A Oracle Database Audit Events

This appendix contains:

About the Oracle Database Audit Events
Account Management Events
Application Management Events
Audit Command Events
Data Access Events
Oracle Database Vault Events
Exception Events
Invalid Record Events
Object Management Events
Peer Association Events
Role and Privilege Management Events
Service and Application Utilization Events
System Management Events
Unknown or Uncategorized Events
User Session Events

A.1 About the Oracle Database Audit Events

This appendix lists the audit event names and IDs, and the attribute names and data types for Oracle Database. The audit events are organized by their respective categories; for example, Account Management. You can use these audit events as follows:

For alerts. When you create an alert, you can specify an audit event, based on its category, that can trigger the alert. See Section 2.12.4 for more information.
For custom reports using third-party tools. If you want to create custom reports using other Oracle Database reporting products or third-party tools, then refer to the tables in this appendix when you design the reports. See Chapter 4, "Oracle Audit Vault Data Warehouse Schema" for more information about custom reports created with third-party tools.

A.2 Account Management Events

Account management events track SQL statements that affect user accounts, such as creating users or altering their profiles. The Account Management Report, described in Section 3.3.3.2, uses these events.

Table A-1 lists the Oracle Database account management source database events and the equivalent Oracle Audit Vault events.

Table A-1 Oracle Database Account Management Audit Events

Event Name Description	Source Event	Audit Vault Event
`ALTER PROFILE`	`67`	`ALTER PROFILE`
`ALTER USER`	`43`	`ALTER USER`
`CREATE PROFILE`	`65`	`CREATE PROFILE`
`CREATE USER`	`51`	`CREATE USER`
`DROP PROFILE`	`66`	`DROP PROFILE`
`DROP USER`	`53`	`DROP USER`

Table A-2 lists the Oracle Database account management event attributes.

Table A-2 Oracle Database Account Management Event Attributes

Attribute Name	Data Type
`CLIENT_APPINFO`	`VARCHAR2(4000)`
`CLIENT_ID`	`VARCHAR2(4000)`
`COMMENT_TEXT`	`VARCHAR2(4000)`
`CONTEXTID`	`VARCHAR2(4000)`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`INSTANCE_NUMBER`	`NUMBER`
`OBJECT_ID`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`PROXY_SESSIONID`	`NUMBER`
`SCN`	`NUMBER`
`SESSION_ACTIONS`	`VARCHAR2(255)`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SQL_BIND`^Foot 1	`VARCHAR2(4000)`
`SQL_TEXT`^Foot 2	`VARCHAR2(4000)`
`STATEMENTID`	`NUMBER`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`UNDO_SQL_TEXT`	`VARCHAR2(4000)`
`USER_GUID`	`VARCHAR2(32)`
`USERNAME`	`VARCHAR2(4000)`

^Footnote 1SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2SQL_TEXT variable could be truncated to 4000 characters.

A.3 Application Management Events

Application management events track actions that were performed on the underlying PL/SQL procedures or functions of system services and applications, such as ALTER FUNCTION statements. The Procedure Management Report, described in Section 3.3.3.5, uses these events.

Table A-3 lists the Oracle Database application management source database events and the equivalent Oracle Audit Vault events.

