Oracle® Audit Vault Auditor's Guide 10g Release 2 (10.2.2) Part Number B28853-02 |
|
|
View PDF |
When creating alerts, you can specify the type of alerts that are triggered based on event category. If an audit event category is selected, you can choose the attribute of the alert to be fine-grained. You use audit event categories in the Advanced Alert Condition section of the Create Alert Rule Page.
This appendix contains reference information about audit events. It includes the following sections:
This section lists event attributes, by event category, and their attribute types. The event categories are:
Account management event attributes are shown in Table B-1.
Table B-1 Account Management Event Attributes
Attribute Name | Attribute Type |
---|---|
client_appinfo |
VARCHAR2(4000) |
client_id |
VARCHAR2(4000) |
comment_text |
VARCHAR2(4000) |
contextid |
VARCHAR2(4000) |
enduser |
VARCHAR2(4000) |
event_status |
VARCHAR2(30) |
event_time |
TIMESTAMP WITH LOCAL TIME ZONE |
host_ip |
VARCHAR2(255) |
host_name |
VARCHAR2(255) |
host_terminal |
VARCHAR2(255) |
instance_number |
NUMBER |
object_id |
NUMBER |
osuser_name |
VARCHAR2(4000) |
parent_contextid |
VARCHAR2(4000) |
privileges_used |
VARCHAR2(4000) |
process# |
NUMBER |
proxy_sessionid |
NUMBER |
scn |
NUMBER |
session_actions |
VARCHAR2(255) |
source_eventid |
VARCHAR2(255) |
sql_bindFoot 1 |
VARCHAR2(4000) |
sql_textFoot 2 |
VARCHAR2(4000) |
statementid |
NUMBER |
sub_contextid |
VARCHAR2(4000) |
target_object |
VARCHAR2(4000) |
target_owner |
VARCHAR2(4000) |
thread# |
NUMBER |
tools_used |
VARCHAR2(4000) |
undo_sql_text |
VARCHAR2(4000) |
user_guid |
VARCHAR2(32) |
username |
VARCHAR2(4000) |
Footnote 1 sql_bind variable could be truncated to 4000 characters.
Footnote 2 sql_text variable could be truncated to 4000 characters.
Application management event attributes are shown in Table B-2.
Table B-2 Application Management Event Attributes
Attribute Name | Attribute Type |
---|---|
associated_object_name |
VARCHAR2(4000) |
associated_object_owner |
VARCHAR2(4000) |
client_appinfo |
VARCHAR2(4000) |
client_id |
VARCHAR2(4000) |
comment_text |
VARCHAR2(4000) |
contextid |
VARCHAR2(4000) |
enduser |
VARCHAR2(4000) |
event_status |
VARCHAR2(30) |
event_time |
TIMESTAMP WITH LOCAL TIME ZONE |
host_ip |
VARCHAR2(255) |
host_name |
VARCHAR2(255) |
host_terminal |
VARCHAR2(255) |
instance_number |
NUMBER |
new_object_name |
VARCHAR2(4000) |
new_object_owner |
VARCHAR2(4000) |
object_id |
NUMBER |
osuser_name |
VARCHAR2(4000) |
parent_contextid |
VARCHAR2(4000) |
privileges_used |
VARCHAR2(4000) |
process# |
NUMBER |
proxy_sessionid |
NUMBER |
scn |
NUMBER |
session_actions |
VARCHAR2(255) |
source_eventid |
VARCHAR2(255) |
sql_bind Foot 1 |
VARCHAR2(4000) |
sql_textFoot 2 |
VARCHAR2(4000) |
statementid |
NUMBER |
sub_contextid |
VARCHAR2(4000) |
target_object |
VARCHAR2(4000) |
target_owner |
VARCHAR2(4000) |
thread# |
NUMBER |
tools_used |
VARCHAR2(4000) |
undo_sql_text |
VARCHAR2(4000) |
user_guid |
VARCHAR2(32) |
username |
VARCHAR2(4000) |
Footnote 1 sql_bind variable could be truncated to 4000 characters.
