Oracle 11g Anti-hacker's Cookbook

Auditing sessions

When the audit is performed, it is important to be able to identify the originating host, username, and logon and logoff time for sessions. In this recipe we will enable an audit on sessions created by users HR, DRAPHEAL, and SMAVRIS.

Getting ready

All steps from this recipe will be performed on the HACKDB database.

How to do it...

1. Connect as user SYSTEM, and start to audit sessions for user HR, DRAPHEAL, and SMAVRIS as follows:

   SQL> conn system
   Enter password:
   Connected.
   SQL> audit session by HR, DRAPHEAL, SMAVRIS;
   
   Audit succeeded.
   
   SQL>
   

2. Next connect as user HR and wait for 10 seconds, then disconnect.
3. Connect also as user DRAPHEAL and SMAVRIS and wait for 10 seconds or more, then disconnect.
4. One source of information for audit trails ...