Table A-3 Oracle Database Application Management Audit Events

Event Name Description	Source Event	Audit Vault Event
`ALTER ASSEMBLY` (Release 11.2)	`217`	`ALTER ASSEMBLY`
`ALTER FUNCTION`	`92`	`ALTER FUNCTION`
`ALTER JAVA`	`161`	`ALTER JAVA`
`ALTER PACKAGE`	`95`	`ALTER PACKAGE`
`ALTER PACKAGE BODY`	`98`	`ALTER PACKAGE BODY`
`ALTER PROCEDURE`	`25`	`ALTER PROCEDURE`
`ALTER RESOURCE COST`	`70`	`ALTER RESOURCE COST`
`ALTER REWRITE EQUIVALENCE`	`210`	`ALTER REWRITE EQUIVALENCE`
`ALTER TRIGGER`	`60`	`ALTER TRIGGER`
`ALTER TYPE`	`80`	`ALTER TYPE`
`ALTER TYPE BODY`	`82`	`ALTER TYPE BODY`
`ANALYZE INDEX`	`63`	`ANALYZE INDEX`
`ANALYZE TABLE`	`62`	`ANALYZE TABLE`
`ASSOCIATE STATISTICS`	`168`	`ASSOCIATE STATISTICS`
`CREATE ASSEMBLY` (Release 11.2)	`216`	`CREATE ASSEMBLY`
`CREATE CONTEXT`	`177`	`CREATE CONTEXT`
`CREATE FUNCTION`	`91`	`CREATE FUNCTION`
`CREATE INDEXTYPE`	`164`	`CREATE INDEXTYPE`
`CREATE JAVA`	`160`	`CREATE JAVA`
`CREATE LIBRARY`	`159`	`CREATE LIBRARY`
`CREATE OPERATOR`	`163`	`CREATE OPERATOR`
`CREATE PACKAGE`	`94`	`CREATE PACKAGE`
`CREATE PACKAGE BODY`	`97`	`CREATE PACKAGE BODY`
`CREATE PROCEDURE`	`24`	`CREATE PROCEDURE`
`CREATE TRIGGER`	`59`	`CREATE TRIGGER`
`CREATE TYPE`	`77`	`CREATE TYPE`
`CREATE TYPE BODY`	`81`	`CREATE TYPE BODY`
`DECLARE REWRITE EQUIVALENCE`	`209`	`DECLARE REWRITE EQUIVALENCE`
`DISABLE TRIGGER`	`119`	`DISABLE TRIGGER`
`DISASSOCIATE STATISTICS`	`169`	`DISASSOCIATE STATISTICS`
`DROP ASSEMBLY` (Release 11.2)	`215`	`DROP ASSEMBLY`
`DROP CONTEXT`	`178`	`DROP CONTEXT`
`DROP FUNCTION`	`93`	`DROP FUNCTION`
`DROP INDEXTYPE`	`165`	`DROP INDEXTYPE`
`DROP JAVA`	`162`	`DROP JAVA`
`DROP LIBRARY`	`84`	`DROP LIBRARY`
`DROP OPERATOR`	`167`	`DROP OPERATOR`
`DROP PACKAGE`	`96`	`DROP PACKAGE`
`DROP PACKAGE BODY`	`99`	`DROP PACKAGE BODY`
`DROP PROCEDURE`	`68`	`DROP PROCEDURE`
`DROP REWRITE EQUIVALENCE`	`211`	`DROP REWRITE EQUIVALENCE`
`DROP TRIGGER`	`61`	`DROP TRIGGER`
`DROP TYPE`	`78`	`DROP TYPE`
`DROP TYPE BODY`	`83`	`DROP TYPE BODY`
`ENABLE TRIGGER`	`118`	`ENABLE TRIGGER`
`EXECUTE TYPE`	`123`	`EXECUTE TYPE`
`EXPLAIN`	`50`	`EXPLAIN`

Table A-4 lists the Oracle Database application management event attributes.

Table A-4 Oracle Database Application Management Event Attributes

Attribute Name	Data Type
`ASSOCIATED_OBJECT_NAME`	`VARCHAR2(4000)`
`ASSOCIATED_OBJECT_OWNER`	`VARCHAR2(4000)`
`CLIENT_APPINFO`	`VARCHAR2(4000)`
`CLIENT_ID`	`VARCHAR2(4000)`
`COMMENT_TEXT`	`VARCHAR2(4000)`
`CONTEXTID`	`VARCHAR2(4000)`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`INSTANCE_NUMBER`	`NUMBER`
`NEW_OBJECT_NAME`	`VARCHAR2(4000)`
`NEW_OBJECT_OWNER`	`VARCHAR2(4000)`
`OBJECT_ID`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`PROXY_SESSIONID`	`NUMBER`
`SCN`	`NUMBER`
`SESSION_ACTIONS`	`VARCHAR2(255)`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SQL_BIND`^Foot 1	`VARCHAR2(4000)`
`SQL_TEXT`^Foot 2	`VARCHAR2(4000)`
`STATEMENTID`	`NUMBER`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`UNDO_SQL_TEXT`	`VARCHAR2(4000)`
`USER_GUID`	`VARCHAR2(32)`
`USERNAME`	`VARCHAR2(4000)`

^Footnote 1SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2SQL_TEXT variable could be truncated to 4000 characters.

A.4 Audit Command Events

Audit command events track the use of AUDIT SQL statements on other SQL statements and on database objects. The Audit Command Report, described in Section 3.3.3.3, uses these events.