Footnote 2 sql_text variable could be truncated to 4000 characters.
Audit command event attributes are shown in Table B-3.
Table B-3 Audit Command Event Attributes
Attribute Name | Attribute Type |
---|---|
audit_option |
VARCHAR2(4000) |
client_appinfo |
VARCHAR2(4000) |
client_id |
VARCHAR2(4000) |
comment_text |
VARCHAR2(4000) |
contextid |
VARCHAR2(4000) |
enduser |
VARCHAR2(4000) |
event_status |
VARCHAR2(30) |
event_time |
TIMESTAMP WITH LOCAL TIME ZONE |
host_ip |
VARCHAR2(255) |
host_name |
VARCHAR2(255) |
host_terminal |
VARCHAR2(255) |
instance_number |
NUMBER |
object_id |
NUMBER |
osuser_name |
VARCHAR2(4000) |
parent_contextid |
VARCHAR2(4000) |
privileges_used |
VARCHAR2(4000) |
process# |
NUMBER |
proxy_sessionid |
NUMBER |
scn |
NUMBER |
session_actions |
VARCHAR2(255) |
source_eventid |
VARCHAR2(255) |
sql_bindFoot 1 |
VARCHAR2(4000) |
sql_text Foot 2 |
VARCHAR2(4000) |
statementid |
NUMBER |
sub_contextid |
VARCHAR2(4000) |
target_object |
VARCHAR2(4000) |
target_owner |
VARCHAR2(4000) |
thread# |
NUMBER |
tools_used |
VARCHAR2(4000) |
undo_sql_text |
VARCHAR2(4000) |
user_guid |
VARCHAR2(32) |
username |
VARCHAR2(4000) |
Footnote 1 sql_bind variable could be truncated to 4000 characters.
Footnote 2 sql_text variable could be truncated to 4000 characters.
Data access event attributes are shown in Table B-4.
Table B-4 Data Access Event Attributes
Attribute Name | Attribute Type |
---|---|
client_appinfo |
VARCHAR2(4000) |
client_id |
VARCHAR2(4000) |
col_namelist |
VARCHAR2(4000) |
col_newval1 |
VARCHAR2(4000) |
col_newval10 |
VARCHAR2(4000) |
col_newval11 |
VARCHAR2(4000) |
col_newval2 |
VARCHAR2(4000) |
col_newval3 |
VARCHAR2(4000) |
col_newval4 |
VARCHAR2(4000) |
col_newval5 |
VARCHAR2(4000) |
col_newval6 |
VARCHAR2(4000) |
col_newval7 |
VARCHAR2(4000) |
col_newval8 |
VARCHAR2(4000) |
col_newval9 |
VARCHAR2(4000) |
col_oldval1 |
VARCHAR2(4000) |
col_oldval10 |
VARCHAR2(4000) |
col_oldval11 |
VARCHAR2(4000) |
col_oldval2 |
VARCHAR2(4000) |
col_oldval3 |
VARCHAR2(4000) |
col_oldval4 |
VARCHAR2(4000) |
col_oldval5 |
VARCHAR2(4000) |
col_oldval6 |
VARCHAR2(4000) |
col_oldval7 |
VARCHAR2(4000) |
col_oldval8 |
VARCHAR2(4000) |
col_oldval9 |
VARCHAR2(4000) |
comment_text |
VARCHAR2(4000) |
contextid |
VARCHAR2(4000) |
data_values |
AV_DATAVALUES_LIST |
enduser |
VARCHAR2(4000) |
event_status |
VARCHAR2(30) |
event_time |
TIMESTAMP WITH LOCAL TIME ZONE |
fga_policyname |
VARCHAR2(30) |
host_ip |
VARCHAR2(255) |
host_name |
VARCHAR2(255) |
host_terminal |
VARCHAR2(255) |
instance_number |
NUMBER |
num_inlinecol |
NUMBER |
object_id |
NUMBER |
osuser_name |
VARCHAR2(4000) |
parent_contextid |
VARCHAR2(4000) |
privileges_used |
VARCHAR2(4000) |
process# |
NUMBER |
proxy_sessionid |
NUMBER |
row_id |
VARCHAR2(18) |
scn |
NUMBER |
session_actions |
VARCHAR2(255) |
source_eventid |
VARCHAR2(255) |
sql_bindFoot 1 |
VARCHAR2(4000) |
sql_textFoot 2 |
VARCHAR2(4000) |
statementid |
NUMBER |
sub_contextid |
VARCHAR2(4000) |
target_object |
VARCHAR2(4000) |
target_owner |
VARCHAR2(4000) |
thread# |
NUMBER |
tools_used |
VARCHAR2(4000) |
transaction_name |
VARCHAR2(256) |
undo_sql_text |
VARCHAR2(4000) |
user_guid |
VARCHAR2(32) |
username |
VARCHAR2(4000) |
Footnote 1 sql_bind variable could be truncated to 4000 characters.
