B Oracle Database Audit Events

When creating alerts, you can specify the type of alerts that are triggered based on event category. If an audit event category is selected, you can choose the attribute of the alert to be fine-grained. You use audit event categories in the Advanced Alert Condition section of the Create Alert Rule Page.

This appendix contains reference information about audit events. It includes the following sections:

• Attributes by Event Category

• Source Event IDs

B.1 Attributes by Event Category

This section lists event attributes, by event category, and their attribute types. The event categories are:

• Account Management Event Attributes

• Application Management Event Attributes

• Audit Command Event Attributes

• Data Access Event Attributes

• Exceptional Event Attributes

• Invalid Record Event Attributes

• Object Management Event Attributes

• Peer Association Event Attributes

• Role and Privilege Management Event Attributes

• Service and Application Utilization Event Attributes

• System Management Event Attributes

• Unknown or Uncategorized Event Attributes

• User Session Event Attributes

B.1.1 Account Management Event Attributes

Account management event attributes are shown in Table B-1.

Table B-1 Account Management Event Attributes

Attribute Name	Attribute Type
client_appinfo	VARCHAR2(4000)
client_id	VARCHAR2(4000)
comment_text	VARCHAR2(4000)
contextid	VARCHAR2(4000)
enduser	VARCHAR2(4000)
event_status	VARCHAR2(30)
event_time	TIMESTAMP WITH LOCAL TIME ZONE
host_ip	VARCHAR2(255)
host_name	VARCHAR2(255)
host_terminal	VARCHAR2(255)
instance_number	NUMBER
object_id	NUMBER
osuser_name	VARCHAR2(4000)
parent_contextid	VARCHAR2(4000)
privileges_used	VARCHAR2(4000)
process#	NUMBER
proxy_sessionid	NUMBER
scn	NUMBER
session_actions	VARCHAR2(255)
source_eventid	VARCHAR2(255)
sql_bindFoot 1	VARCHAR2(4000)
sql_textFoot 2	VARCHAR2(4000)
statementid	NUMBER
sub_contextid	VARCHAR2(4000)
target_object	VARCHAR2(4000)
target_owner	VARCHAR2(4000)
thread#	NUMBER
tools_used	VARCHAR2(4000)
undo_sql_text	VARCHAR2(4000)
user_guid	VARCHAR2(32)
username	VARCHAR2(4000)

^Footnote 1 sql_bind variable could be truncated to 4000 characters.

^Footnote 2 sql_text variable could be truncated to 4000 characters.

B.1.2 Application Management Event Attributes

Application management event attributes are shown in Table B-2.

Table B-2 Application Management Event Attributes

Attribute Name	Attribute Type
associated_object_name	VARCHAR2(4000)
associated_object_owner	VARCHAR2(4000)
client_appinfo	VARCHAR2(4000)
client_id	VARCHAR2(4000)
comment_text	VARCHAR2(4000)
contextid	VARCHAR2(4000)
enduser	VARCHAR2(4000)
event_status	VARCHAR2(30)
event_time	TIMESTAMP WITH LOCAL TIME ZONE
host_ip	VARCHAR2(255)
host_name	VARCHAR2(255)
host_terminal	VARCHAR2(255)
instance_number	NUMBER
new_object_name	VARCHAR2(4000)
new_object_owner	VARCHAR2(4000)
object_id	NUMBER
osuser_name	VARCHAR2(4000)
parent_contextid	VARCHAR2(4000)
privileges_used	VARCHAR2(4000)
process#	NUMBER
proxy_sessionid	NUMBER
scn	NUMBER
session_actions	VARCHAR2(255)
source_eventid	VARCHAR2(255)
sql_bind Foot 1	VARCHAR2(4000)
sql_textFoot 2	VARCHAR2(4000)
statementid	NUMBER
sub_contextid	VARCHAR2(4000)
target_object	VARCHAR2(4000)
target_owner	VARCHAR2(4000)
thread#	NUMBER
tools_used	VARCHAR2(4000)
undo_sql_text	VARCHAR2(4000)
user_guid	VARCHAR2(32)
username	VARCHAR2(4000)

^Footnote 1 sql_bind variable could be truncated to 4000 characters.

