B Oracle Database Audit Events

This appendix contains:

• About the Oracle Database Audit Events

• Account Management Events

• Application Management Events

• Audit Command Events

• Data Access Events

• Oracle Database Vault Events

• Exception Events

• Invalid Record Events

• Object Management Events

• Peer Association Events

• Role and Privilege Management Events

• Service and Application Utilization Events

• System Management Events

• Unknown or Uncategorized Events

• User Session Events

B.1 About the Oracle Database Audit Events

This appendix lists the audit event names and IDs, and the attribute names and data types for Oracle Database. The audit events are organized by their respective categories; for example, Account Management. You can use these audit events as follows:

• For alerts. When you create an alert, you can specify an audit event, based on its category, that can trigger the alert. See Section 2.11.2 for more information.

• For custom reports using third-party tools. If you want to create custom reports using third-party tools, refer to the tables in this appendix when you design the reports. See Appendix A, "Oracle Audit Vault Data Warehouse Schema" for more information about custom reports created with third-party tools.

B.2 Account Management Events

Account management events track SQL statements that affect user accounts, such as creating users or altering their profiles. The Account Management Report, described in Section 3.4.1, uses these events.

Table B-1 lists the Oracle Database account management events and event IDs.

Table B-1 Oracle Database Account Management Events and Event IDs

Event Name	Event ID
ALTER PROFILE	67
ALTER USER	43
CREATE PROFILE	65
CREATE USER	51
DROP PROFILE	66
DROP USER	53

Table B-2 lists the Oracle Database account management event attributes.

Table B-2 Oracle Database Account Management Event Attributes

Attribute Name	Data Type
CLIENT_APPINFO	VARCHAR2(4000)
CLIENT_ID	VARCHAR2(4000)
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INSTANCE_NUMBER	NUMBER
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_SESSIONID	NUMBER
SCN	NUMBER
SESSION_ACTIONS	VARCHAR2(255)
SOURCE_EVENTID	VARCHAR2(255)
SQL_BINDFoot 1	VARCHAR2(4000)
SQL_TEXTFoot 2	VARCHAR2(4000)
STATEMENTID	NUMBER
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
UNDO_SQL_TEXT	VARCHAR2(4000)
USER_GUID	VARCHAR2(32)
USERNAME	VARCHAR2(4000)

^Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

B.3 Application Management Events

Application management events track actions that were performed on the underlying PL/SQL procedures or functions of system services and applications, such as ALTER FUNCTION statements. The Procedure Management Report, described in Section 3.4.4, uses these events.

Table B-3 lists the Oracle Database application management events and event IDs.

Table B-3 Oracle Database Application Management Events and Event IDs

Event Name	Event ID
ALTER FUNCTION	92
ALTER JAVA	161
ALTER PACKAGE	95
ALTER PACKAGE BODY	98
ALTER PROCEDURE	25
ALTER RESOURCE COST	70
ALTER REWRITE EQUIVALENCE	210
ALTER TRIGGER	60
ALTER TYPE	80
ALTER TYPE BODY	82
ANALYZE INDEX	63
ANALYZE TABLE	62
ASSOCIATE STATISTICS	168
CREATE CONTEXT	177
CREATE FUNCTION	91
CREATE INDEXTYPE	164
CREATE JAVA	160
CREATE LIBRARY	159
CREATE OPERATOR	163
CREATE PACKAGE	94
CREATE PACKAGE BODY	97
CREATE PROCEDURE	24
CREATE TRIGGER	59
CREATE TYPE	77
CREATE TYPE BODY	81
DECLARE REWRITE EQUIVALENCE	209
DISABLE TRIGGER	119
DISASSOCIATE STATISTICS	169
DROP CONTEXT	178
DROP FUNCTION	93
DROP INDEXTYPE	165
DROP JAVA	162
DROP LIBRARY	84
DROP OPERATOR	167
DROP PACKAGE	96
DROP PACKAGE BODY	99
DROP PROCEDURE	68
DROP REWRITE EQUIVALENCE	211
DROP TRIGGER	61
DROP TYPE	78
DROP TYPE BODY	83
ENABLE TRIGGER	118
EXECUTE TYPE	123
EXPLAIN	50

Table B-4 lists the Oracle Database application management event attributes.