Footnote 2 sql_text variable could be truncated to 4000 characters.
Exceptional event attributes are shown in Table B-5.
Table B-5 Exceptional Event Attributes
Attribute Name | Attribute Type |
---|---|
client_appinfo |
VARCHAR2(4000) |
client_id |
VARCHAR2(4000) |
comment_text |
VARCHAR2(4000) |
contextid |
VARCHAR2(4000) |
enduser |
VARCHAR2(4000) |
event_status |
VARCHAR2(30) |
event_time |
TIMESTAMP WITH LOCAL TIME ZONE |
host_ip |
VARCHAR2(255) |
host_name |
VARCHAR2(255) |
host_terminal |
VARCHAR2(255) |
instance_number |
NUMBER |
object_id |
NUMBER |
osuser_name |
VARCHAR2(4000) |
parent_contextid |
VARCHAR2(4000) |
privileges_used |
VARCHAR2(4000) |
process# |
NUMBER |
proxy_sessionid |
NUMBER |
scn |
NUMBER |
session_actions |
VARCHAR2(255) |
source_eventid |
VARCHAR2(255) |
sql_bindFoot 1 |
VARCHAR2(4000) |
sql_text Foot 2 |
VARCHAR2(4000) |
statementid |
NUMBER |
sub_contextid |
VARCHAR2(4000) |
target_object |
VARCHAR2(4000) |
target_owner |
VARCHAR2(4000) |
thread# |
NUMBER |
tools_used |
VARCHAR2(4000) |
undo_sql_text |
VARCHAR2(4000) |
user_guid |
VARCHAR2(32) |
username |
VARCHAR2(4000) |
Footnote 1 sql_bind variable could be truncated to 4000 characters.
Footnote 2 sql_text variable could be truncated to 4000 characters.
Invalid record event attributes are shown in Table B-6.
Table B-6 Invalid Record Event Attributes
Attribute Name | Attribute Type |
---|---|
client_appinfo |
VARCHAR2(4000) |
client_id |
VARCHAR2(4000) |
comment_text |
VARCHAR2(4000) |
contextid |
VARCHAR2(4000) |
enduser |
VARCHAR2(4000) |
enduser |
NUMBER |
error_message |
VARCHAR2(30) |
event_time |
TIMESTAMP WITH LOCAL TIME ZONE |
host_ip |
VARCHAR2(255) |
host_name |
VARCHAR2(255) |
host_terminal |
VARCHAR2(255) |
instance_number |
NUMBER |
module_name |
VARCHAR2(100) |
object_id |
NUMBER |
original_content1 |
VARCHAR2(4000) |
original_content2 |
VARCHAR2(4000) |
original_content3 |
VARCHAR2(4000) |
osuser_name |
VARCHAR2(4000) |
parent_contextid |
VARCHAR2(4000) |
privileges_used |
VARCHAR2(4000) |
process# |
NUMBER |
proxy_sessionid |
NUMBER |
scn |
NUMBER |
session_actions |
VARCHAR2(255) |
severity |
NUMBER |
source_eventid |
VARCHAR2(255) |
sql_bindFoot 1 |
VARCHAR2(4000) |
sql_textFoot 2 |
VARCHAR2(4000) |
statementid |
NUMBER |
sub_contextid |
VARCHAR2(4000) |
target_object |
VARCHAR2(4000) |
target_owner |
VARCHAR2(4000) |
thread# |
NUMBER |
tools_used |
VARCHAR2(4000) |
undo_sql_text |
VARCHAR2(4000) |
user_guid |
VARCHAR2(32) |
username |
VARCHAR2(4000) |
Footnote 1 sql_bind variable could be truncated to 4000 characters.