Table A-5 lists the Oracle Database audit command source database events and the equivalent Oracle Audit Vault events.

Table A-5 Oracle Database Audit Command Audit Events

Event Name Description	Source Event	Audit Vault Event
`AUDIT DEFAULT`	`106`	`AUDIT DEFAULT`
`AUDIT OBJECT`	`30`	`AUDIT OBJECT`
`NOAUDIT DEFAULT`	`107`	`NOAUDIT DEFAULT`
`NOAUDIT OBJECT`	`31`	`NOAUDIT OBJECT`
`SYSTEM AUDIT`	`104`	`SYSTEM AUDIT`
`SYSTEM NOAUDIT`	`105`	`SYSTEM NOAUDIT`

Table A-6 lists the Oracle Database audit command event attributes.

Table A-6 Oracle Database Audit Command Event Attributes

Attribute Name	Data Type
`AUDIT_OPTION`	`VARCHAR2(4000)`
`CLIENT_APPINFO`	`VARCHAR2(4000)`
`CLIENT_ID`	`VARCHAR2(4000)`
`COMMENT_TEXT`	`VARCHAR2(4000)`
`CONTEXTID`	`VARCHAR2(4000)`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`INSTANCE_NUMBER`	`NUMBER`
`OBJECT_ID`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`PROXY_SESSIONID`	`NUMBER`
`SCN`	`NUMBER`
`SESSION_ACTIONS`	`VARCHAR2(255)`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SQL_BIND`^Foot 1	`VARCHAR2(4000)`
`SQL_TEXT`^Foot 2	`VARCHAR2(4000)`
`STATEMENTID`	`NUMBER`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`UNDO_SQL_TEXT`	`VARCHAR2(4000)`
`USER_GUID`	`VARCHAR2(32)`
`USERNAME`	`VARCHAR2(4000)`

^Footnote 1SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2SQL_TEXT variable could be truncated to 4000 characters.

A.5 Data Access Events

Data access events track audited data manipulation language (DML) activities, for example, all SELECT, INSERT, UPDATE, or DROP SQL statements. The Data Access Report, described in Section 3.3.2.3, uses these events.

Table A-7 lists the Oracle Database data access source database events and the equivalent Oracle Audit Vault events.

Table A-7 Oracle Database Data Access Audit Events

Event Name Description	Source Event	Audit Vault Event
`DELETE`	`7`	`DELETE`
`INSERT`	`2`	`INSERT`
`SELECT`	`3`	`SELECT`
`SELECT MINING MODEL` (Release 11.2)	`131`	`SELECT MINING MODEL`
`TRUNCATE TABLE`	`85`	`TRUNCATE TABLE`
`UPDATE`	`6`	`UPDATE`

Table A-8 lists the Oracle Database data access event attributes.

Table A-8 Oracle Database Data Access Event Attributes

Attribute Name	Data Type
`CLIENT_APPINFO`	`VARCHAR2(4000)`
`CLIENT_ID`	`VARCHAR2(4000)`
`COL_NAMELIST`	`VARCHAR2(4000)`
`COL_NEWVAL1`	`VARCHAR2(4000)`
`COL_NEWVAL2`	`VARCHAR2(4000)`
`COL_NEWVAL3`	`VARCHAR2(4000)`
`COL_NEWVAL4`	`VARCHAR2(4000)`
`COL_NEWVAL5`	`VARCHAR2(4000)`
`COL_NEWVAL6`	`VARCHAR2(4000)`
`COL_NEWVAL7`	`VARCHAR2(4000)`
`COL_NEWVAL8`	`VARCHAR2(4000)`
`COL_NEWVAL9`	`VARCHAR2(4000)`
`COL_NEWVAL10`	`VARCHAR2(4000)`
`COL_NEWVAL11`	`VARCHAR2(4000)`
`COL_OLDVAL1`	`VARCHAR2(4000)`
`COL_OLDVAL2`	`VARCHAR2(4000)`
`COL_OLDVAL3`	`VARCHAR2(4000)`
`COL_OLDVAL4`	`VARCHAR2(4000)`
`COL_OLDVAL5`	`VARCHAR2(4000)`
`COL_OLDVAL6`	`VARCHAR2(4000)`
`COL_OLDVAL7`	`VARCHAR2(4000)`
`COL_OLDVAL8`	`VARCHAR2(4000)`
`COL_OLDVAL9`	`VARCHAR2(4000)`
`COL_OLDVAL10`	`VARCHAR2(4000)`
`COL_OLDVAL11`	`VARCHAR2(4000)`
`COMMENT_TEXT`	`VARCHAR2(4000)`
`CONTEXTID`	`VARCHAR2(4000)`
`DATA_VALUES`	`AV_DATAVALUES_LIST`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`FGA_POLICYNAME`	`VARCHAR2(30)`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`INSTANCE_NUMBER`	`NUMBER`
`NUM_INLINECOL`	`NUMBER`
`OBJECT_ID`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`PROXY_SESSIONID`	`NUMBER`
`ROW_ID`	`VARCHAR2(18)`
`SCN`	`NUMBER`
`SESSION_ACTIONS`	`VARCHAR2(255)`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SQL_BIND`^Foot 1	`VARCHAR2(4000)`
`SQL_TEXT`^Foot 2	`VARCHAR2(4000)`
`STATEMENTID`	`NUMBER`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`TRANSACTION_NAME`	`VARCHAR2(256)`
`UNDO_SQL_TEXT`	`VARCHAR2(4000)`
`USER_GUID`	`VARCHAR2(32)`
`USERNAME`	`VARCHAR2(4000)`

