Oracle audit

[Former Member]

Hello,

I am on Oracle 10.2.0.4 and have enabled Oracle auditing. When querying dba_audit_trail, I saw below output:

OS_USERNAME TERMINAL USERNAME TO_CHAR(TIMESTAMP,'DD-MON- OWNER OBJ_NAME

-

---

-

---

-

---

-

---

-

---

-

---

ACTION_NAME SES_ACTIONS

-

---

-

---

DOMAIN\SAPServicePRD B1AMSPRD SAPSR3 02-May-2010 12:58:16 SAPSR3 USR01

DELETE

How can I find out who ran the DELETE command on table USR01?

Thank you.

[markus_doehr2 · Accepted solution]

> I am on Oracle 10.2.0.4 and have enabled Oracle auditing. When querying dba_audit_trail, I saw below output:

A SAP system uses only one user (SAPService<SID> or <sid>adm on Unix) to connect to the database. So on database level you won't have a chance to find out who deleted a user.

To find out who deleted the user use

- transaction SUIM

- Change documents - for users

Enter username and date. This report will also list deleted users.

Markus

[Former Member · Accepted solution]

Thank you Markus

[Former Member]

Hello again,

Does the changing of <sid>adm password cause the system to issue a DELETE command on USR01?