Footnote 2 sql_text variable could be truncated to 4000 characters.
Object management event attributes are shown in Table B-7.
Table B-7 Object Management Event Attributes
Attribute Name | Attribute Type |
---|---|
associated_object_name |
VARCHAR2(4000) |
associated_object_owner |
VARCHAR2(4000) |
client_appinfo |
VARCHAR2(4000) |
client_id |
VARCHAR2(4000) |
comment_text |
VARCHAR2(4000) |
contextid |
VARCHAR2(4000) |
enduser |
VARCHAR2(4000) |
event_status |
VARCHAR2(30) |
event_time |
TIMESTAMP WITH LOCAL TIME ZONE |
host_ip |
VARCHAR2(255) |
host_name |
VARCHAR2(255) |
host_terminal |
VARCHAR2(255) |
new_object_name |
VARCHAR2(4000) |
new_object_owner |
VARCHAR2(4000) |
object_id |
NUMBER |
osuser_name |
VARCHAR2(4000) |
parent_contextid |
VARCHAR2(4000) |
privileges_used |
VARCHAR2(4000) |
process# |
NUMBER |
proxy_sessionid |
NUMBER |
scn |
NUMBER |
session_actions |
VARCHAR2(255) |
source_eventid |
VARCHAR2(255) |
sql_bindFoot 1 |
VARCHAR2(4000) |
sql_textFoot 2 |
VARCHAR2(4000) |
statementid |
NUMBER |
sub_contextid |
VARCHAR2(4000) |
target_object |
VARCHAR2(4000) |
target_owner |
VARCHAR2(4000) |
thread# |
NUMBER |
tools_used |
VARCHAR2(4000) |
undo_sql_text |
VARCHAR2(4000) |
user_guid |
VARCHAR2(32) |
username |
VARCHAR2(4000) |
Footnote 1 sql_bind variable could be truncated to 4000 characters.
Footnote 2 sql_text variable could be truncated to 4000 characters.
Peer association event attributes are shown in Table B-8.
Table B-8 Peer Association Event Attributes
Attribute Name | Attribute Type |
---|---|
client_appinfo |
VARCHAR2(4000) |
client_id |
VARCHAR2(4000) |
comment_text |
VARCHAR2(4000) |
contextid |
VARCHAR2(4000) |
contextid |
VARCHAR2(4000) |
enduser |
VARCHAR2(4000) |
event_status |
VARCHAR2(30) |
event_time |
TIMESTAMP WITH LOCAL TIME ZONE |
host_ip |
VARCHAR2(255) |
host_name |
VARCHAR2(255) |
host_terminal |
VARCHAR2(255) |
instance_number |
NUMBER |
object_id |
NUMBER |
osuser_name |
VARCHAR2(4000) |
parent_contextid |
VARCHAR2(4000) |
privileges_used |
VARCHAR2(4000) |
process# |
NUMBER |
proxy_sessionid |
NUMBER |
scn |
NUMBER |
session_actions |
VARCHAR2(255) |
source_eventid |
VARCHAR2(255) |
sql_bindFoot 1 |
VARCHAR2(4000) |
sql_textFoot 2 |
VARCHAR2(4000) |
statementid |
NUMBER |
sub_contextid |
VARCHAR2(4000) |
target_object |
VARCHAR2(4000) |
target_owner |
VARCHAR2(4000) |
thread# |
NUMBER |
tools_used |
VARCHAR2(4000) |
undo_sql_text |
VARCHAR2(4000) |
user_guid |
VARCHAR2(32) |
username |
VARCHAR2(4000) |
Footnote 1 sql_bind variable could be truncated to 4000 characters.