^Footnote 1SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2SQL_TEXT variable could be truncated to 4000 characters.

A.6 Oracle Database Vault Events

Oracle Database Vault events track audited Oracle Database Vault activity. The Oracle Database Vault Report, described in Section 3.3.2.4, uses these events.

Table A-9 lists the Oracle Database Vault source database events and the equivalent Oracle Audit Vault events.

Table A-9 Oracle Database Vault Audit Events

Event Name Description	Source Event	Audit Vault Event
`ACCESS CTRL COMMAND AUTH`	`1008`	`ACCESS CTRL COMMAND AUTH`
`ACCESS CTRL SESSION INIT`	`1009`	`ACCESS CTRL SESSION INIT`
`COMMAND AUTHORIZATION`	`1005`	`COMMAND AUTHORIZATION`
`FACTOR ASSIGNMENT`	`1001`	`FACTOR ASSIGNMENT`
`FACTOR EVALUATION`	`1000`	`FACTOR EVALUATION`
`FACTOR EXPRESSION`	`1002`	`FACTOR EXPRESSION`
`LBL SEC ATTEMPT TO UPGRADE`	`1010`	`LBL SEC ATTEMPT TO UPGRADE`
`LBL SEC SESSION INIT`	`1007`	`LBL SEC SESSION INIT`
`REALM AUTHORIZATION`	`1004`	`REALM AUTHORIZATION`
`REALM VIOLATION`	`1003`	`REALM VIOLATION`
`SECURE ROLE`	`1006`	`SECURE ROLE`

Table A-10 lists the Oracle Database Vault event attributes.

Table A-10 Oracle Database Vault Event Attributes

Attribute Name	Data Type
`ACTION_COMMAND`	`VARCHAR2(4000)`
`ACTION_NAME`	`VARCHAR2(128)`
`ACTION_OBJECT_ID`	`NUMBER`
`ACTION_OBJECT_NAME`	`VARCHAR2(128)`
`AUDIT_OPTION`	`VARCHAR2(4000)`
`CREATE_DATE`	`TIMESTAMP WITH LOCAL TIME ZONE`
`CREATED_BY`	`VARCHAR2(30)`
`FACTOR_CONTEXT`	`VARCHAR2(4000)`
`RULE_ID`	`NUMBER`
`RULE_NAME`	`VARCHAR2(90)`
`RULE_SET_ID`	`NUMBER`
`RULE_SET_NAME`	`VARCHAR2(90)`
`UPDATE_DATE`	`TIMESTAMP WITH LOCAL TIME ZONE`
`UPDATED_BY`	`VARCHAR2(30)`

A.7 Exception Events

Exception events track audited error and exception activity, such as network errors. The Exception Activity Report, described in Section 3.3.4.2, uses these events.

Table A-11 lists the Oracle Database exception source database events and the equivalent Oracle Audit Vault events.

Table A-11 Oracle Database Exception Audit Events

Event Name Description	Source Event	Audit Vault Event
`NETWORK ERROR`	`122`	`NETWORK ERROR`

Table A-12 lists the Oracle Database exception event attributes.