Table B-4 Oracle Database Application Management Event Attributes

Attribute Name	Data Type
ASSOCIATED_OBJECT_NAME	VARCHAR2(4000)
ASSOCIATED_OBJECT_OWNER	VARCHAR2(4000)
CLIENT_APPINFO	VARCHAR2(4000)
CLIENT_ID	VARCHAR2(4000)
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INSTANCE_NUMBER	NUMBER
NEW_OBJECT_NAME	VARCHAR2(4000)
NEW_OBJECT_OWNER	VARCHAR2(4000)
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_SESSIONID	NUMBER
SCN	NUMBER
SESSION_ACTIONS	VARCHAR2(255)
SOURCE_EVENTID	VARCHAR2(255)
SQL_BINDFoot 1	VARCHAR2(4000)
SQL_TEXTFoot 2	VARCHAR2(4000)
STATEMENTID	NUMBER
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
UNDO_SQL_TEXT	VARCHAR2(4000)
USER_GUID	VARCHAR2(32)
USERNAME	VARCHAR2(4000)

^Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

B.4 Audit Command Events

Audit command events track the use of AUDIT SQL statements on other SQL statements and on database objects. The Audit Command Report, described in Section 3.4.2, uses these events.

Table B-5 lists the Oracle Database audit events and event IDs.

Table B-5 Oracle Database Audit Events and Event IDs

Event Name	Event ID
AUDIT DEFAULT	106
AUDIT OBJECT	30
NOAUDIT DEFAULT	107
NOAUDIT OBJECT	31
SYSTEM AUDIT	104
SYSTEM NOAUDIT	105

Table B-6 lists the Oracle Database audit command event attributes.

Table B-6 Oracle Database Audit Command Event Attributes

Attribute Name	Data Type
AUDIT_OPTION	VARCHAR2(4000)
CLIENT_APPINFO	VARCHAR2(4000)
CLIENT_ID	VARCHAR2(4000)
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INSTANCE_NUMBER	NUMBER
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_SESSIONID	NUMBER
SCN	NUMBER
SESSION_ACTIONS	VARCHAR2(255)
SOURCE_EVENTID	VARCHAR2(255)
SQL_BINDFoot 1	VARCHAR2(4000)
SQL_TEXTFoot 2	VARCHAR2(4000)
STATEMENTID	NUMBER
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
UNDO_SQL_TEXT	VARCHAR2(4000)
USER_GUID	VARCHAR2(32)
USERNAME	VARCHAR2(4000)

^Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

B.5 Data Access Events

Data access events track audited data manipulation language (DML) activities, for example, all SELECT, INSERT, UPDATE, or DROP SQL statements. The Data Access Report, described in Section 3.3.2, uses these events.

Table B-7 lists the Oracle Database data access events and event IDs.

Table B-7 Oracle Database Data Access Events and Event IDs

Event Name	Event ID
DELETE	7
INSERT	2
SELECT	3
TRUNCATE TABLE	85
UPDATE	6

Table B-8 lists the Oracle Database data access event attributes.