Footnote 2 sql_text variable could be truncated to 4000 characters.
Role and privilege management event attributes are shown in Table B-9.
Table B-9 Role and Privilege Management Event Attributes
Attribute Name | Attribute Type |
---|---|
admin_option |
NUMBER |
client_appinfo |
VARCHAR2(4000) |
client_id |
VARCHAR2(4000) |
comment_text |
VARCHAR2(4000) |
contextid |
VARCHAR2(4000) |
enduser |
VARCHAR2(4000) |
event_status |
VARCHAR2(30) |
event_time |
TIMESTAMP WITH LOCAL TIME |
grantee |
VARCHAR2(4000) |
host_ip |
VARCHAR2(255) |
host_name |
VARCHAR2(255) |
host_terminal |
VARCHAR2(255) |
instance_number |
NUMBER |
object_id |
NUMBER |
object_privilege |
VARCHAR2(255) |
osuser_name |
VARCHAR2(4000) |
parent_contextid |
VARCHAR2(4000) |
privileges_used |
VARCHAR2(4000) |
process# |
NUMBER |
proxy_sessionid |
NUMBER |
role_name |
VARCHAR2(4000) |
scn |
NUMBER |
session_actions |
VARCHAR2(255) |
source_eventid |
VARCHAR2(255) |
sql_bindFoot 1 |
VARCHAR2(4000) |
sql_textFoot 2 |
VARCHAR2(4000) |
statementid |
NUMBER |
sub_contextid |
VARCHAR2(4000) |
system_privilege |
VARCHAR2(4000) |
target_object |
VARCHAR2(4000) |
target_owner |
VARCHAR2(4000) |
thread# |
NUMBER |
tools_used |
VARCHAR2(4000) |
undo_sql_text |
VARCHAR2(4000) |
user_guid |
VARCHAR2(32) |
username |
VARCHAR2(4000) |
Footnote 1 sql_bind variable could be truncated to 4000 characters.
Footnote 2 sql_text variable could be truncated to 4000 characters.
Service and application utilization event attributes are shown in Table B-10.
Table B-10 Service and Application Utilization Event Attributes
Attribute Name | Attribute Type |
---|---|
client_appinfo |
VARCHAR2(4000) |
client_id |
VARCHAR2(4000) |
comment_text |
VARCHAR2(4000) |
contextid |
VARCHAR2(4000) |
enduser |
VARCHAR2(4000) |
event_status |
VARCHAR2(30) |
event_time |
TIMESTAMP WITH LOCAL TIME ZONE |
host_ip |
VARCHAR2(255) |
host_name |
VARCHAR2(255) |
host_terminal |
VARCHAR2(255) |
instance_number |
NUMBER |
object_id |
NUMBER |
osuser_name |
VARCHAR2(4000) |
parent_contextid |
VARCHAR2(4000) |
privileges_used |
VARCHAR2(4000) |
process# |
NUMBER |
proxy_sessionid |
NUMBER |
scn |
NUMBER |
session_actions |
VARCHAR2(255) |
source_eventid |
VARCHAR2(255) |
sql_bindFoot 1 |
VARCHAR2(4000) |
sql_text Foot 2 |
VARCHAR2(4000) |
statementid |
NUMBER |
sub_contextid |
VARCHAR2(4000) |
target_object |
VARCHAR2(4000) |
target_owner |
VARCHAR2(4000) |
thread# |
NUMBER |
tools_used |
VARCHAR2(4000) |
undo_sql_text |
VARCHAR2(4000) |
user_guid |
VARCHAR2(32) |
username |
VARCHAR2(4000) |
Footnote 1 sql_bind variable could be truncated to 4000 characters.
Footnote 2 sql_text variable could be truncated to 4000 characters.
