Skip Headers
Oracle® Audit Vault Auditor's Guide
Release 10.2.3.2

Part Number E14460-07
Go to Documentation Home
Home
Go to Book List
Book List
Go to Table of Contents
Contents
Go to Index
Index
Go to Feedback page
Contact Us

Go to previous page
Previous
Go to next page
Next
PDF · Mobi · ePub

A Oracle Database Audit Events

This appendix contains:

A.1 About the Oracle Database Audit Events

This appendix lists the audit event names and IDs, and the attribute names and data types for Oracle Database. The audit events are organized by their respective categories; for example, Account Management. You can use these audit events as follows:

A.2 Account Management Events

Account management events track SQL statements that affect user accounts, such as creating users or altering their profiles. The Account Management Report, described in Section 3.3.3.2, uses these events.

Table A-1 lists the Oracle Database account management source database events and the equivalent Oracle Audit Vault events.

Table A-1 Oracle Database Account Management Audit Events

Event Name Description Source Event Audit Vault Event

ALTER PROFILE

67

ALTER PROFILE

ALTER USER

43

ALTER USER

CREATE PROFILE

65

CREATE PROFILE

CREATE USER

51

CREATE USER

DROP PROFILE

66

DROP PROFILE

DROP USER

53

DROP USER


Table A-2 lists the Oracle Database account management event attributes.

Table A-2 Oracle Database Account Management Event Attributes

Attribute Name Data Type

CLIENT_APPINFO

VARCHAR2(4000)

CLIENT_ID

VARCHAR2(4000)

COMMENT_TEXT

VARCHAR2(4000)

CONTEXTID

VARCHAR2(4000)

ENDUSER

VARCHAR2(4000)

EVENT_STATUS

VARCHAR2(30)

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INSTANCE_NUMBER

NUMBER

OBJECT_ID

NUMBER

OSUSER_NAME

VARCHAR2(4000)

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

PROXY_SESSIONID

NUMBER

SCN

NUMBER

SESSION_ACTIONS

VARCHAR2(255)

SOURCE_EVENTID

VARCHAR2(255)

SQL_BINDFoot 1 

VARCHAR2(4000)

SQL_TEXTFoot 2 

VARCHAR2(4000)

STATEMENTID

NUMBER

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

UNDO_SQL_TEXT

VARCHAR2(4000)

USER_GUID

VARCHAR2(32)

USERNAME

VARCHAR2(4000)


Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

A.3 Application Management Events

Application management events track actions that were performed on the underlying PL/SQL procedures or functions of system services and applications, such as ALTER FUNCTION statements. The Procedure Management Report, described in Section 3.3.3.5, uses these events.

Table A-3 lists the Oracle Database application management source database events and the equivalent Oracle Audit Vault events.

Table A-3 Oracle Database Application Management Audit Events

Event Name Description Source Event Audit Vault Event

ALTER ASSEMBLY (Release 11.2)

217

ALTER ASSEMBLY

ALTER FUNCTION

92

ALTER FUNCTION

ALTER JAVA

161

ALTER JAVA

ALTER PACKAGE

95

ALTER PACKAGE

ALTER PACKAGE BODY

98

ALTER PACKAGE BODY

ALTER PROCEDURE

25

ALTER PROCEDURE

ALTER RESOURCE COST

70

ALTER RESOURCE COST

ALTER REWRITE EQUIVALENCE

210

ALTER REWRITE EQUIVALENCE

ALTER TRIGGER

60

ALTER TRIGGER

ALTER TYPE

80

ALTER TYPE

ALTER TYPE BODY

82

ALTER TYPE BODY

ANALYZE INDEX

63

ANALYZE INDEX

ANALYZE TABLE

62

ANALYZE TABLE

ASSOCIATE STATISTICS

168

ASSOCIATE STATISTICS

CREATE ASSEMBLY (Release 11.2)

216

CREATE ASSEMBLY

CREATE CONTEXT

177

CREATE CONTEXT

CREATE FUNCTION

91

CREATE FUNCTION

CREATE INDEXTYPE

164

CREATE INDEXTYPE

CREATE JAVA

160

CREATE JAVA

CREATE LIBRARY

159

CREATE LIBRARY

CREATE OPERATOR

163

CREATE OPERATOR

CREATE PACKAGE

94

CREATE PACKAGE

CREATE PACKAGE BODY

97

CREATE PACKAGE BODY

CREATE PROCEDURE

24

CREATE PROCEDURE

CREATE TRIGGER

59

CREATE TRIGGER

CREATE TYPE

77

CREATE TYPE

CREATE TYPE BODY

81

CREATE TYPE BODY

DECLARE REWRITE EQUIVALENCE

209

DECLARE REWRITE EQUIVALENCE

DISABLE TRIGGER

119

DISABLE TRIGGER

DISASSOCIATE STATISTICS

169

DISASSOCIATE STATISTICS

DROP ASSEMBLY (Release 11.2)