Table A-12 Oracle Database Exception Event Attributes

Attribute Name	Data Type
`CLIENT_APPINFO`	`VARCHAR2(4000)`
`CLIENT_ID`	`VARCHAR2(4000)`
`COMMENT_TEXT`	`VARCHAR2(4000)`
`CONTEXTID`	`VARCHAR2(4000)`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`INSTANCE_NUMBER`	`NUMBER`
`OBJECT_ID`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`PROXY_SESSIONID`	`NUMBER`
`SCN`	`NUMBER`
`SESSION_ACTIONS`	`VARCHAR2(255)`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SQL_BIND`^Foot 1	`VARCHAR2(4000)`
`SQL_TEXT`^Foot 2	`VARCHAR2(4000)`
`STATEMENTID`	`NUMBER`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`UNDO_SQL_TEXT`	`VARCHAR2(4000)`
`USER_GUID`	`VARCHAR2(32)`
`USERNAME`	`VARCHAR2(4000)`

^Footnote 1SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2SQL_TEXT variable could be truncated to 4000 characters.

A.8 Invalid Record Events

Invalid record events track audited activity that Oracle Audit Vault cannot recognize, possibly due to a corrupted audit record. The Invalid Audit Record Report, described in Section 3.3.4.3, uses these events.

Table A-13 lists the Oracle Database invalid record source database events and the equivalent Oracle Audit Vault events.

Table A-13 Oracle Database Invalid Record Audit Events

Event Name Description	Source Event	Audit Vault Event
`INVALID RECORD`	`30000`	`INVALID RECORD`

Table A-14 lists the Oracle Database invalid record event attributes.

Table A-14 Oracle Database Invalid Record Event Attributes

Attribute Name	Data Type
`CLIENT_APPINFO`	`VARCHAR2(4000)`
`CLIENT_ID`	`VARCHAR2(4000)`
`COMMENT_TEXT`	`VARCHAR2(4000)`
`CONTEXTID`	`VARCHAR2(4000)`
`ENDUSER`	`VARCHAR2(4000)`
`ENDUSER`	`NUMBER`
`ERROR_MESSAGE`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`INSTANCE_NUMBER`	`NUMBER`
`MODULE_NAME`	`VARCHAR2(100)`
`OBJECT_ID`	`NUMBER`
`ORIGINAL_CONTENT1`	`VARCHAR2(4000)`
`ORIGINAL_CONTENT2`	`VARCHAR2(4000)`
`ORIGINAL_CONTENT3`	`VARCHAR2(4000)`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`PROXY_SESSIONID`	`NUMBER`
`SCN`	`NUMBER`
`SESSION_ACTIONS`	`VARCHAR2(255)`
`SEVERITY`	`NUMBER`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SQL_BIND`^Foot 1	`VARCHAR2(4000)`
`SQL_TEXT`^Foot 2	`VARCHAR2(4000)`
`STATEMENTID`	`NUMBER`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`UNDO_SQL_TEXT`	`VARCHAR2(4000)`
`USER_GUID`	`VARCHAR2(32)`
`USERNAME`	`VARCHAR2(4000)`

^Footnote 1SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2SQL_TEXT variable could be truncated to 4000 characters.

A.9 Object Management Events

Object management events track audited actions performed on database objects, such as CREATE TABLE statements. The Object Management Report, described in Section 3.3.3.4, uses these events.

Table A-15 lists the Oracle Database object management source database events and the equivalent Oracle Audit Vault events.