Table B-8 Oracle Database Data Access Event Attributes

Attribute Name	Data Type
CLIENT_APPINFO	VARCHAR2(4000)
CLIENT_ID	VARCHAR2(4000)
COL_NAMELIST	VARCHAR2(4000)
COL_NEWVAL1	VARCHAR2(4000)
COL_NEWVAL10	VARCHAR2(4000)
COL_NEWVAL11	VARCHAR2(4000)
COL_NEWVAL2	VARCHAR2(4000)
COL_NEWVAL3	VARCHAR2(4000)
COL_NEWVAL4	VARCHAR2(4000)
COL_NEWVAL5	VARCHAR2(4000)
COL_NEWVAL6	VARCHAR2(4000)
COL_NEWVAL7	VARCHAR2(4000)
COL_NEWVAL8	VARCHAR2(4000)
COL_NEWVAL9	VARCHAR2(4000)
COL_OLDVAL1	VARCHAR2(4000)
COL_OLDVAL10	VARCHAR2(4000)
COL_OLDVAL11	VARCHAR2(4000)
COL_OLDVAL2	VARCHAR2(4000)
COL_OLDVAL3	VARCHAR2(4000)
COL_OLDVAL4	VARCHAR2(4000)
COL_OLDVAL5	VARCHAR2(4000)
COL_OLDVAL6	VARCHAR2(4000)
COL_OLDVAL7	VARCHAR2(4000)
COL_OLDVAL8	VARCHAR2(4000)
COL_OLDVAL9	VARCHAR2(4000)
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
DATA_VALUES	AV_DATAVALUES_LIST
ENDUSER	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
FGA_POLICYNAME	VARCHAR2(30)
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INSTANCE_NUMBER	NUMBER
NUM_INLINECOL	NUMBER
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_SESSIONID	NUMBER
ROW_ID	VARCHAR2(18)
SCN	NUMBER
SESSION_ACTIONS	VARCHAR2(255)
SOURCE_EVENTID	VARCHAR2(255)
SQL_BINDFoot 1	VARCHAR2(4000)
SQL_TEXTFoot 2	VARCHAR2(4000)
STATEMENTID	NUMBER
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
TRANSACTION_NAME	VARCHAR2(256)
UNDO_SQL_TEXT	VARCHAR2(4000)
USER_GUID	VARCHAR2(32)
USERNAME	VARCHAR2(4000)

^Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

B.6 Oracle Database Vault Events

Oracle Database Vault events track audited Oracle Database Vault activity. The Oracle Database Vault Report, described in Section 3.3.3, uses these events.

Table B-9 lists the Oracle Database Vault events and event IDs.

Table B-9 Oracle Database Vault Events and Event IDs

Event Name	Event ID
FACTOR EVALUATION	1000
FACTOR ASSIGNMENT	1001
FACTOR EXPRESSION	1002
REALM VIOLATION	1003
REALM AUTHORIZATION	1004
COMMAND AUTHORIZATION	1005
SECURE ROLE	1006
LBL SEC SESSION INIT	1007
ACCESS CTRL COMMAND AUTH	1008
ACCESS CTRL SESSION INIT	1009
LBL SEC ATTEMPT TO UPGRADE	1010

Table B-10 lists the Oracle Database Vault event attributes.

Table B-10 Oracle Database Vault Event Attributes

Attribute Name	Data Type
ACTION_NAME	VARCHAR2(128)
ACTION_OBJECT_ID	NUMBER
ACTION_OBJECT_NAME	VARCHAR2(128)
ACTION_COMMAND	VARCHAR2(4000)
AUDIT_OPTION	VARCHAR2(4000)
RULE_SET_ID	NUMBER
RULE_SET_NAME	VARCHAR2(90)
RULE_ID	NUMBER
RULE_NAME	VARCHAR2(90)
FACTOR_CONTEXT	VARCHAR2(4000)
CREATED_BY	VARCHAR2(30)
CREATE_DATE	TIMESTAMP WITH LOCAL TIME ZONE
UPDATED_BY	VARCHAR2(30)
UPDATE_DATE	TIMESTAMP WITH LOCAL TIME ZONE

B.7 Exception Events

Exception events track audited error and exception activity, such as network errors. The Exception Report, described in Section 3.5.1, uses these events.

Table B-11 lists the Oracle Database exception events and event IDs.

Table B-11 Oracle Database Exceptional Events and Event IDs

Event Name	Event ID
NETWORK ERROR	122

Table B-12 lists the Oracle Database exception event attributes.