215

DROP ASSEMBLY

DROP CONTEXT

178

DROP CONTEXT

DROP FUNCTION

93

DROP FUNCTION

DROP INDEXTYPE

165

DROP INDEXTYPE

DROP JAVA

162

DROP JAVA

DROP LIBRARY

84

DROP LIBRARY

DROP OPERATOR

167

DROP OPERATOR

DROP PACKAGE

96

DROP PACKAGE

DROP PACKAGE BODY

99

DROP PACKAGE BODY

DROP PROCEDURE

68

DROP PROCEDURE

DROP REWRITE EQUIVALENCE

211

DROP REWRITE EQUIVALENCE

DROP TRIGGER

61

DROP TRIGGER

DROP TYPE

78

DROP TYPE

DROP TYPE BODY

83

DROP TYPE BODY

ENABLE TRIGGER

118

ENABLE TRIGGER

EXECUTE TYPE

123

EXECUTE TYPE

EXPLAIN

50

EXPLAIN


Table A-4 lists the Oracle Database application management event attributes.

Table A-4 Oracle Database Application Management Event Attributes

Attribute Name Data Type

ASSOCIATED_OBJECT_NAME

VARCHAR2(4000)

ASSOCIATED_OBJECT_OWNER

VARCHAR2(4000)

CLIENT_APPINFO

VARCHAR2(4000)

CLIENT_ID

VARCHAR2(4000)

COMMENT_TEXT

VARCHAR2(4000)

CONTEXTID

VARCHAR2(4000)

ENDUSER

VARCHAR2(4000)

EVENT_STATUS

VARCHAR2(30)

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INSTANCE_NUMBER

NUMBER

NEW_OBJECT_NAME

VARCHAR2(4000)

NEW_OBJECT_OWNER

VARCHAR2(4000)

OBJECT_ID

NUMBER

OSUSER_NAME

VARCHAR2(4000)

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

PROXY_SESSIONID

NUMBER

SCN

NUMBER

SESSION_ACTIONS

VARCHAR2(255)

SOURCE_EVENTID

VARCHAR2(255)

SQL_BINDFoot 1 

VARCHAR2(4000)

SQL_TEXTFoot 2 

VARCHAR2(4000)

STATEMENTID

NUMBER

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

UNDO_SQL_TEXT

VARCHAR2(4000)

USER_GUID

VARCHAR2(32)

USERNAME

VARCHAR2(4000)


Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

A.4 Audit Command Events

Audit command events track the use of AUDIT SQL statements on other SQL statements and on database objects. The Audit Command Report, described in Section 3.3.3.3, uses these events.

Table A-5 lists the Oracle Database audit command source database events and the equivalent Oracle Audit Vault events.

Table A-5 Oracle Database Audit Command Audit Events

Event Name Description Source Event Audit Vault Event

AUDIT DEFAULT

106

AUDIT DEFAULT

AUDIT OBJECT

30

AUDIT OBJECT

NOAUDIT DEFAULT

107

NOAUDIT DEFAULT

NOAUDIT OBJECT

31

NOAUDIT OBJECT

SYSTEM AUDIT

104

SYSTEM AUDIT

SYSTEM NOAUDIT

105

SYSTEM NOAUDIT


Table A-6 lists the Oracle Database audit command event attributes.

Table A-6 Oracle Database Audit Command Event Attributes

Attribute Name Data Type

AUDIT_OPTION

VARCHAR2(4000)

CLIENT_APPINFO

VARCHAR2(4000)

CLIENT_ID

VARCHAR2(4000)

COMMENT_TEXT

VARCHAR2(4000)

CONTEXTID

VARCHAR2(4000)

ENDUSER

VARCHAR2(4000)

EVENT_STATUS

VARCHAR2(30)

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INSTANCE_NUMBER

NUMBER

OBJECT_ID

NUMBER

OSUSER_NAME

VARCHAR2(4000)

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

PROXY_SESSIONID

NUMBER

SCN

NUMBER

SESSION_ACTIONS

VARCHAR2(255)

SOURCE_EVENTID

VARCHAR2(255)

SQL_BINDFoot 1 

VARCHAR2(4000)

SQL_TEXTFoot 2 

VARCHAR2(4000)

STATEMENTID

NUMBER

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

UNDO_SQL_TEXT

VARCHAR2(4000)

USER_GUID

VARCHAR2(32)

USERNAME

VARCHAR2(4000)


Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

A.5 Data Access Events

Data access events track audited data manipulation language (DML) activities, for example, all SELECT, INSERT, UPDATE, or DROP SQL statements. The Data Access Report, described in Section 3.3.2.3, uses these events.

Table A-7 lists the Oracle Database data access source database events and the equivalent Oracle Audit Vault events.

