Reviewing the audit trail reveals one failed login attempt by the user RJB on August 10th:
SQL> select username, to_char(timestamp,'MM/DD/YY HH24:MI') Timestamp,
2 obj_name, returncode, action_name, sql_text from dba_audit_trail
3 where action_name in ('LOGON','LOGOFF')
4 and username in ('SCOTT','RJB','KSHELTON')
5 order by timestamp desc;
USERNAME TIMESTAMP OBJ_NAME RETURNCODE ACTION_NAME SQL_TEXT
---------- -------------- ---------- ---------- ---------------- ----------
KSHELTON 08/12/07 17:04 0 LOGON
SCOTT 08/12/07 16:10 0 LOGOFF
RJB 08/12/07 11:35 0 LOGON
RJB 08/12/07 11:35 0 LOGON
RJB 08/11/07 22:51 0 LOGON
RJB 08/11/07 22:51 0 LOGOFF
RJB 08/11/07 21:55 0 LOGOFF
RJB 08/11/07 21:40 0 LOGOFF
RJB 08/10/07 22:52 0 LOGOFF
RJB 08/10/07 22:52 0 LOGOFF
RJB 08/10/07 22:52 1017 LOGON
RJB 08/10/07 12:23 0 LOGOFF
SCOTT 08/03/07 04:18 0 LOGOFF
13 rows selected.
The RETURNCODE represents the ORA error message. An ORA-1017 message indicates that an
incorrect password was entered. Note that if we are just interested in logons and logoffs, we could
use the DBA_AUDIT_SESSION view instead.
336 Oracle Database 11g DBA Handbook
Statement auditing also includes startup and shutdown operations. Although we can audit
the command shutdown immediate in the SYS.AUD$ table, it is not possible to audit the startup
command in SYS.AUD$ because the database has to be started before rows can be added to
this table. For these cases, we can look in the directory specified in the initialization parameter
AUDIT_FILE_DEST to see a record of a startup operation performed by a system administrator (by
default this parameter contains $ORACLE_HOME/admin/dw/adump).
Pages:
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551