Table B-12 Oracle Database Exceptional Event Attributes

Attribute Name	Data Type
CLIENT_APPINFO	VARCHAR2(4000)
CLIENT_ID	VARCHAR2(4000)
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INSTANCE_NUMBER	NUMBER
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_SESSIONID	NUMBER
SCN	NUMBER
SESSION_ACTIONS	VARCHAR2(255)
SOURCE_EVENTID	VARCHAR2(255)
SQL_BINDFoot 1	VARCHAR2(4000)
SQL_TEXTFoot 2	VARCHAR2(4000)
STATEMENTID	NUMBER
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
UNDO_SQL_TEXT	VARCHAR2(4000)
USER_GUID	VARCHAR2(32)
USERNAME	VARCHAR2(4000)

^Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

B.8 Invalid Record Events

Invalid record events track audited activity that Audit Vault could not understand, possibly due to a corrupted audit record. The Invalid Audit Record Report, described in Section 3.5.2, uses these events.

Table B-13 lists the Oracle Database invalid record events and event IDs.

Table B-13 Oracle Database Invalid Record Events and Event IDs

Event Name	Event ID
INVALID RECORD	30000

Table B-14 lists the Oracle Database invalid record event attributes.

Table B-14 Oracle Database Invalid Record Event Attributes

Attribute Name	Data Type
CLIENT_APPINFO	VARCHAR2(4000)
CLIENT_ID	VARCHAR2(4000)
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
ENDUSER	NUMBER
ERROR_MESSAGE	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INSTANCE_NUMBER	NUMBER
MODULE_NAME	VARCHAR2(100)
OBJECT_ID	NUMBER
ORIGINAL_CONTENT1	VARCHAR2(4000)
ORIGINAL_CONTENT2	VARCHAR2(4000)
ORIGINAL_CONTENT3	VARCHAR2(4000)
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_SESSIONID	NUMBER
SCN	NUMBER
SESSION_ACTIONS	VARCHAR2(255)
SEVERITY	NUMBER
SOURCE_EVENTID	VARCHAR2(255)
SQL_BINDFoot 1	VARCHAR2(4000)
SQL_TEXTFoot 2	VARCHAR2(4000)
STATEMENTID	NUMBER
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
UNDO_SQL_TEXT	VARCHAR2(4000)
USER_GUID	VARCHAR2(32)
USERNAME	VARCHAR2(4000)

^Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

B.9 Object Management Events

Object management events track audited actions performed on database objects, such as CREATE TABLE statements. The Object Management Report, described in Section 3.4.3, uses these events.

Table B-15 lists the Oracle Database object management events and event IDs.

Table B-15 Oracle Database Object Management Events and Event IDs

Event Name	Event ID
ALTER DIMENSION	175
ALTER INDEX	11
ALTER MATERIALIZED VIEW	75
ALTER MATERIALIZED VIEW LOG	72
ALTER OPERATOR	183
ALTER OUTLINE	179
ALTER SEQUENCE	14
ALTER TABLE	15
CREATE DIMENSION	174
CREATE DIRECTORY	157
CREATE INDEX	9
CREATE MATERIALIZED VIEW	74
CREATE MATERIALIZED VIEW LOG	71
CREATE OUTLINE	180
CREATE PUBLIC DATABASE LINK	112
CREATE PUBLIC SYNONYM	110
CREATE SCHEMA	56
CREATE SEQUENCE	13
CREATE SYNONYM	19
CREATE TABLE	1
CREATE VIEW	21
DROP DIMENSION	176
DROP DIRECTORY	158
DROP INDEX	10
DROP MATERIALIZED VIEW	76
DROP MATERIALIZED VIEW LOG	73
DROP OUTLINE	181
DROP PUBLIC DATABASE LINK	113
DROP PUBLIC SYNONYM	111
DROP SEQUENCE	16
DROP SYNONYM	20
DROP TABLE	12
DROP VIEW	22
FLASHBACK TABLE	205
LOCK	26
PURGE INDEX	201
PURGE TABLE	200
RENAME	28
UNDROP OBJECT	202
UPDATE INDEXES	182
VALIDATE INDEX	23

Table B-16 lists the Oracle Database object management event attributes.