Table A-7 Oracle Database Data Access Audit Events

Event Name Description Source Event Audit Vault Event

DELETE

7

DELETE

INSERT

2

INSERT

SELECT

3

SELECT

SELECT MINING MODEL (Release 11.2)

131

SELECT MINING MODEL

TRUNCATE TABLE

85

TRUNCATE TABLE

UPDATE

6

UPDATE


Table A-8 lists the Oracle Database data access event attributes.

Table A-8 Oracle Database Data Access Event Attributes

Attribute Name Data Type

CLIENT_APPINFO

VARCHAR2(4000)

CLIENT_ID

VARCHAR2(4000)

COL_NAMELIST

VARCHAR2(4000)

COL_NEWVAL1

VARCHAR2(4000)

COL_NEWVAL2

VARCHAR2(4000)

COL_NEWVAL3

VARCHAR2(4000)

COL_NEWVAL4

VARCHAR2(4000)

COL_NEWVAL5

VARCHAR2(4000)

COL_NEWVAL6

VARCHAR2(4000)

COL_NEWVAL7

VARCHAR2(4000)

COL_NEWVAL8

VARCHAR2(4000)

COL_NEWVAL9

VARCHAR2(4000)

COL_NEWVAL10

VARCHAR2(4000)

COL_NEWVAL11

VARCHAR2(4000)

COL_OLDVAL1

VARCHAR2(4000)

COL_OLDVAL2

VARCHAR2(4000)

COL_OLDVAL3

VARCHAR2(4000)

COL_OLDVAL4

VARCHAR2(4000)

COL_OLDVAL5

VARCHAR2(4000)

COL_OLDVAL6

VARCHAR2(4000)

COL_OLDVAL7

VARCHAR2(4000)

COL_OLDVAL8

VARCHAR2(4000)

COL_OLDVAL9

VARCHAR2(4000)

COL_OLDVAL10

VARCHAR2(4000)

COL_OLDVAL11

VARCHAR2(4000)

COMMENT_TEXT

VARCHAR2(4000)

CONTEXTID

VARCHAR2(4000)

DATA_VALUES

AV_DATAVALUES_LIST

ENDUSER

VARCHAR2(4000)

EVENT_STATUS

VARCHAR2(30)

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

FGA_POLICYNAME

VARCHAR2(30)

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INSTANCE_NUMBER

NUMBER

NUM_INLINECOL

NUMBER

OBJECT_ID

NUMBER

OSUSER_NAME

VARCHAR2(4000)

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

PROXY_SESSIONID

NUMBER

ROW_ID

VARCHAR2(18)

SCN

NUMBER

SESSION_ACTIONS

VARCHAR2(255)

SOURCE_EVENTID

VARCHAR2(255)

SQL_BINDFoot 1 

VARCHAR2(4000)

SQL_TEXTFoot 2 

VARCHAR2(4000)

STATEMENTID

NUMBER

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

TRANSACTION_NAME

VARCHAR2(256)

UNDO_SQL_TEXT

VARCHAR2(4000)

USER_GUID

VARCHAR2(32)

USERNAME

VARCHAR2(4000)


Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

A.6 Oracle Database Vault Events

Oracle Database Vault events track audited Oracle Database Vault activity. The Oracle Database Vault Report, described in Section 3.3.2.4, uses these events.

Table A-9 lists the Oracle Database Vault source database events and the equivalent Oracle Audit Vault events.

Table A-9 Oracle Database Vault Audit Events

Event Name Description Source Event Audit Vault Event

ACCESS CTRL COMMAND AUTH

1008

ACCESS CTRL COMMAND AUTH

ACCESS CTRL SESSION INIT

1009

ACCESS CTRL SESSION INIT

COMMAND AUTHORIZATION

1005

COMMAND AUTHORIZATION

FACTOR ASSIGNMENT

1001

FACTOR ASSIGNMENT

FACTOR EVALUATION

1000

FACTOR EVALUATION

FACTOR EXPRESSION

1002

FACTOR EXPRESSION

LBL SEC ATTEMPT TO UPGRADE

1010

LBL SEC ATTEMPT TO UPGRADE

LBL SEC SESSION INIT

1007

LBL SEC SESSION INIT

REALM AUTHORIZATION

1004

REALM AUTHORIZATION

REALM VIOLATION

1003

REALM VIOLATION

SECURE ROLE

1006

SECURE ROLE


Table A-10 lists the Oracle Database Vault event attributes.

Table A-10 Oracle Database Vault Event Attributes

Attribute Name Data Type

ACTION_COMMAND

VARCHAR2(4000)

ACTION_NAME

VARCHAR2(128)

ACTION_OBJECT_ID

NUMBER

ACTION_OBJECT_NAME

VARCHAR2(128)

AUDIT_OPTION

VARCHAR2(4000)

CREATE_DATE

TIMESTAMP WITH LOCAL TIME ZONE

CREATED_BY

VARCHAR2(30)

FACTOR_CONTEXT

VARCHAR2(4000)

RULE_ID

NUMBER

RULE_NAME

VARCHAR2(90)

RULE_SET_ID

NUMBER

RULE_SET_NAME

VARCHAR2(90)

UPDATE_DATE

TIMESTAMP WITH LOCAL TIME ZONE

UPDATED_BY

VARCHAR2(30)


A.7 Exception Events

Exception events track audited error and exception activity, such as network errors. The Exception Activity Report, described in Section 3.3.4.2, uses these events.

