All Apps and Add-ons

Oracle 11g standard audit to syslog: what is normal for single quotes?

jldunn
Engager

We are using Oracle 11g standard audit to syslog on a Unix server. I am seeing a small number of Oracle records that don't have trailing quotes in the syslog file, e.g.:

2013 Nov 6 03:00:01 hostname [local7.warning] Audit[30801972]: LENGTH : '203' ACTION :[55] 'alter session set remote_dependencies_mode = signature

Note that there is an opening single quote before "alter" but not a closing trailing quote.
Our DBA team doesn't know if this is 'normal' for Oracle audit records or not.
Is it 'normal' for an audit record to be missing a trailing quote?

I have not seen other records (non-Oracle) truncated by our syslog, so I am not suspecting syslog at this point. The records appear to be of differing lengths; i.e. they aren't all getting chopped off at a specific point.

pmdba
Builder

I would not say that this is normal. The syslog output format may be dependent on your particular flavor of UNIX, or your particular syslog configuration. The systems I have tested this on (RHEL 5, RHEL 6, OEL 5) all include the trailing quote, as well as several more fields (see below). I would recommend checking your syslog or rsyslog configuration to make sure there isn't some issue there. It may also be that Oracle is sending a character that has special meaning to syslog that causes it to truncate the entry. Check the full SQL statement being used to see if there is anything unusual about it.

Dec 3 14:46:31 hostname Oracle Audit[11872]: LENGTH : '233' ACTION :[85] 'alter system set "_shutdown_completion_timeout_mins" = 30 scope=memory /* db agent */' DATABASE USER:[1] '/' PRIVILEGE :[6] 'SYSDBA' CLIENT USER:[6] 'oracle' CLIENT TERMINAL:[0] '' STATUS:[1] '0' DBID:[10] '1773000810'

0 Karma

lguinn2
Legend

You might also want to ask this on an Oracle forum. I don't think that many in this community are Oracle admins.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...