^Footnote 2 sql_text variable could be truncated to 4000 characters.

B.1.3 Audit Command Event Attributes

Audit command event attributes are shown in Table B-3.

Table B-3 Audit Command Event Attributes

Attribute Name	Attribute Type
audit_option	VARCHAR2(4000)
client_appinfo	VARCHAR2(4000)
client_id	VARCHAR2(4000)
comment_text	VARCHAR2(4000)
contextid	VARCHAR2(4000)
enduser	VARCHAR2(4000)
event_status	VARCHAR2(30)
event_time	TIMESTAMP WITH LOCAL TIME ZONE
host_ip	VARCHAR2(255)
host_name	VARCHAR2(255)
host_terminal	VARCHAR2(255)
instance_number	NUMBER
object_id	NUMBER
osuser_name	VARCHAR2(4000)
parent_contextid	VARCHAR2(4000)
privileges_used	VARCHAR2(4000)
process#	NUMBER
proxy_sessionid	NUMBER
scn	NUMBER
session_actions	VARCHAR2(255)
source_eventid	VARCHAR2(255)
sql_bindFoot 1	VARCHAR2(4000)
sql_text Foot 2	VARCHAR2(4000)
statementid	NUMBER
sub_contextid	VARCHAR2(4000)
target_object	VARCHAR2(4000)
target_owner	VARCHAR2(4000)
thread#	NUMBER
tools_used	VARCHAR2(4000)
undo_sql_text	VARCHAR2(4000)
user_guid	VARCHAR2(32)
username	VARCHAR2(4000)

^Footnote 1 sql_bind variable could be truncated to 4000 characters.

^Footnote 2 sql_text variable could be truncated to 4000 characters.

B.1.4 Data Access Event Attributes

Data access event attributes are shown in Table B-4.

Table B-4 Data Access Event Attributes

Attribute Name	Attribute Type
client_appinfo	VARCHAR2(4000)
client_id	VARCHAR2(4000)
col_namelist	VARCHAR2(4000)
col_newval1	VARCHAR2(4000)
col_newval10	VARCHAR2(4000)
col_newval11	VARCHAR2(4000)
col_newval2	VARCHAR2(4000)
col_newval3	VARCHAR2(4000)
col_newval4	VARCHAR2(4000)
col_newval5	VARCHAR2(4000)
col_newval6	VARCHAR2(4000)
col_newval7	VARCHAR2(4000)
col_newval8	VARCHAR2(4000)
col_newval9	VARCHAR2(4000)
col_oldval1	VARCHAR2(4000)
col_oldval10	VARCHAR2(4000)
col_oldval11	VARCHAR2(4000)
col_oldval2	VARCHAR2(4000)
col_oldval3	VARCHAR2(4000)
col_oldval4	VARCHAR2(4000)
col_oldval5	VARCHAR2(4000)
col_oldval6	VARCHAR2(4000)
col_oldval7	VARCHAR2(4000)
col_oldval8	VARCHAR2(4000)
col_oldval9	VARCHAR2(4000)
comment_text	VARCHAR2(4000)
contextid	VARCHAR2(4000)
data_values	AV_DATAVALUES_LIST
enduser	VARCHAR2(4000)
event_status	VARCHAR2(30)
event_time	TIMESTAMP WITH LOCAL TIME ZONE
fga_policyname	VARCHAR2(30)
host_ip	VARCHAR2(255)
host_name	VARCHAR2(255)
host_terminal	VARCHAR2(255)
instance_number	NUMBER
num_inlinecol	NUMBER
object_id	NUMBER
osuser_name	VARCHAR2(4000)
parent_contextid	VARCHAR2(4000)
privileges_used	VARCHAR2(4000)
process#	NUMBER
proxy_sessionid	NUMBER
row_id	VARCHAR2(18)
scn	NUMBER
session_actions	VARCHAR2(255)
source_eventid	VARCHAR2(255)
sql_bindFoot 1	VARCHAR2(4000)
sql_textFoot 2	VARCHAR2(4000)
statementid	NUMBER
sub_contextid	VARCHAR2(4000)
target_object	VARCHAR2(4000)
target_owner	VARCHAR2(4000)
thread#	NUMBER
tools_used	VARCHAR2(4000)
transaction_name	VARCHAR2(256)
undo_sql_text	VARCHAR2(4000)
user_guid	VARCHAR2(32)
username	VARCHAR2(4000)