Table A-11 lists the Oracle Database exception source database events and the equivalent Oracle Audit Vault events.

Table A-11 Oracle Database Exception Audit Events

Event Name Description Source Event Audit Vault Event

NETWORK ERROR

122

NETWORK ERROR


Table A-12 lists the Oracle Database exception event attributes.

Table A-12 Oracle Database Exception Event Attributes

Attribute Name Data Type

CLIENT_APPINFO

VARCHAR2(4000)

CLIENT_ID

VARCHAR2(4000)

COMMENT_TEXT

VARCHAR2(4000)

CONTEXTID

VARCHAR2(4000)

ENDUSER

VARCHAR2(4000)

EVENT_STATUS

VARCHAR2(30)

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INSTANCE_NUMBER

NUMBER

OBJECT_ID

NUMBER

OSUSER_NAME

VARCHAR2(4000)

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

PROXY_SESSIONID

NUMBER

SCN

NUMBER

SESSION_ACTIONS

VARCHAR2(255)

SOURCE_EVENTID

VARCHAR2(255)

SQL_BINDFoot 1 

VARCHAR2(4000)

SQL_TEXTFoot 2 

VARCHAR2(4000)

STATEMENTID

NUMBER

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

UNDO_SQL_TEXT

VARCHAR2(4000)

USER_GUID

VARCHAR2(32)

USERNAME

VARCHAR2(4000)


Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

A.8 Invalid Record Events

Invalid record events track audited activity that Oracle Audit Vault cannot recognize, possibly due to a corrupted audit record. The Invalid Audit Record Report, described in Section 3.3.4.3, uses these events.

Table A-13 lists the Oracle Database invalid record source database events and the equivalent Oracle Audit Vault events.

Table A-13 Oracle Database Invalid Record Audit Events

Event Name Description Source Event Audit Vault Event

INVALID RECORD

30000

INVALID RECORD


Table A-14 lists the Oracle Database invalid record event attributes.

Table A-14 Oracle Database Invalid Record Event Attributes

Attribute Name Data Type

CLIENT_APPINFO

VARCHAR2(4000)

CLIENT_ID

VARCHAR2(4000)

COMMENT_TEXT

VARCHAR2(4000)

CONTEXTID

VARCHAR2(4000)

ENDUSER

VARCHAR2(4000)

ENDUSER

NUMBER

ERROR_MESSAGE

VARCHAR2(30)

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INSTANCE_NUMBER

NUMBER

MODULE_NAME

VARCHAR2(100)

OBJECT_ID

NUMBER

ORIGINAL_CONTENT1

VARCHAR2(4000)

ORIGINAL_CONTENT2

VARCHAR2(4000)

ORIGINAL_CONTENT3

VARCHAR2(4000)

OSUSER_NAME

VARCHAR2(4000)

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

PROXY_SESSIONID

NUMBER

SCN

NUMBER

SESSION_ACTIONS

VARCHAR2(255)

SEVERITY

NUMBER

SOURCE_EVENTID

VARCHAR2(255)

SQL_BINDFoot 1 

VARCHAR2(4000)

SQL_TEXTFoot 2 

VARCHAR2(4000)

STATEMENTID

NUMBER

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

UNDO_SQL_TEXT

VARCHAR2(4000)

USER_GUID

VARCHAR2(32)

USERNAME

VARCHAR2(4000)


Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

A.9 Object Management Events

Object management events track audited actions performed on database objects, such as CREATE TABLE statements. The Object Management Report, described in Section 3.3.3.4, uses these events.

Table A-15 lists the Oracle Database object management source database events and the equivalent Oracle Audit Vault events.

Table A-15 Oracle Database Object Management Audit Events

Event Name Description Source Event Audit Vault Event

ALTER DIMENSION

175

ALTER DIMENSION

ALTER EDITION (Release 11.2)

213

ALTER EDITION

ALTER INDEX

11

ALTER INDEX

ALTER MATERIALIZED VIEW

75

ALTER MATERIALIZED VIEW

ALTER MATERIALIZED VIEW LOG

72

ALTER MATERIALIZED VIEW LOG

ALTER MINING MODEL (Release 11.2)

130

ALTER MINING MODEL

ALTER OPERATOR

183

ALTER OPERATOR

ALTER OUTLINE

179

ALTER OUTLINE

ALTER PUBLIC SYNONYM (Release 11.2)

134

ALTER PUBLIC SYNONYM

ALTER SEQUENCE

14

ALTER SEQUENCE

ALTER SYNONYM (Release 11.2)