System management event attributes are shown in Table B-11.
Table B-11 System Management Event Attributes
Attribute Name | Attribute Type |
---|---|
client_appinfo |
VARCHAR2(4000) |
client_id |
VARCHAR2(4000) |
comment_text |
VARCHAR2(4000) |
contextid |
VARCHAR2(4000) |
enduser |
VARCHAR2(4000) |
event_status |
VARCHAR2(30) |
event_time |
TIMESTAMP WITH LOCAL TIME ZONE |
host_ip |
VARCHAR2(255) |
host_name |
VARCHAR2(255) |
host_terminal |
VARCHAR2(255) |
instance_number |
NUMBER |
object_id |
NUMBER |
osuser_name |
VARCHAR2(4000) |
parent_contextid |
VARCHAR2(4000) |
privileges_used |
VARCHAR2(4000) |
process# |
NUMBER |
proxy_sessionid |
NUMBER |
scn |
NUMBER |
session_actions |
VARCHAR2(255) |
source_eventid |
VARCHAR2(255) |
sql_bindFoot 1 |
VARCHAR2(4000) |
sql_textFoot 2 |
VARCHAR2(4000) |
statementid |
NUMBER |
sub_contextid |
VARCHAR2(4000) |
target_object |
VARCHAR2(4000) |
target_owner |
VARCHAR2(4000) |
thread# |
NUMBER |
tools_used |
VARCHAR2(4000) |
undo_sql_text |
VARCHAR2(4000) |
user_guid |
VARCHAR2(32) |
username |
VARCHAR2(4000) |
Footnote 1 sql_bind variable could be truncated to 4000 characters.
Footnote 2 sql_text variable could be truncated to 4000 characters.
Unknown or uncategorized event attributes are shown in Table B-12.
Table B-12 Unknown or Uncategorized Event Attributes
Attribute Name | Attribute Type |
---|---|
client_appinfo |
VARCHAR2(4000) |
client_id |
VARCHAR2(4000) |
comment_text |
VARCHAR2(4000) |
contextid |
VARCHAR2(4000) |
enduser |
VARCHAR2(4000) |
event_status |
VARCHAR2(30) |
event_time |
TIMESTAMP WITH LOCAL TIME ZONE |
host_ip |
VARCHAR2(255) |
host_name |
VARCHAR2(255) |
host_terminal |
VARCHAR2(255) |
instance_number |
NUMBER |
object_id |
NUMBER |
osuser_name |
VARCHAR2(4000) |
parent_contextid |
VARCHAR2(4000) |
privileges_used |
VARCHAR2(4000) |
process# |
NUMBER |
proxy_sessionid |
NUMBER |
scn |
NUMBER |
session_actions |
VARCHAR2(255) |
source_eventid |
VARCHAR2(255) |
sql_bind Foot 1 |
VARCHAR2(4000) |
sql_text Foot 2 |
VARCHAR2(4000) |
statementid |
NUMBER |
sub_contextid |
VARCHAR2(4000) |
target_object |
VARCHAR2(4000) |
target_owner |
VARCHAR2(4000) |
thread# |
NUMBER |
tools_used |
VARCHAR2(4000) |
undo_sql_text |
VARCHAR2(4000) |
user_guid |
VARCHAR2(32) |
username |
VARCHAR2(4000) |
Footnote 1 sql_bind variable could be truncated to 4000 characters.
Footnote 2 sql_text variable could be truncated to 4000 characters.
User session event attributes are shown in Table B-13.