^Footnote 1 sql_bind variable could be truncated to 4000 characters.

^Footnote 2 sql_text variable could be truncated to 4000 characters.

B.1.5 Exceptional Event Attributes

Exceptional event attributes are shown in Table B-5.

Table B-5 Exceptional Event Attributes

Attribute Name	Attribute Type
client_appinfo	VARCHAR2(4000)
client_id	VARCHAR2(4000)
comment_text	VARCHAR2(4000)
contextid	VARCHAR2(4000)
enduser	VARCHAR2(4000)
event_status	VARCHAR2(30)
event_time	TIMESTAMP WITH LOCAL TIME ZONE
host_ip	VARCHAR2(255)
host_name	VARCHAR2(255)
host_terminal	VARCHAR2(255)
instance_number	NUMBER
object_id	NUMBER
osuser_name	VARCHAR2(4000)
parent_contextid	VARCHAR2(4000)
privileges_used	VARCHAR2(4000)
process#	NUMBER
proxy_sessionid	NUMBER
scn	NUMBER
session_actions	VARCHAR2(255)
source_eventid	VARCHAR2(255)
sql_bindFoot 1	VARCHAR2(4000)
sql_text Foot 2	VARCHAR2(4000)
statementid	NUMBER
sub_contextid	VARCHAR2(4000)
target_object	VARCHAR2(4000)
target_owner	VARCHAR2(4000)
thread#	NUMBER
tools_used	VARCHAR2(4000)
undo_sql_text	VARCHAR2(4000)
user_guid	VARCHAR2(32)
username	VARCHAR2(4000)

^Footnote 1 sql_bind variable could be truncated to 4000 characters.

^Footnote 2 sql_text variable could be truncated to 4000 characters.

B.1.6 Invalid Record Event Attributes

Invalid record event attributes are shown in Table B-6.

Table B-6 Invalid Record Event Attributes

Attribute Name	Attribute Type
client_appinfo	VARCHAR2(4000)
client_id	VARCHAR2(4000)
comment_text	VARCHAR2(4000)
contextid	VARCHAR2(4000)
enduser	VARCHAR2(4000)
enduser	NUMBER
error_message	VARCHAR2(30)
event_time	TIMESTAMP WITH LOCAL TIME ZONE
host_ip	VARCHAR2(255)
host_name	VARCHAR2(255)
host_terminal	VARCHAR2(255)
instance_number	NUMBER
module_name	VARCHAR2(100)
object_id	NUMBER
original_content1	VARCHAR2(4000)
original_content2	VARCHAR2(4000)
original_content3	VARCHAR2(4000)
osuser_name	VARCHAR2(4000)
parent_contextid	VARCHAR2(4000)
privileges_used	VARCHAR2(4000)
process#	NUMBER
proxy_sessionid	NUMBER
scn	NUMBER
session_actions	VARCHAR2(255)
severity	NUMBER
source_eventid	VARCHAR2(255)
sql_bindFoot 1	VARCHAR2(4000)
sql_textFoot 2	VARCHAR2(4000)
statementid	NUMBER
sub_contextid	VARCHAR2(4000)
target_object	VARCHAR2(4000)
target_owner	VARCHAR2(4000)
thread#	NUMBER
tools_used	VARCHAR2(4000)
undo_sql_text	VARCHAR2(4000)
user_guid	VARCHAR2(32)
username	VARCHAR2(4000)

^Footnote 1 sql_bind variable could be truncated to 4000 characters.