192

ALTER SYNONYM

ALTER TABLE

15

ALTER TABLE

APPLY TABLE OR SCHEMA POLICYFoot 1 

500

APPLY TABLE OR SCHEMA POLICY

CREATE MINING MODEL (Release 11.2)

133

CREATE MINING MODEL

CREATE DIMENSION

174

CREATE DIMENSION

CREATE DIRECTORY

157

CREATE DIRECTORY

CREATE EDITION (Release 11.2

212

CREATE EDITION

CREATE INDEX

9

CREATE INDEX

CREATE MATERIALIZED VIEW

74

CREATE MATERIALIZED VIEW

CREATE MATERIALIZED VIEW LOG

71

CREATE MATERIALIZED VIEW LOG

CREATE OUTLINE

180

CREATE OUTLINE

CREATE PUBLIC DATABASE LINK

112

CREATE PUBLIC DATABASE LINK

CREATE PUBLIC SYNONYM

110

CREATE PUBLIC SYNONYM

CREATE SCHEMA

56

CREATE SCHEMA

CREATE SEQUENCE

13

CREATE SEQUENCE

CREATE SYNONYM

19

CREATE SYNONYM

CREATE TABLE

1

CREATE TABLE

CREATE VIEW

21

CREATE VIEW

DROP DIMENSION

176

DROP DIMENSION

DROP DIRECTORY

158

DROP DIRECTORY

DROP EDITION (Release 11.2)

214

DROP EDITION

DROP INDEX

10

DROP INDEX

DROP MATERIALIZED VIEW

76

DROP MATERIALIZED VIEW

DROP MATERIALIZED VIEW LOG

73

DROP MATERIALIZED VIEW LOG

DROP OUTLINE

181

DROP OUTLINE

DROP PUBLIC DATABASE LINK

113

DROP PUBLIC DATABASE LINK

DROP PUBLIC SYNONYM

111

DROP PUBLIC SYNONYM

DROP SEQUENCE

16

DROP SEQUENCE

DROP SYNONYM

20

DROP SYNONYM

DROP TABLE

12

DROP TABLE

DROP VIEW

22

DROP VIEW

FLASHBACK TABLE

205

FLASHBACK TABLE

LOCK

26

LOCK

PURGE INDEX

201

PURGE INDEX

PURGE TABLE

200

PURGE TABLE

REMOVE TABLE OR SCHEMA POLICYFoot 2 

501

REMOVE TABLE OR SCHEMA POLICY

RENAME

28

RENAME

UNDROP OBJECT

202

UNDROP OBJECT

UPDATE INDEXES

182

UPDATE INDEXES

VALIDATE INDEX

23

VALIDATE INDEX


Footnote 1 APPLY TABLE OR SCHEMA POLICY is an Oracle Label Security audit event.

Footnote 2 REMOVE TABLE OR SCHEMA POLICY is an Oracle Label Security audit event.

Table A-16 lists the Oracle Database object management event attributes.

Table A-16 Oracle Database Object Management Event Attributes

Attribute Name Data Type

ASSOCIATED_OBJECT_NAME

VARCHAR2(4000)

ASSOCIATED_OBJECT_OWNER

VARCHAR2(4000)

CLIENT_APPINFO

VARCHAR2(4000)

CLIENT_ID

VARCHAR2(4000)

COMMENT_TEXT

VARCHAR2(4000)

CONTEXTID

VARCHAR2(4000)

ENDUSER

VARCHAR2(4000)

EVENT_STATUS

VARCHAR2(30)

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

NEW_OBJECT_NAME

VARCHAR2(4000)

NEW_OBJECT_OWNER

VARCHAR2(4000)

OBJECT_ID

NUMBER

OSUSER_NAME

VARCHAR2(4000)

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

PROXY_SESSIONID

NUMBER

SCN

NUMBER

SESSION_ACTIONS

VARCHAR2(255)

SOURCE_EVENTID

VARCHAR2(255)

SQL_BINDFoot 1 

VARCHAR2(4000)

SQL_TEXTFoot 2 

VARCHAR2(4000)

STATEMENTID

NUMBER

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

UNDO_SQL_TEXT

VARCHAR2(4000)

USER_GUID

VARCHAR2(32)

USERNAME

VARCHAR2(4000)


Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

A.10 Peer Association Events

Peer association events track database link statements. The Distributed Database Report, described in Section 3.3.2.5, uses these events.

Table A-17 lists the Oracle Database peer association source database events and the equivalent Oracle Audit Vault events.

Table A-17 Oracle Database Peer Association Audit Events

Event Name Description Source Event Audit Vault Event

CREATE DATABASE LINK

32

CREATE DATABASE LINK

DROP DATABASE LINK

33

DROP DATABASE LINK


Table A-18 lists the Oracle Database peer association event attributes.