Table B-13 User Session Event Attributes
Attribute Name | Attribute Type |
---|---|
authentication_method |
VARCHAR2(255) |
client_appinfo |
VARCHAR2(4000) |
client_id |
VARCHAR2(4000) |
comment_text |
VARCHAR2(4000) |
contextid |
VARCHAR2(4000) |
enduser |
VARCHAR2(4000) |
event_status |
VARCHAR2(30) |
event_time |
TIMESTAMP WITH LOCAL TIME ZONE |
host_ip |
VARCHAR2(255) |
host_name |
VARCHAR2(255) |
host_terminal |
VARCHAR2(255) |
instance_number |
NUMBER |
logoff_dlock |
NUMBER |
logoff_lread |
NUMBER |
logoff_lwrite |
NUMBER |
logoff_pread |
NUMBER |
object_id |
NUMBER |
osuser_name |
VARCHAR2(4000) |
parent_contextid |
VARCHAR2(4000) |
privileges_used |
VARCHAR2(4000) |
process# |
NUMBER |
proxy_sessionid |
NUMBER |
scn |
NUMBER |
session_actions |
VARCHAR2(255) |
source_eventid |
VARCHAR2(255) |
sql_bindFoot 1 |
VARCHAR2(4000) |
sql_textFoot 2 |
VARCHAR2(4000) |
statementid |
NUMBER |
sub_contextid |
VARCHAR2(4000) |
target_object |
VARCHAR2(4000) |
target_owner |
VARCHAR2(4000) |
thread# |
NUMBER |
tools_used |
VARCHAR2(4000) |
undo_sql_text |
VARCHAR2(4000) |
user_guid |
VARCHAR2(32) |
username |
VARCHAR2(4000) |
Footnote 1 sql_bind variable could be truncated to 4000 characters.
Footnote 2 sql_text variable could be truncated to 4000 characters.
Source event IDs are numbers that represent the events in each category. A logon event, for example, is specified as:
SOURCE_EVENTID = '100'
This section lists events, by category, and their corresponding Oracle Database (ORCLDB) events. The event categories are:
Account management events and event IDs are shown in Table B-1.
Application management events and event IDs are shown in Table B-15.
Table B-15 Application Management Events and Event IDs
Event | ORCLDB Event ID |
---|---|
ALTER FUNCTION |
92 |
ALTER JAVA |
161 |
ALTER PACKAGE |
95 |
ALTER PACKAGE BODY |
98 |
ALTER PROCEDURE |
25 |
ALTER RESOURCE COST |
70 |
ALTER REWRITE EQUIVALENCE |
210 |
ALTER TRIGGER |
60 |
ALTER TYPE |
80 |
ALTER TYPE BODY |
82 |
ANALYZE INDEX |
63 |
ANALYZE TABLE |
62 |
ASSOCIATE STATISTICS |
168 |
CREATE CONTEXT |
177 |
CREATE FUNCTION |
91 |
CREATE INDEXTYPE |
164 |
CREATE JAVA |
160 |
CREATE LIBRARY |
159 |
CREATE OPERATOR |
163 |
CREATE PACKAGE |
94 |
CREATE PACKAGE BODY |
97 |
CREATE PROCEDURE |
24 |
CREATE TRIGGER |
59 |
CREATE TYPE |
77 |
CREATE TYPE BODY |
81 |
DECLARE REWRITE EQUIVALENCE |
209 |
DISABLE TRIGGER |
119 |
DISASSOCIATE STATISTICS |
169 |
DROP CONTEXT |
178 |
DROP FUNCTION |
93 |
DROP INDEXTYPE |
165 |
DROP JAVA |
162 |
DROP LIBRARY |
84 |
DROP OPERATOR |
167 |
DROP PACKAGE |
96 |
DROP PACKAGE BODY |
99 |
DROP PROCEDURE |
68 |
DROP REWRITE EQUIVALENCE |
211 |
DROP TRIGGER |
61 |
DROP TYPE |
78 |
DROP TYPE BODY |
83 |
ENABLE TRIGGER |
118 |
EXECUTE TYPE |
123 |
EXPLAIN |
50 |
Audit events and event IDs are shown in Table B-16.
Data access events and event IDs are shown in Table B-17.
Exceptional events and event IDs are shown in Table B-18.
Invalid record events and event IDs are shown in Table B-19.
Object management events and event IDs are shown in Table B-20.
