Thanks Doug. But doesn't the product_user_profile only work for connections
using SQL*Plus? Anyway, they figured out it was a temporary table, which
was dropped and recreated by a batch job being run daily.
But I just figured out there's no way to audit drop and truncate statements
executed against specific tables, using the 'AUDIT' command.
Thanks
Raj
dgoulet@vicr.
com To: Rajesh Rao/CHASE@CHASE, Multiple
recipients of list ORACLE-L
<[EMAIL PROTECTED]>
March 19, cc:
2002 02:55 PM Subject: Re:Audit Drop Table
Raj,
From Metalink:
The PRODUCT_USER_PROFILE table will only allow you to enable or disable
certain
sql*plus commands (Not logins). "Connect" is one such command.
For example, the command.
INSERT INTO PRODUCT_USER_PROFILE(product, userid, attribute, char_value)
VALUES('SQL*Plus','TEST','CONNECT','DISABLED');
Will ensure that the user test can not execute the "connect" command
within
his session. This includes attempts to 'connect' as himself or any other
user.
Refer Note: 98549.947 for more information.
You should be able to insert a record to prevent the user from dropping
tables
after which it's just a matter of time till someone complains. Then you
will
have your culprit.
Also, have you considered giving people their own accounts if they have a
need
to create objects? That would also fix your problem, unless the user
allows
others to use his/her account. In that case it's their problem, not yours.
Dick Goulet
____________________Reply Separator____________________
Author: [EMAIL PROTECTED]
Date: 3/19/2002 11:04 AM
One of the application users has been complaining that someone keeps
dropping one of his tables. He imports it back, and after a few hours, its
gone again. I tried to turn on auditing for this table when its dropped. I
thought this was possible but looks like its not. I turned on full auditing
for the table but it does not audit the drop in sys.aud$. I understand that
there's no such system privilege as 'drop table'.
How do I turn this auditing on? Something like 'Audit drop on scott.emp'.
Is it possible? I am thinking, not. There are hundreds of users in the
database, and I dont wish to turn full auditing on for all these users.
And no drop statement exists in v$sqlarea currently. And damn !!! This is
on 7.3.4.
Raj
--
Please see the official ORACLE-L FAQ: http://www.orafaq.com
--
Author:
INET: [EMAIL PROTECTED]
Fat City Network Services -- (858) 538-5051 FAX: (858) 538-5051
San Diego, California -- Public Internet access / Mailing Lists
--------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: [EMAIL PROTECTED] (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L
(or the name of mailing list you want to be removed from). You may
also send the HELP command for other information (like subscribing).
--
Please see the official ORACLE-L FAQ: http://www.orafaq.com
--
Author:
INET: [EMAIL PROTECTED]
Fat City Network Services -- (858) 538-5051 FAX: (858) 538-5051
San Diego, California -- Public Internet access / Mailing Lists
--------------------------------------------------------------------
To REMOVE yourself from this mailing list, send an E-Mail message
to: [EMAIL PROTECTED] (note EXACT spelling of 'ListGuru') and in
the message BODY, include a line containing: UNSUB ORACLE-L
(or the name of mailing list you want to be removed from). You may
also send the HELP command for other information (like subscribing).