Table A-18 Oracle Database Peer Association Event Attributes

Attribute Name Data Type

CLIENT_APPINFO

VARCHAR2(4000)

CLIENT_ID

VARCHAR2(4000)

COMMENT_TEXT

VARCHAR2(4000)

CONTEXTID

VARCHAR2(4000)

ENDUSER

VARCHAR2(4000)

EVENT_STATUS

VARCHAR2(30)

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INSTANCE_NUMBER

NUMBER

OBJECT_ID

NUMBER

OSUSER_NAME

VARCHAR2(4000)

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

PROXY_SESSIONID

NUMBER

SCN

NUMBER

SESSION_ACTIONS

VARCHAR2(255)

SOURCE_EVENTID

VARCHAR2(255)

SQL_BINDFoot 1 

VARCHAR2(4000)

SQL_TEXTFoot 2 

VARCHAR2(4000)

STATEMENTID

NUMBER

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

UNDO_SQL_TEXT

VARCHAR2(4000)

USER_GUID

VARCHAR2(32)

USERNAME

VARCHAR2(4000)


Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

A.11 Role and Privilege Management Events

Role and privilege management events track audited role and privilege management activity, such as granting object permissions to a user. The Role and Privilege Management Report, described in Section 3.3.3.6, uses these events.

Table A-19 lists the Oracle Database role and privilege management source database events and the equivalent Oracle Audit Vault events.

Table A-19 Oracle Database Role and Privilege Management Audit Events

Event Name Description Source Event Audit Vault Event

ALTER ROLE

79

ALTER ROLE

CREATE ROLE

52

CREATE ROLE

DROP ROLE

54

DROP ROLE

GRANT OBJECT

17

GRANT OBJECT

GRANT ROLE

114

GRANT ROLE

OBJECT EXISTS ERRORSFoot 1 

505

OBJECT EXISTS ERRORS

REVOKE OBJECT

18

REVOKE OBJECT

REVOKE ROLE

115

REVOKE ROLE

SET USER OR PROGRAM UNIT LABEL1

502

SET USER OR PROGRAM UNIT LABEL

PRIVILEGED ACTION1

506

PRIVILEGED ACTION

Footnote 1 OBJECT EXISTS ERRORS, SET USER OR PROGRAM UNIT LABEL, and PRIVILEGED ACTION are Oracle Label Security events.

Table A-20 lists the Oracle Database role and privilege management event attributes.

Table A-20 Oracle Database Role and Privilege Management Event Attributes

Attribute Name Data Type

ADMIN_OPTION

NUMBER

CLIENT_APPINFO

VARCHAR2(4000)

CLIENT_ID

VARCHAR2(4000)

COMMENT_TEXT

VARCHAR2(4000)

CONTEXTID

VARCHAR2(4000)

ENDUSER

VARCHAR2(4000)

EVENT_STATUS

VARCHAR2(30)

EVENT_TIME

TIMESTAMP WITH LOCAL TIME

GRANTEE

VARCHAR2(4000)

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INSTANCE_NUMBER

NUMBER

OBJECT_ID

NUMBER

OBJECT_PRIVILEGE

VARCHAR2(255)

OSUSER_NAME

VARCHAR2(4000)

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

PROXY_SESSIONID

NUMBER

ROLE_NAME

VARCHAR2(4000)

SCN

NUMBER

SESSION_ACTIONS

VARCHAR2(255)

SOURCE_EVENTID

VARCHAR2(255)

SQL_BINDFoot 1 

VARCHAR2(4000)

SQL_TEXTFoot 2 

VARCHAR2(4000)

STATEMENTID

NUMBER

SUB_CONTEXTID

VARCHAR2(4000)

SYSTEM_PRIVILEGE

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

UNDO_SQL_TEXT

VARCHAR2(4000)

USER_GUID

VARCHAR2(32)

USERNAME

VARCHAR2(4000)


Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

A.12 Service and Application Utilization Events

Service and application utilization events track audited application access activity, such as the execution of PL/SQL procedures or functions. The Procedure Executions Report, described in Section 3.3.2.6, uses these events.

Table A-21 lists the Oracle Database service and application utilization source database events and the equivalent Oracle Audit Vault events.

Table A-21 Oracle Database Service and Application Utilization Audit Events

Event Name Description Source Event Audit Vault Event

CALL METHOD

170

CALL METHOD

EXECUTE PROCEDURE

116

EXECUTE PROCEDURE

PL/SQL EXECUTE

47

PL/SQL EXECUTE


Table A-22 lists the Oracle Database service and application utilization event attributes.