^Footnote 2 sql_text variable could be truncated to 4000 characters.

B.1.7 Object Management Event Attributes

Object management event attributes are shown in Table B-7.

Table B-7 Object Management Event Attributes

Attribute Name	Attribute Type
associated_object_name	VARCHAR2(4000)
associated_object_owner	VARCHAR2(4000)
client_appinfo	VARCHAR2(4000)
client_id	VARCHAR2(4000)
comment_text	VARCHAR2(4000)
contextid	VARCHAR2(4000)
enduser	VARCHAR2(4000)
event_status	VARCHAR2(30)
event_time	TIMESTAMP WITH LOCAL TIME ZONE
host_ip	VARCHAR2(255)
host_name	VARCHAR2(255)
host_terminal	VARCHAR2(255)
new_object_name	VARCHAR2(4000)
new_object_owner	VARCHAR2(4000)
object_id	NUMBER
osuser_name	VARCHAR2(4000)
parent_contextid	VARCHAR2(4000)
privileges_used	VARCHAR2(4000)
process#	NUMBER
proxy_sessionid	NUMBER
scn	NUMBER
session_actions	VARCHAR2(255)
source_eventid	VARCHAR2(255)
sql_bindFoot 1	VARCHAR2(4000)
sql_textFoot 2	VARCHAR2(4000)
statementid	NUMBER
sub_contextid	VARCHAR2(4000)
target_object	VARCHAR2(4000)
target_owner	VARCHAR2(4000)
thread#	NUMBER
tools_used	VARCHAR2(4000)
undo_sql_text	VARCHAR2(4000)
user_guid	VARCHAR2(32)
username	VARCHAR2(4000)

^Footnote 1 sql_bind variable could be truncated to 4000 characters.

^Footnote 2 sql_text variable could be truncated to 4000 characters.

B.1.8 Peer Association Event Attributes

Peer association event attributes are shown in Table B-8.

Table B-8 Peer Association Event Attributes

Attribute Name	Attribute Type
client_appinfo	VARCHAR2(4000)
client_id	VARCHAR2(4000)
comment_text	VARCHAR2(4000)
contextid	VARCHAR2(4000)
contextid	VARCHAR2(4000)
enduser	VARCHAR2(4000)
event_status	VARCHAR2(30)
event_time	TIMESTAMP WITH LOCAL TIME ZONE
host_ip	VARCHAR2(255)
host_name	VARCHAR2(255)
host_terminal	VARCHAR2(255)
instance_number	NUMBER
object_id	NUMBER
osuser_name	VARCHAR2(4000)
parent_contextid	VARCHAR2(4000)
privileges_used	VARCHAR2(4000)
process#	NUMBER
proxy_sessionid	NUMBER
scn	NUMBER
session_actions	VARCHAR2(255)
source_eventid	VARCHAR2(255)
sql_bindFoot 1	VARCHAR2(4000)
sql_textFoot 2	VARCHAR2(4000)
statementid	NUMBER
sub_contextid	VARCHAR2(4000)
target_object	VARCHAR2(4000)
target_owner	VARCHAR2(4000)
thread#	NUMBER
tools_used	VARCHAR2(4000)
undo_sql_text	VARCHAR2(4000)
user_guid	VARCHAR2(32)
username	VARCHAR2(4000)

^Footnote 1 sql_bind variable could be truncated to 4000 characters.

^Footnote 2 sql_text variable could be truncated to 4000 characters.

B.1.9 Role and Privilege Management Event Attributes

Role and privilege management event attributes are shown in Table B-9.

