(AUD.ACTION#
, 108 /* GRANT SYS_PRIV */
, SUBSTR(AUTH$PRIVILEGES
, 1
, 1)
, 109 /* REVOKE SYS_PRIV */
, SUBSTR(AUTH$PRIVILEGES
, 1
, 1)
, 114 /* GRANT ROLE */
, SUBSTR(AUTH$PRIVILEGES
, 1
, 1)
, 115 /* REVOKE ROLE */
, SUBSTR(AUTH$PRIVILEGES
, 1
, 1)
, NULL) /* ADMIN_OPTION */
, AUTH$GRANTEE /* GRANTEE */
, DECODE(AUD.ACTION#
, 104 /* AUDIT */
, AOM.NAME
, 105 /* NOAUDIT */
, AOM.NAME
, NULL) /* AUDIT_OPTION */
, SES$ACTIONS /* SES_ACTIONS */
, CAST((FROM_TZ(CAST(LOGOFF$TIME AS TIMESTAMP)
, '00:00') AT LOCAL) AS DATE) /* LOGOFF_TIME */
, LOGOFF$LREAD /* LOGOFF_LREAD */
, LOGOFF$PREAD /* LOGOFF_PREAD */
, LOGOFF$LWRITE /* LOGOFF_LWRITE */
, DECODE(AUD.ACTION#
, 104 /* AUDIT */
, NULL
, 105 /* NOAUDIT */
, NULL
, 108 /* GRANT SYS_PRIV */
, NULL
, 109 /* REVOKE SYS_PRIV */
, NULL
, 114 /* GRANT ROLE */
, NULL
, 115 /* REVOKE ROLE */
, NULL
, AUD.LOGOFF$DEAD) /* LOGOFF_DLOCK */
, COMMENT$TEXT /* COMMENT_TEXT */
, SESSIONID /* SESSIONID */
, ENTRYID /* ENTRYID */
, STATEMENT /* STATEMENTID */
, RETURNCODE /* RETURNCODE */
, SPX.NAME /* PRIVILEGE */
, CLIENTID /* CLIENT_ID */
, AUDITID /* ECONTEXT_ID */
, SESSIONCPU /* SESSION_CPU */
, FROM_TZ(NTIMESTAMP#
, '00:00') AT LOCAL
, /* EXTENDED_TIMESTAMP */ PROXY$SID /* PROXY_SESSIONID */
, USER$GUID /* GLOBAL_UID */
, INSTANCE# /* INSTANCE_NUMBER */
, PROCESS# /* OS_PROCESS */
, XID /* TRANSACTIONID */
, SCN /* SCN */
, TO_NCHAR(SUBSTR(SQLBIND
, 1
, 2000)) /* SQL_BIND */
, TO_NCHAR(SUBSTR(SQLTEXT
, 1
, 2000)) /* SQL_TEXT */
, OBJ$EDITION /* OBJ_EDITION_NAME */
, DBID /* DBID */ FROM SYS.AUD$ AUD
, SYSTEM_PRIVILEGE_MAP SPM
, SYSTEM_PRIVILEGE_MAP SPX
, STMT_AUDIT_OPTION_MAP AOM
, AUDIT_ACTIONS ACT WHERE AUD.ACTION# = ACT.ACTION (+)
AND - AUD.LOGOFF$DEAD = SPM.PRIVILEGE (+)
AND AUD.LOGOFF$DEAD = AOM.OPTION# (+)
AND - AUD.PRIV$USED = SPX.PRIVILEGE (+)