Table B-16 Oracle Database Object Management Event Attributes

Attribute Name	Data Type
ASSOCIATED_OBJECT_NAME	VARCHAR2(4000)
ASSOCIATED_OBJECT_OWNER	VARCHAR2(4000)
CLIENT_APPINFO	VARCHAR2(4000)
CLIENT_ID	VARCHAR2(4000)
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
NEW_OBJECT_NAME	VARCHAR2(4000)
NEW_OBJECT_OWNER	VARCHAR2(4000)
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_SESSIONID	NUMBER
SCN	NUMBER
SESSION_ACTIONS	VARCHAR2(255)
SOURCE_EVENTID	VARCHAR2(255)
SQL_BINDFoot 1	VARCHAR2(4000)
SQL_TEXTFoot 2	VARCHAR2(4000)
STATEMENTID	NUMBER
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
UNDO_SQL_TEXT	VARCHAR2(4000)
USER_GUID	VARCHAR2(32)
USERNAME	VARCHAR2(4000)

^Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

B.10 Peer Association Events

Peer association events track database link statements. The Distributed Database Report, described in Section 3.3.4, uses these events.

Table B-17 lists the Oracle Database peer association events and event IDs.

Table B-17 Oracle Database Peer Association Events and Event IDs

Event Name	Event ID
CREATE DATABASE LINK	32
DROP DATABASE LINK	33

Table B-18 lists the Oracle Database peer association event attributes.

Table B-18 Oracle Database Peer Association Event Attributes

Attribute Name	Data Type
CLIENT_APPINFO	VARCHAR2(4000)
CLIENT_ID	VARCHAR2(4000)
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INSTANCE_NUMBER	NUMBER
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_SESSIONID	NUMBER
SCN	NUMBER
SESSION_ACTIONS	VARCHAR2(255)
SOURCE_EVENTID	VARCHAR2(255)
SQL_BINDFoot 1	VARCHAR2(4000)
SQL_TEXTFoot 2	VARCHAR2(4000)
STATEMENTID	NUMBER
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
UNDO_SQL_TEXT	VARCHAR2(4000)
USER_GUID	VARCHAR2(32)
USERNAME	VARCHAR2(4000)

^Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

B.11 Role and Privilege Management Events

Role and privilege management events track audited role and privilege management activity, such creating of roles and privileges. The Role and Privilege Management Report, described in Section 3.4.5, uses these events.

Table B-19 lists the Oracle Database role and privilege management events and event IDs.

Table B-19 Oracle Database Role and Privilege Management Events and Event IDs

Event Name	Event ID
ALTER ROLE	79
CREATE ROLE	52
DROP ROLE	54
GRANT OBJECT	17
GRANT ROLE	114
REVOKE OBJECT	18
REVOKE ROLE	115

Table B-20 lists the Oracle Database role and privilege management event attributes.

Table B-20 Oracle Database Role and Privilege Management Event Attributes

Attribute Name	Data Type
ADMIN_OPTION	NUMBER
CLIENT_APPINFO	VARCHAR2(4000)
CLIENT_ID	VARCHAR2(4000)
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME
GRANTEE	VARCHAR2(4000)
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INSTANCE_NUMBER	NUMBER
OBJECT_ID	NUMBER
OBJECT_PRIVILEGE	VARCHAR2(255)
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_SESSIONID	NUMBER
ROLE_NAME	VARCHAR2(4000)
SCN	NUMBER
SESSION_ACTIONS	VARCHAR2(255)
SOURCE_EVENTID	VARCHAR2(255)
SQL_BINDFoot 1	VARCHAR2(4000)
SQL_TEXTFoot 2	VARCHAR2(4000)
STATEMENTID	NUMBER
SUB_CONTEXTID	VARCHAR2(4000)
SYSTEM_PRIVILEGE	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
UNDO_SQL_TEXT	VARCHAR2(4000)
USER_GUID	VARCHAR2(32)
USERNAME	VARCHAR2(4000)

^Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

B.12 Service and Application Utilization Events

Service and application utilization events track audited application access activity, such as the execution of PL/SQL procedures or functions. The Procedure Executions Report, described in Section 3.3.5, uses these events.