Table B-20 Object Management Events and Event IDs
Event | ORCLDB Event ID |
---|---|
ALTER DIMENSION |
175 |
ALTER INDEX |
11 |
ALTER MATERIALIZED VIEW |
75 |
ALTER MATERIALIZED VIEW LOG |
72 |
ALTER OPERATOR |
183 |
ALTER OUTLINE |
179 |
ALTER SEQUENCE |
14 |
ALTER TABLE |
15 |
CREATE DIMENSION |
174 |
CREATE DIRECTORY |
157 |
CREATE INDEX |
9 |
CREATE MATERIALIZED VIEW |
74 |
CREATE MATERIALIZED VIEW LOG |
71 |
CREATE OUTLINE |
180 |
CREATE PUBLIC DATABASE LINK |
112 |
CREATE PUBLIC SYNONYM |
110 |
CREATE SCHEMA |
56 |
CREATE SEQUENCE |
13 |
CREATE SYNONYM |
19 |
CREATE TABLE |
1 |
CREATE VIEW |
21 |
DROP DIMENSION |
176 |
DROP DIRECTORY |
158 |
DROP INDEX |
10 |
DROP MATERIALIZED VIEW |
76 |
DROP MATERIALIZED VIEW LOG |
73 |
DROP OUTLINE |
181 |
DROP PUBLIC DATABASE LINK |
113 |
DROP PUBLIC SYNONYM |
111 |
DROP SEQUENCE |
16 |
DROP SYNONYM |
20 |
DROP TABLE |
12 |
DROP VIEW |
22 |
FLASHBACK TABLE |
205 |
LOCK |
26 |
PURGE INDEX |
201 |
PURGE TABLE |
200 |
RENAME |
28 |
UNDROP OBJECT |
202 |
UPDATE INDEXES |
182 |
VALIDATE INDEX |
23 |
Peer association events and event IDs are shown in Table B-21.
Role and privilege management events and event IDs are shown in Table B-22.
Service and application utilization events and event IDs are shown in Table B-23.
System management events and event IDs are shown in Table B-24.
Table B-24 System Management Events and Event IDs
Event | ORCLDB Event ID |
---|---|
ALTER CLUSTER |
5 |
ALTER DATABASE |
35 |
ALTER ROLLBACK SEG |
37 |
ALTER SYSTEM |
49 |
ALTER TABLESPACE |
40 |
ANALYZE CLUSTER |
64 |
CREATE CLUSTER |
4 |
CREATE CONTROL FILE |
57 |
CREATE DATABASE |
34 |
CREATE ROLLBACK SEG |
36 |
CREATE TABLESPACE |
39 |
DISABLE ALL TRIGGERS |
121 |
DROP CLUSTER |
8 |
DROP ROLLBACK SEG |
38 |
DROP TABLESPACE |
41 |
ENABLE ALL TRIGGERS |
120 |
FLASHBACK |
128 |
FLASHBACK DATABASE |
204 |
PURGE DBA_RECYCLEBIN |
198 |
PURGE TABLESPACE |
199 |
SHUTDOWN |
216 |
STARTUP |
215 |
SUPER USER DDL |
213 |
SUPER USER DML |
214 |
SYSTEM GRANT |
108 |
SYSTEM REVOKE |
109 |
TRUNCATE CLUSTER |
86 |
Unknown or uncategorized events and event IDs are shown in Table B-25.
User session events and event IDs are shown in Table B-26.
Table B-26 User Session Events and Event IDs
Event | ORCLDB Event ID |
---|---|
ALTER SESSION |
42 |
COMMIT |
44 |
CREATE RESTORE POINT |
206 |
CREATE SESSION |
129 |
DROP RESTORE POINT |
207 |
LOGOFF |
101 |
LOGOFF BY CLEANUP |
102 |
LOGON |
100 |
PROXY AUTHENTICATION ONLY |
208 |
PURGE USER_RECYCLEBIN |
197 |
ROLLBACK |
45 |
SAVEPOINT |
46 |
SESSION REC |
103 |
SET ROLE |
55 |
SET TRANSACTION |
48 |
SUPER USER LOGON |
212 |