Table A-15 Oracle Database Object Management Audit Events

Event Name Description	Source Event	Audit Vault Event
`ALTER DIMENSION`	`175`	`ALTER DIMENSION`
`ALTER EDITION` (Release 11.2)	213	`ALTER EDITION`
`ALTER INDEX`	`11`	`ALTER INDEX`
`ALTER MATERIALIZED VIEW`	`75`	`ALTER MATERIALIZED VIEW`
`ALTER MATERIALIZED VIEW LOG`	`72`	`ALTER MATERIALIZED VIEW LOG`
`ALTER MINING MODEL` (Release 11.2)	`130`	`ALTER MINING MODEL`
`ALTER OPERATOR`	`183`	`ALTER OPERATOR`
`ALTER OUTLINE`	`179`	`ALTER OUTLINE`
`ALTER PUBLIC SYNONYM` (Release 11.2)	`134`	`ALTER PUBLIC SYNONYM`
`ALTER SEQUENCE`	`14`	`ALTER SEQUENCE`
`ALTER SYNONYM` (Release 11.2)	`192`	`ALTER SYNONYM`
`ALTER TABLE`	`15`	`ALTER TABLE`
`APPLY TABLE OR SCHEMA POLICY`^Foot 1	`500`	APPLY TABLE OR SCHEMA POLICY
`CREATE MINING MODEL` (Release 11.2)	`133`	`CREATE MINING MODEL`
`CREATE DIMENSION`	`174`	`CREATE DIMENSION`
`CREATE DIRECTORY`	`157`	`CREATE DIRECTORY`
`CREATE EDITION` (Release 11.2	`212`	`CREATE EDITION`
`CREATE INDEX`	`9`	`CREATE INDEX`
`CREATE MATERIALIZED VIEW`	`74`	`CREATE MATERIALIZED VIEW`
`CREATE MATERIALIZED VIEW LOG`	`71`	`CREATE MATERIALIZED VIEW LOG`
`CREATE OUTLINE`	`180`	`CREATE OUTLINE`
`CREATE PUBLIC DATABASE LINK`	`112`	`CREATE PUBLIC DATABASE LINK`
`CREATE PUBLIC SYNONYM`	`110`	`CREATE PUBLIC SYNONYM`
`CREATE SCHEMA`	`56`	`CREATE SCHEMA`
`CREATE SEQUENCE`	`13`	`CREATE SEQUENCE`
`CREATE SYNONYM`	`19`	`CREATE SYNONYM`
`CREATE TABLE`	`1`	`CREATE TABLE`
`CREATE VIEW`	`21`	`CREATE VIEW`
`DROP DIMENSION`	`176`	`DROP DIMENSION`
`DROP DIRECTORY`	`158`	`DROP DIRECTORY`
`DROP EDITION` (Release 11.2)	`214`	`DROP EDITION`
`DROP INDEX`	`10`	`DROP INDEX`
`DROP MATERIALIZED VIEW`	`76`	`DROP MATERIALIZED VIEW`
`DROP MATERIALIZED VIEW LOG`	`73`	`DROP MATERIALIZED VIEW LOG`
`DROP OUTLINE`	`181`	`DROP OUTLINE`
`DROP PUBLIC DATABASE LINK`	`113`	`DROP PUBLIC DATABASE LINK`
`DROP PUBLIC SYNONYM`	`111`	`DROP PUBLIC SYNONYM`
`DROP SEQUENCE`	`16`	`DROP SEQUENCE`
`DROP SYNONYM`	`20`	`DROP SYNONYM`
`DROP TABLE`	`12`	`DROP TABLE`
`DROP VIEW`	`22`	`DROP VIEW`
`FLASHBACK TABLE`	`205`	`FLASHBACK TABLE`
`LOCK`	`26`	`LOCK`
`PURGE INDEX`	`201`	`PURGE INDEX`
`PURGE TABLE`	`200`	`PURGE TABLE`
`REMOVE TABLE OR SCHEMA POLICY`^Foot 2	`501`	`REMOVE TABLE OR SCHEMA POLICY`
`RENAME`	`28`	`RENAME`
`UNDROP OBJECT`	`202`	`UNDROP OBJECT`
`UPDATE INDEXES`	`182`	`UPDATE INDEXES`
`VALIDATE INDEX`	`23`	`VALIDATE INDEX`

^Footnote 1APPLY TABLE OR SCHEMA POLICY is an Oracle Label Security audit event.

^Footnote 2REMOVE TABLE OR SCHEMA POLICY is an Oracle Label Security audit event.

Table A-16 lists the Oracle Database object management event attributes.