Table B-21 lists the Oracle Database service and application utilization events and event IDs.

Table B-21 Oracle Database Service and Application Utilization Events and Event IDs

Event Name	Event ID
CALL METHOD	170
EXECUTE PROCEDURE	116
PL/SQL EXECUTE	47

Table B-22 lists the Oracle Database service and application utilization event attributes.

Table B-22 Oracle Database Service and Application Utilization Event Attributes

Attribute Name	Data Type
CLIENT_APPINFO	VARCHAR2(4000)
CLIENT_ID	VARCHAR2(4000)
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INSTANCE_NUMBER	NUMBER
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_SESSIONID	NUMBER
SCN	NUMBER
SESSION_ACTIONS	VARCHAR2(255)
SOURCE_EVENTID	VARCHAR2(255)
SQL_BINDFoot 1	VARCHAR2(4000)
SQL_TEXTFoot 2	VARCHAR2(4000)
STATEMENTID	NUMBER
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
UNDO_SQL_TEXT	VARCHAR2(4000)
USER_GUID	VARCHAR2(32)
USERNAME	VARCHAR2(4000)

^Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

B.13 System Management Events

System management events track audited system management activity, such as STARTUP and SHUTDOWN operations. The System Management Report, described in Section 3.4.6, uses these events.

Table B-23 lists the Oracle Database system management events and event IDs.

Table B-23 Oracle Database System Management Events and Event IDs

Event Name	Event ID
ALTER CLUSTER	5
ALTER DATABASE	35
ALTER ROLLBACK SEG	37
ALTER SYSTEM	49
ALTER TABLESPACE	40
ANALYZE CLUSTER	64
CREATE CLUSTER	4
CREATE CONTROL FILE	57
CREATE DATABASE	34
CREATE ROLLBACK SEG	36
CREATE TABLESPACE	39
DISABLE ALL TRIGGERS	121
DROP CLUSTER	8
DROP ROLLBACK SEG	38
DROP TABLESPACE	41
ENABLE ALL TRIGGERS	120
FLASHBACK	128
FLASHBACK DATABASE	204
PURGE DBA_RECYCLEBIN	198
PURGE TABLESPACE	199
SHUTDOWN	216
STARTUP	215
SUPER USER DDL	213
SUPER USER DML	214
SYSTEM GRANT	108
SYSTEM REVOKE	109
TRUNCATE CLUSTER	86

Table B-24 lists the Oracle Database system management event attributes.

Table B-24 Oracle Database System Management Event Attributes

Attribute Name	Data Type
CLIENT_APPINFO	VARCHAR2(4000)
CLIENT_ID	VARCHAR2(4000)
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INSTANCE_NUMBER	NUMBER
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_SESSIONID	NUMBER
SCN	NUMBER
SESSION_ACTIONS	VARCHAR2(255)
SOURCE_EVENTID	VARCHAR2(255)
SQL_BINDFoot 1	VARCHAR2(4000)
SQL_TEXTFoot 2	VARCHAR2(4000)
STATEMENTID	NUMBER
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
UNDO_SQL_TEXT	VARCHAR2(4000)
USER_GUID	VARCHAR2(32)
USERNAME	VARCHAR2(4000)

^Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

B.14 Unknown or Uncategorized Events

Unknown or uncategorized events track audited activity that cannot be categorized, such as ALTER SUMMARY statements. The Uncategorized Activity Report, described in Section 3.5.3, uses these events.

Table B-25 lists the Oracle Database unknown or uncategorized events and event IDs.