Table B-9 Role and Privilege Management Event Attributes

Attribute Name	Attribute Type
admin_option	NUMBER
client_appinfo	VARCHAR2(4000)
client_id	VARCHAR2(4000)
comment_text	VARCHAR2(4000)
contextid	VARCHAR2(4000)
enduser	VARCHAR2(4000)
event_status	VARCHAR2(30)
event_time	TIMESTAMP WITH LOCAL TIME
grantee	VARCHAR2(4000)
host_ip	VARCHAR2(255)
host_name	VARCHAR2(255)
host_terminal	VARCHAR2(255)
instance_number	NUMBER
object_id	NUMBER
object_privilege	VARCHAR2(255)
osuser_name	VARCHAR2(4000)
parent_contextid	VARCHAR2(4000)
privileges_used	VARCHAR2(4000)
process#	NUMBER
proxy_sessionid	NUMBER
role_name	VARCHAR2(4000)
scn	NUMBER
session_actions	VARCHAR2(255)
source_eventid	VARCHAR2(255)
sql_bindFoot 1	VARCHAR2(4000)
sql_textFoot 2	VARCHAR2(4000)
statementid	NUMBER
sub_contextid	VARCHAR2(4000)
system_privilege	VARCHAR2(4000)
target_object	VARCHAR2(4000)
target_owner	VARCHAR2(4000)
thread#	NUMBER
tools_used	VARCHAR2(4000)
undo_sql_text	VARCHAR2(4000)
user_guid	VARCHAR2(32)
username	VARCHAR2(4000)

^Footnote 1 sql_bind variable could be truncated to 4000 characters.

^Footnote 2 sql_text variable could be truncated to 4000 characters.

B.1.10 Service and Application Utilization Event Attributes

Service and application utilization event attributes are shown in Table B-10.

Table B-10 Service and Application Utilization Event Attributes

Attribute Name	Attribute Type
client_appinfo	VARCHAR2(4000)
client_id	VARCHAR2(4000)
comment_text	VARCHAR2(4000)
contextid	VARCHAR2(4000)
enduser	VARCHAR2(4000)
event_status	VARCHAR2(30)
event_time	TIMESTAMP WITH LOCAL TIME ZONE
host_ip	VARCHAR2(255)
host_name	VARCHAR2(255)
host_terminal	VARCHAR2(255)
instance_number	NUMBER
object_id	NUMBER
osuser_name	VARCHAR2(4000)
parent_contextid	VARCHAR2(4000)
privileges_used	VARCHAR2(4000)
process#	NUMBER
proxy_sessionid	NUMBER
scn	NUMBER
session_actions	VARCHAR2(255)
source_eventid	VARCHAR2(255)
sql_bindFoot 1	VARCHAR2(4000)
sql_text Foot 2	VARCHAR2(4000)
statementid	NUMBER
sub_contextid	VARCHAR2(4000)
target_object	VARCHAR2(4000)
target_owner	VARCHAR2(4000)
thread#	NUMBER
tools_used	VARCHAR2(4000)
undo_sql_text	VARCHAR2(4000)
user_guid	VARCHAR2(32)
username	VARCHAR2(4000)

^Footnote 1 sql_bind variable could be truncated to 4000 characters.

^Footnote 2 sql_text variable could be truncated to 4000 characters.

B.1.11 System Management Event Attributes

System management event attributes are shown in Table B-11.

Table B-11 System Management Event Attributes

Attribute Name	Attribute Type
client_appinfo	VARCHAR2(4000)
client_id	VARCHAR2(4000)
comment_text	VARCHAR2(4000)
contextid	VARCHAR2(4000)
enduser	VARCHAR2(4000)
event_status	VARCHAR2(30)
event_time	TIMESTAMP WITH LOCAL TIME ZONE
host_ip	VARCHAR2(255)
host_name	VARCHAR2(255)
host_terminal	VARCHAR2(255)
instance_number	NUMBER
object_id	NUMBER
osuser_name	VARCHAR2(4000)
parent_contextid	VARCHAR2(4000)
privileges_used	VARCHAR2(4000)
process#	NUMBER
proxy_sessionid	NUMBER
scn	NUMBER
session_actions	VARCHAR2(255)
source_eventid	VARCHAR2(255)
sql_bindFoot 1	VARCHAR2(4000)
sql_textFoot 2	VARCHAR2(4000)
statementid	NUMBER
sub_contextid	VARCHAR2(4000)
target_object	VARCHAR2(4000)
target_owner	VARCHAR2(4000)
thread#	NUMBER
tools_used	VARCHAR2(4000)
undo_sql_text	VARCHAR2(4000)
user_guid	VARCHAR2(32)
username	VARCHAR2(4000)

^Footnote 1 sql_bind variable could be truncated to 4000 characters.