Table A-16 Oracle Database Object Management Event Attributes

Attribute Name	Data Type
`ASSOCIATED_OBJECT_NAME`	`VARCHAR2(4000)`
`ASSOCIATED_OBJECT_OWNER`	`VARCHAR2(4000)`
`CLIENT_APPINFO`	`VARCHAR2(4000)`
`CLIENT_ID`	`VARCHAR2(4000)`
`COMMENT_TEXT`	`VARCHAR2(4000)`
`CONTEXTID`	`VARCHAR2(4000)`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`NEW_OBJECT_NAME`	`VARCHAR2(4000)`
`NEW_OBJECT_OWNER`	`VARCHAR2(4000)`
`OBJECT_ID`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`PROXY_SESSIONID`	`NUMBER`
`SCN`	`NUMBER`
`SESSION_ACTIONS`	`VARCHAR2(255)`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SQL_BIND`^Foot 1	`VARCHAR2(4000)`
`SQL_TEXT`^Foot 2	`VARCHAR2(4000)`
`STATEMENTID`	`NUMBER`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`UNDO_SQL_TEXT`	`VARCHAR2(4000)`
`USER_GUID`	`VARCHAR2(32)`
`USERNAME`	`VARCHAR2(4000)`

^Footnote 1SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2SQL_TEXT variable could be truncated to 4000 characters.

A.10 Peer Association Events

Peer association events track database link statements. The Distributed Database Report, described in Section 3.3.2.5, uses these events.

Table A-17 lists the Oracle Database peer association source database events and the equivalent Oracle Audit Vault events.

Table A-17 Oracle Database Peer Association Audit Events

Event Name Description	Source Event	Audit Vault Event
`CREATE DATABASE LINK`	`32`	`CREATE DATABASE LINK`
`DROP DATABASE LINK`	`33`	`DROP DATABASE LINK`

Table A-18 lists the Oracle Database peer association event attributes.

Table A-18 Oracle Database Peer Association Event Attributes

Attribute Name	Data Type
`CLIENT_APPINFO`	`VARCHAR2(4000)`
`CLIENT_ID`	`VARCHAR2(4000)`
`COMMENT_TEXT`	`VARCHAR2(4000)`
`CONTEXTID`	`VARCHAR2(4000)`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`INSTANCE_NUMBER`	`NUMBER`
`OBJECT_ID`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`PROXY_SESSIONID`	`NUMBER`
`SCN`	`NUMBER`
`SESSION_ACTIONS`	`VARCHAR2(255)`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SQL_BIND`^Foot 1	`VARCHAR2(4000)`
`SQL_TEXT`^Foot 2	`VARCHAR2(4000)`
`STATEMENTID`	`NUMBER`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`UNDO_SQL_TEXT`	`VARCHAR2(4000)`
`USER_GUID`	`VARCHAR2(32)`
`USERNAME`	`VARCHAR2(4000)`

^Footnote 1SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2SQL_TEXT variable could be truncated to 4000 characters.

A.11 Role and Privilege Management Events

Role and privilege management events track audited role and privilege management activity, such as granting object permissions to a user. The Role and Privilege Management Report, described in Section 3.3.3.6, uses these events.

Table A-19 lists the Oracle Database role and privilege management source database events and the equivalent Oracle Audit Vault events.

Table A-19 Oracle Database Role and Privilege Management Audit Events

Event Name Description	Source Event	Audit Vault Event
`ALTER ROLE`	`79`	`ALTER ROLE`
`CREATE ROLE`	`52`	`CREATE ROLE`
`DROP ROLE`	`54`	`DROP ROLE`
`GRANT OBJECT`	`17`	`GRANT OBJECT`
`GRANT ROLE`	`114`	`GRANT ROLE`
`OBJECT EXISTS ERRORS`^Foot 1	`505`	`OBJECT EXISTS ERRORS`
`REVOKE OBJECT`	`18`	`REVOKE OBJECT`
`REVOKE ROLE`	`115`	`REVOKE ROLE`
`SET USER OR PROGRAM UNIT LABEL`¹	`502`	`SET USER OR PROGRAM UNIT LABEL`
`PRIVILEGED ACTION`¹	`506`	`PRIVILEGED ACTION`

^Footnote 1OBJECT EXISTS ERRORS, SET USER OR PROGRAM UNIT LABEL, and PRIVILEGED ACTION are Oracle Label Security events.

Table A-20 lists the Oracle Database role and privilege management event attributes.