Table B-25 Oracle Database Unknown or Uncategorized Events and Event IDs

Event Name	Event ID
ALTER SUMMARY	172
COMMENT	29
CREATE SUMMARY	171
DROP SUMMARY	173
NO-OP	27
SUPER USER UNKNOWN	217
UNKNOWN	0
USER COMMENT	117

Table B-26 lists the Oracle Database unknown or uncategorized event attributes.

Table B-26 Unknown or Uncategorized Event Attributes

Attribute Name	Data Type
CLIENT_APPINFO	VARCHAR2(4000)
CLIENT_ID	VARCHAR2(4000)
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INSTANCE_NUMBER	NUMBER
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_SESSIONID	NUMBER
SCN	NUMBER
SESSION_ACTIONS	VARCHAR2(255)
SOURCE_EVENTID	VARCHAR2(255)
SQL_BINDFoot 1	VARCHAR2(4000)
SQL_TEXTFoot 2	VARCHAR2(4000)
STATEMENTID	NUMBER
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
UNDO_SQL_TEXT	VARCHAR2(4000)
USER_GUID	VARCHAR2(32)
USERNAME	VARCHAR2(4000)

^Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

B.15 User Session Events

User session events track audited authentication events for users who log in to the database. The User Sessions Report, described in Section 3.3.6, uses these events.

Table B-27 lists the Oracle Database user session events and event IDs.

Table B-27 Oracle Database User Session Events and Event IDs

Event Name	Event ID
ALTER SESSION	42
COMMIT	44
CREATE RESTORE POINT	206
CREATE SESSION	129
DROP RESTORE POINT	207
LOGOFF	101
LOGOFF BY CLEANUP	102
LOGON	100
PROXY AUTHENTICATION ONLY	208
PURGE USER_RECYCLEBIN	197
ROLLBACK	45
SAVEPOINT	46
SESSION REC	103
SET ROLE	55
SET TRANSACTION	48
SUPER USER LOGON	212

Table B-28 lists the Oracle Database user session event attributes.

Table B-28 Oracle Database User Session Event Attributes

Attribute Name	Data Type
AUTHENTICATION_METHOD	VARCHAR2(255)
CLIENT_APPINFO	VARCHAR2(4000)
CLIENT_ID	VARCHAR2(4000)
COMMENT_TEXT	VARCHAR2(4000)
CONTEXTID	VARCHAR2(4000)
ENDUSER	VARCHAR2(4000)
EVENT_STATUS	VARCHAR2(30)
EVENT_TIME	TIMESTAMP WITH LOCAL TIME ZONE
HOST_IP	VARCHAR2(255)
HOST_NAME	VARCHAR2(255)
HOST_TERMINAL	VARCHAR2(255)
INSTANCE_NUMBER	NUMBER
LOGOFF_DLOCK	NUMBER
LOGOFF_LREAD	NUMBER
LOGOFF_LWRITE	NUMBER
LOGOFF_PREAD	NUMBER
OBJECT_ID	NUMBER
OSUSER_NAME	VARCHAR2(4000)
PARENT_CONTEXTID	VARCHAR2(4000)
PRIVILEGES_USED	VARCHAR2(4000)
PROCESS#	NUMBER
PROXY_SESSIONID	NUMBER
SCN	NUMBER
SESSION_ACTIONS	VARCHAR2(255)
SOURCE_EVENTID	VARCHAR2(255)
SQL_BINDFoot 1	VARCHAR2(4000)
SQL_TEXTFoot 2	VARCHAR2(4000)
STATEMENTID	NUMBER
SUB_CONTEXTID	VARCHAR2(4000)
TARGET_OBJECT	VARCHAR2(4000)
TARGET_OWNER	VARCHAR2(4000)
THREAD#	NUMBER
TOOLS_USED	VARCHAR2(4000)
UNDO_SQL_TEXT	VARCHAR2(4000)
USER_GUID	VARCHAR2(32)
USERNAME	VARCHAR2(4000)

^Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.