^Footnote 2 sql_text variable could be truncated to 4000 characters.

B.1.12 Unknown or Uncategorized Event Attributes

Unknown or uncategorized event attributes are shown in Table B-12.

Table B-12 Unknown or Uncategorized Event Attributes

Attribute Name	Attribute Type
client_appinfo	VARCHAR2(4000)
client_id	VARCHAR2(4000)
comment_text	VARCHAR2(4000)
contextid	VARCHAR2(4000)
enduser	VARCHAR2(4000)
event_status	VARCHAR2(30)
event_time	TIMESTAMP WITH LOCAL TIME ZONE
host_ip	VARCHAR2(255)
host_name	VARCHAR2(255)
host_terminal	VARCHAR2(255)
instance_number	NUMBER
object_id	NUMBER
osuser_name	VARCHAR2(4000)
parent_contextid	VARCHAR2(4000)
privileges_used	VARCHAR2(4000)
process#	NUMBER
proxy_sessionid	NUMBER
scn	NUMBER
session_actions	VARCHAR2(255)
source_eventid	VARCHAR2(255)
sql_bind Foot 1	VARCHAR2(4000)
sql_text Foot 2	VARCHAR2(4000)
statementid	NUMBER
sub_contextid	VARCHAR2(4000)
target_object	VARCHAR2(4000)
target_owner	VARCHAR2(4000)
thread#	NUMBER
tools_used	VARCHAR2(4000)
undo_sql_text	VARCHAR2(4000)
user_guid	VARCHAR2(32)
username	VARCHAR2(4000)

^Footnote 1 sql_bind variable could be truncated to 4000 characters.

^Footnote 2 sql_text variable could be truncated to 4000 characters.

B.1.13 User Session Event Attributes

User session event attributes are shown in Table B-13.

Table B-13 User Session Event Attributes

Attribute Name	Attribute Type
authentication_method	VARCHAR2(255)
client_appinfo	VARCHAR2(4000)
client_id	VARCHAR2(4000)
comment_text	VARCHAR2(4000)
contextid	VARCHAR2(4000)
enduser	VARCHAR2(4000)
event_status	VARCHAR2(30)
event_time	TIMESTAMP WITH LOCAL TIME ZONE
host_ip	VARCHAR2(255)
host_name	VARCHAR2(255)
host_terminal	VARCHAR2(255)
instance_number	NUMBER
logoff_dlock	NUMBER
logoff_lread	NUMBER
logoff_lwrite	NUMBER
logoff_pread	NUMBER
object_id	NUMBER
osuser_name	VARCHAR2(4000)
parent_contextid	VARCHAR2(4000)
privileges_used	VARCHAR2(4000)
process#	NUMBER
proxy_sessionid	NUMBER
scn	NUMBER
session_actions	VARCHAR2(255)
source_eventid	VARCHAR2(255)
sql_bindFoot 1	VARCHAR2(4000)
sql_textFoot 2	VARCHAR2(4000)
statementid	NUMBER
sub_contextid	VARCHAR2(4000)
target_object	VARCHAR2(4000)
target_owner	VARCHAR2(4000)
thread#	NUMBER
tools_used	VARCHAR2(4000)
undo_sql_text	VARCHAR2(4000)
user_guid	VARCHAR2(32)
username	VARCHAR2(4000)

^Footnote 1 sql_bind variable could be truncated to 4000 characters.

^Footnote 2 sql_text variable could be truncated to 4000 characters.

B.2 Source Event IDs

Source event IDs are numbers that represent the events in each category. A logon event, for example, is specified as:

SOURCE_EVENTID = '100'

This section lists events, by category, and their corresponding Oracle Database (ORCLDB) events. The event categories are:

• Account Management Events

• Application Management Events

• Audit Events

• Data Access Events

• Exceptional Events

• Invalid Record Events

• Object Management Events

• Peer Association Events

• Role and Privilege Management Events

• Service and Application Utilization Events

• System Management Events

• Unknown or Uncategorized Events

• User Session Events

B.2.1 Account Management Events

Account management events and event IDs are shown in Table B-1.