Table A-22 Oracle Database Service and Application Utilization Event Attributes

Attribute Name Data Type

CLIENT_APPINFO

VARCHAR2(4000)

CLIENT_ID

VARCHAR2(4000)

COMMENT_TEXT

VARCHAR2(4000)

CONTEXTID

VARCHAR2(4000)

ENDUSER

VARCHAR2(4000)

EVENT_STATUS

VARCHAR2(30)

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INSTANCE_NUMBER

NUMBER

OBJECT_ID

NUMBER

OSUSER_NAME

VARCHAR2(4000)

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

PROXY_SESSIONID

NUMBER

SCN

NUMBER

SESSION_ACTIONS

VARCHAR2(255)

SOURCE_EVENTID

VARCHAR2(255)

SQL_BINDFoot 1 

VARCHAR2(4000)

SQL_TEXTFoot 2 

VARCHAR2(4000)

STATEMENTID

NUMBER

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

UNDO_SQL_TEXT

VARCHAR2(4000)

USER_GUID

VARCHAR2(32)

USERNAME

VARCHAR2(4000)


Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

A.13 System Management Events

System management events track audited system management activity, such as STARTUP and SHUTDOWN operations. The System Management Report, described in Section 3.3.3.7, uses these events.

Table A-23 lists the Oracle Database system management source database events and the equivalent Oracle Audit Vault events.

Table A-23 Oracle Database System Management Audit Events

Event Name Description Source Event Audit Vault Event

ALTER CLUSTER

5

ALTER CLUSTER

ALTER DATABASE

35

ALTER DATABASE

ALTER FLASHBACK ARCHIVE (Release 11.2)

219

ALTER FLASHBACK ARCHIVE

ALTER ROLLBACK SEG

37

ALTER ROLLBACK SEG

ALTER SYSTEM

49

ALTER SYSTEM

ALTER TABLESPACE

40

ALTER TABLESPACE

ANALYZE CLUSTER

64

ANALYZE CLUSTER

CREATE CLUSTER

4

CREATE CLUSTER

CREATE CONTROL FILE

57

CREATE CONTROL FILE

CREATE DATABASE

34

CREATE DATABASE

CREATE FLASHBACK ARCHIVE (Release 11.2)

218

CREATE FLASHBACK ARCHIVE

CREATE ROLLBACK SEG

36

CREATE ROLLBACK SEG

CREATE TABLESPACE

39

CREATE TABLESPACE

DISABLE ALL TRIGGERS

121

DISABLE ALL TRIGGERS

DROP CLUSTER

8

DROP CLUSTER

DROP FLASHBACK ARCHIVE (Release 11.2)

220

DROP FLASHBACK ARCHIVE

DROP ROLLBACK SEG

38

DROP ROLLBACK SEG

DROP TABLESPACE

41

DROP TABLESPACE

ENABLE ALL TRIGGERS

120

ENABLE ALL TRIGGERS

FLASHBACK

128

FLASHBACK

FLASHBACK DATABASE

204

FLASHBACK DATABASE

PURGE DBA_RECYCLEBIN

198

PURGE DBA_RECYCLEBIN

PURGE TABLESPACE

199

PURGE TABLESPACE

SHUTDOWN

20005

SHUTDOWN

STARTUP

20004

STARTUP

SUPER USER TRANSACTION CONTROL (Release 11.2)

20000

SUPER USER TRANSACTION CONTROL

SUPER USER DDL

20002

SUPER USER DDL

SUPER USER DML

20003

SUPER USER DML

SYSTEM GRANT

108

SYSTEM GRANT

SYSTEM REVOKE

109

SYSTEM REVOKE

TRUNCATE CLUSTER

86

TRUNCATE CLUSTER


Table A-24 lists the Oracle Database system management event attributes.

Table A-24 Oracle Database System Management Event Attributes

Attribute Name Data Type

CLIENT_APPINFO

VARCHAR2(4000)

CLIENT_ID

VARCHAR2(4000)

COMMENT_TEXT

VARCHAR2(4000)

CONTEXTID

VARCHAR2(4000)

ENDUSER

VARCHAR2(4000)

EVENT_STATUS

VARCHAR2(30)

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INSTANCE_NUMBER

NUMBER

OBJECT_ID

NUMBER

OSUSER_NAME

VARCHAR2(4000)

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

PROXY_SESSIONID

NUMBER

SCN

NUMBER

SESSION_ACTIONS

VARCHAR2(255)

SOURCE_EVENTID

VARCHAR2(255)

SQL_BINDFoot 1 

VARCHAR2(4000)

SQL_TEXTFoot 2 

VARCHAR2(4000)

STATEMENTID

NUMBER

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

UNDO_SQL_TEXT

VARCHAR2(4000)

USER_GUID

VARCHAR2(32)

USERNAME

VARCHAR2(4000)


Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

A.14 Unknown or Uncategorized Events

Unknown or uncategorized events track audited activity that cannot be categorized, such as ALTER SUMMARY statements. The Uncategorized Activity Report, described in Section 3.3.4.4, uses these events.

Table A-25 lists the Oracle Database unknown or uncategorized source database events and the equivalent Oracle Audit Vault events.