Table B-14 Account Management Events and Event IDs

Event	ORCLDB Event ID
ALTER PROFILE	67
ALTER USER	43
CREATE PROFILE	65
CREATE USER	51
DROP PROFILE	66
DROP USER	53

B.2.2 Application Management Events

Application management events and event IDs are shown in Table B-15.

Table B-15 Application Management Events and Event IDs

Event	ORCLDB Event ID
ALTER FUNCTION	92
ALTER JAVA	161
ALTER PACKAGE	95
ALTER PACKAGE BODY	98
ALTER PROCEDURE	25
ALTER RESOURCE COST	70
ALTER REWRITE EQUIVALENCE	210
ALTER TRIGGER	60
ALTER TYPE	80
ALTER TYPE BODY	82
ANALYZE INDEX	63
ANALYZE TABLE	62
ASSOCIATE STATISTICS	168
CREATE CONTEXT	177
CREATE FUNCTION	91
CREATE INDEXTYPE	164
CREATE JAVA	160
CREATE LIBRARY	159
CREATE OPERATOR	163
CREATE PACKAGE	94
CREATE PACKAGE BODY	97
CREATE PROCEDURE	24
CREATE TRIGGER	59
CREATE TYPE	77
CREATE TYPE BODY	81
DECLARE REWRITE EQUIVALENCE	209
DISABLE TRIGGER	119
DISASSOCIATE STATISTICS	169
DROP CONTEXT	178
DROP FUNCTION	93
DROP INDEXTYPE	165
DROP JAVA	162
DROP LIBRARY	84
DROP OPERATOR	167
DROP PACKAGE	96
DROP PACKAGE BODY	99
DROP PROCEDURE	68
DROP REWRITE EQUIVALENCE	211
DROP TRIGGER	61
DROP TYPE	78
DROP TYPE BODY	83
ENABLE TRIGGER	118
EXECUTE TYPE	123
EXPLAIN	50

B.2.3 Audit Events

Audit events and event IDs are shown in Table B-16.

Table B-16 Audit Events and Event IDs

Event	ORCLDB Event ID
AUDIT DEFAULT	106
AUDIT OBJECT	30
NOAUDIT DEFAULT	107
NOAUDIT OBJECT	31
SYSTEM AUDIT	104
SYSTEM NOAUDIT	105

B.2.4 Data Access Events

Data access events and event IDs are shown in Table B-17.

Table B-17 Data Access Events and Event IDs

Event	ORCLDB Event ID
DELETE	7
INSERT	2
SELECT	3
TRUNCATE TABLE	85
UPDATE	6

B.2.5 Exceptional Events

Exceptional events and event IDs are shown in Table B-18.

Table B-18 Exceptional Events and Event IDs

Event	ORCLDB Event ID
NETWORK ERROR	122

B.2.6 Invalid Record Events

Invalid record events and event IDs are shown in Table B-19.

Table B-19 Invalid Record Events and Event IDs

Event	ORCLDB Event ID
INVALID RECORD	30000

B.2.7 Object Management Events

Object management events and event IDs are shown in Table B-20.

Table B-20 Object Management Events and Event IDs

Event	ORCLDB Event ID
ALTER DIMENSION	175
ALTER INDEX	11
ALTER MATERIALIZED VIEW	75
ALTER MATERIALIZED VIEW LOG	72
ALTER OPERATOR	183
ALTER OUTLINE	179
ALTER SEQUENCE	14
ALTER TABLE	15
CREATE DIMENSION	174
CREATE DIRECTORY	157
CREATE INDEX	9
CREATE MATERIALIZED VIEW	74
CREATE MATERIALIZED VIEW LOG	71
CREATE OUTLINE	180
CREATE PUBLIC DATABASE LINK	112
CREATE PUBLIC SYNONYM	110
CREATE SCHEMA	56
CREATE SEQUENCE	13
CREATE SYNONYM	19
CREATE TABLE	1
CREATE VIEW	21
DROP DIMENSION	176
DROP DIRECTORY	158
DROP INDEX	10
DROP MATERIALIZED VIEW	76
DROP MATERIALIZED VIEW LOG	73
DROP OUTLINE	181
DROP PUBLIC DATABASE LINK	113
DROP PUBLIC SYNONYM	111
DROP SEQUENCE	16
DROP SYNONYM	20
DROP TABLE	12
DROP VIEW	22
FLASHBACK TABLE	205
LOCK	26
PURGE INDEX	201
PURGE TABLE	200
RENAME	28
UNDROP OBJECT	202
UPDATE INDEXES	182
VALIDATE INDEX	23

B.2.8 Peer Association Events

Peer association events and event IDs are shown in Table B-21.

Table B-21 Peer Association Events and Event IDs

Event	ORCLDB Event ID
CREATE DATABASE LINK	32
DROP DATABASE LINK	33

B.2.9 Role and Privilege Management Events

Role and privilege management events and event IDs are shown in Table B-22.

Table B-22 Role and Privilege Management Events and Event IDs

Event	ORCLDB Event ID
ALTER ROLE	79
CREATE ROLE	52
DROP ROLE	54
GRANT OBJECT	17
GRANT ROLE	114
REVOKE OBJECT	18
REVOKE ROLE	115

B.2.10 Service and Application Utilization Events

Service and application utilization events and event IDs are shown in Table B-23.

Table B-23 Service and Application Utilization Events and Event IDs

Event	ORCLDB Event ID
CALL METHOD	170
EXECUTE PROCEDURE	116
PL/SQL EXECUTE	47

B.2.11 System Management Events

System management events and event IDs are shown in Table B-24.

Table B-24 System Management Events and Event IDs

Event	ORCLDB Event ID
ALTER CLUSTER	5
ALTER DATABASE	35
ALTER ROLLBACK SEG	37
ALTER SYSTEM	49
ALTER TABLESPACE	40
ANALYZE CLUSTER	64
CREATE CLUSTER	4
CREATE CONTROL FILE	57
CREATE DATABASE	34
CREATE ROLLBACK SEG	36
CREATE TABLESPACE	39
DISABLE ALL TRIGGERS	121
DROP CLUSTER	8
DROP ROLLBACK SEG	38
DROP TABLESPACE	41
ENABLE ALL TRIGGERS	120
FLASHBACK	128
FLASHBACK DATABASE	204
PURGE DBA_RECYCLEBIN	198
PURGE TABLESPACE	199
SHUTDOWN	216
STARTUP	215
SUPER USER DDL	213
SUPER USER DML	214
SYSTEM GRANT	108
SYSTEM REVOKE	109
TRUNCATE CLUSTER	86

B.2.12 Unknown or Uncategorized Events

Unknown or uncategorized events and event IDs are shown in Table B-25.

Table B-25 Unknown or Uncategorized Events and Event IDs

Event	ORCLDB Event ID
ALTER SUMMARY	172
COMMENT	29
CREATE SUMMARY	171
DROP SUMMARY	173
NO-OP	27
SUPER USER UNKNOWN	217
UNKNOWN	0
USER COMMENT	117

B.2.13 User Session Events

User session events and event IDs are shown in Table B-26.

Table B-26 User Session Events and Event IDs

Event	ORCLDB Event ID
ALTER SESSION	42
COMMIT	44
CREATE RESTORE POINT	206
CREATE SESSION	129
DROP RESTORE POINT	207
LOGOFF	101
LOGOFF BY CLEANUP	102
LOGON	100
PROXY AUTHENTICATION ONLY	208
PURGE USER_RECYCLEBIN	197
ROLLBACK	45
SAVEPOINT	46
SESSION REC	103
SET ROLE	55
SET TRANSACTION	48
SUPER USER LOGON	212