Table A-25 Oracle Database Unknown or Uncategorized Audit Events

Event Name Description Source Event Audit Vault Event

ALTER SUMMARY

172

ALTER SUMMARY

COMMENT

29

COMMENT

CREATE SUMMARY

171

CREATE SUMMARY

DROP SUMMARY

173

DROP SUMMARY

NO-OP

27

NO-OP

SUPER USER UNKNOWN

20006

SUPER USER UNKNOWN

UNKNOWN

0

UNKNOWN

USER COMMENT

117

USER COMMENT


Table A-26 lists the Oracle Database unknown or uncategorized event attributes.

Table A-26 Oracle Database Unknown or Uncategorized Event Attributes

Attribute Name Data Type

CLIENT_APPINFO

VARCHAR2(4000)

CLIENT_ID

VARCHAR2(4000)

COMMENT_TEXT

VARCHAR2(4000)

CONTEXTID

VARCHAR2(4000)

ENDUSER

VARCHAR2(4000)

EVENT_STATUS

VARCHAR2(30)

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INSTANCE_NUMBER

NUMBER

OBJECT_ID

NUMBER

OSUSER_NAME

VARCHAR2(4000)

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

PROXY_SESSIONID

NUMBER

SCN

NUMBER

SESSION_ACTIONS

VARCHAR2(255)

SOURCE_EVENTID

VARCHAR2(255)

SQL_BINDFoot 1 

VARCHAR2(4000)

SQL_TEXTFoot 2 

VARCHAR2(4000)

STATEMENTID

NUMBER

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

UNDO_SQL_TEXT

VARCHAR2(4000)

USER_GUID

VARCHAR2(32)

USERNAME

VARCHAR2(4000)


Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.

A.15 User Session Events

User session events track audited authentication events for users who log in to the database. The User Sessions Report, described in Section 3.3.2.7, uses these events.

Table A-27 lists the Oracle Database user session source database events and the equivalent Oracle Audit Vault events.

Table A-27 Oracle Database User Session Audit Events

Event Name Description Source Event Audit Vault Event

ALTER SESSION

42

ALTER SESSION

COMMIT

44

COMMIT

CREATE RESTORE POINT

206

CREATE RESTORE POINT

CREATE SESSION

129

CREATE SESSION

DROP RESTORE POINT

207

DROP RESTORE POINT

LOGOFF

101

LOGOFF

LOGOFF BY CLEANUP

102

LOGOFF BY CLEANUP

LOGON

100

LOGON

PROXY AUTHENTICATION ONLY

208

PROXY AUTHENTICATION ONLY

PURGE USER_RECYCLEBIN

197

PURGE USER_RECYCLEBIN

ROLLBACK

45

ROLLBACK

SAVEPOINT

46

SAVEPOINT

SESSION REC

103

SESSION REC

SET ROLE

55

SET ROLE

SET TRANSACTION

48

SET TRANSACTION

SUPER USER LOGON

20001

SUPER USER LOGON


Table A-28 lists the Oracle Database user session event attributes.

Table A-28 Oracle Database User Session Event Attributes

Attribute Name Data Type

AUTHENTICATION_METHOD

VARCHAR2(255)

CLIENT_APPINFO

VARCHAR2(4000)

CLIENT_ID

VARCHAR2(4000)

COMMENT_TEXT

VARCHAR2(4000)

CONTEXTID

VARCHAR2(4000)

ENDUSER

VARCHAR2(4000)

EVENT_STATUS

VARCHAR2(30)

EVENT_TIME

TIMESTAMP WITH LOCAL TIME ZONE

HOST_IP

VARCHAR2(255)

HOST_NAME

VARCHAR2(255)

HOST_TERMINAL

VARCHAR2(255)

INSTANCE_NUMBER

NUMBER

LOGOFF_DLOCK

NUMBER

LOGOFF_LREAD

NUMBER

LOGOFF_LWRITE

NUMBER

LOGOFF_PREAD

NUMBER

OBJECT_ID

NUMBER

OSUSER_NAME

VARCHAR2(4000)

PARENT_CONTEXTID

VARCHAR2(4000)

PRIVILEGES_USED

VARCHAR2(4000)

PROCESS#

NUMBER

PROXY_SESSIONID

NUMBER

SCN

NUMBER

SESSION_ACTIONS

VARCHAR2(255)

SOURCE_EVENTID

VARCHAR2(255)

SQL_BINDFoot 1 

VARCHAR2(4000)

SQL_TEXTFoot 2 

VARCHAR2(4000)

STATEMENTID

NUMBER

SUB_CONTEXTID

VARCHAR2(4000)

TARGET_OBJECT

VARCHAR2(4000)

TARGET_OWNER

VARCHAR2(4000)

THREAD#

NUMBER

TOOLS_USED

VARCHAR2(4000)

UNDO_SQL_TEXT

VARCHAR2(4000)

USER_GUID

VARCHAR2(32)

USERNAME

VARCHAR2(4000)


Footnote 1 SQL_BIND variable could be truncated to 4000 characters.

Footnote 2 SQL_TEXT variable could be truncated to 4000 characters.