Table A-20 Oracle Database Role and Privilege Management Event Attributes

Attribute Name	Data Type
`ADMIN_OPTION`	`NUMBER`
`CLIENT_APPINFO`	`VARCHAR2(4000)`
`CLIENT_ID`	`VARCHAR2(4000)`
`COMMENT_TEXT`	`VARCHAR2(4000)`
`CONTEXTID`	`VARCHAR2(4000)`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME`
`GRANTEE`	`VARCHAR2(4000)`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`INSTANCE_NUMBER`	`NUMBER`
`OBJECT_ID`	`NUMBER`
`OBJECT_PRIVILEGE`	`VARCHAR2(255)`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`PROXY_SESSIONID`	`NUMBER`
`ROLE_NAME`	`VARCHAR2(4000)`
`SCN`	`NUMBER`
`SESSION_ACTIONS`	`VARCHAR2(255)`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SQL_BIND`^Foot 1	`VARCHAR2(4000)`
`SQL_TEXT`^Foot 2	`VARCHAR2(4000)`
`STATEMENTID`	`NUMBER`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`SYSTEM_PRIVILEGE`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`UNDO_SQL_TEXT`	`VARCHAR2(4000)`
`USER_GUID`	`VARCHAR2(32)`
`USERNAME`	`VARCHAR2(4000)`

^Footnote 1SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2SQL_TEXT variable could be truncated to 4000 characters.

A.12 Service and Application Utilization Events

Service and application utilization events track audited application access activity, such as the execution of PL/SQL procedures or functions. The Procedure Executions Report, described in Section 3.3.2.6, uses these events.

Table A-21 lists the Oracle Database service and application utilization source database events and the equivalent Oracle Audit Vault events.

Table A-21 Oracle Database Service and Application Utilization Audit Events

Event Name Description	Source Event	Audit Vault Event
`CALL METHOD`	`170`	`CALL METHOD`
`EXECUTE PROCEDURE`	`116`	`EXECUTE PROCEDURE`
`PL/SQL EXECUTE`	`47`	`PL/SQL EXECUTE`

Table A-22 lists the Oracle Database service and application utilization event attributes.

Table A-22 Oracle Database Service and Application Utilization Event Attributes

Attribute Name	Data Type
`CLIENT_APPINFO`	`VARCHAR2(4000)`
`CLIENT_ID`	`VARCHAR2(4000)`
`COMMENT_TEXT`	`VARCHAR2(4000)`
`CONTEXTID`	`VARCHAR2(4000)`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`INSTANCE_NUMBER`	`NUMBER`
`OBJECT_ID`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`PROXY_SESSIONID`	`NUMBER`
`SCN`	`NUMBER`
`SESSION_ACTIONS`	`VARCHAR2(255)`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SQL_BIND`^Foot 1	`VARCHAR2(4000)`
`SQL_TEXT`^Foot 2	`VARCHAR2(4000)`
`STATEMENTID`	`NUMBER`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`UNDO_SQL_TEXT`	`VARCHAR2(4000)`
`USER_GUID`	`VARCHAR2(32)`
`USERNAME`	`VARCHAR2(4000)`

^Footnote 1SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2SQL_TEXT variable could be truncated to 4000 characters.

A.13 System Management Events

System management events track audited system management activity, such as STARTUP and SHUTDOWN operations. The System Management Report, described in Section 3.3.3.7, uses these events.

Table A-23 lists the Oracle Database system management source database events and the equivalent Oracle Audit Vault events.

Table A-23 Oracle Database System Management Audit Events

Event Name Description	Source Event	Audit Vault Event
`ALTER CLUSTER`	`5`	`ALTER CLUSTER`
`ALTER DATABASE`	`35`	`ALTER DATABASE`
`ALTER FLASHBACK ARCHIVE` (Release 11.2)	`219`	`ALTER FLASHBACK ARCHIVE`
`ALTER ROLLBACK SEG`	`37`	`ALTER ROLLBACK SEG`
`ALTER SYSTEM`	`49`	`ALTER SYSTEM`
`ALTER TABLESPACE`	`40`	`ALTER TABLESPACE`
`ANALYZE CLUSTER`	`64`	`ANALYZE CLUSTER`
`CREATE CLUSTER`	`4`	`CREATE CLUSTER`
`CREATE CONTROL FILE`	`57`	`CREATE CONTROL FILE`
`CREATE DATABASE`	`34`	`CREATE DATABASE`
`CREATE FLASHBACK ARCHIVE` (Release 11.2)	`218`	`CREATE FLASHBACK ARCHIVE`
`CREATE ROLLBACK SEG`	`36`	`CREATE ROLLBACK SEG`
`CREATE TABLESPACE`	`39`	`CREATE TABLESPACE`
`DISABLE ALL TRIGGERS`	`121`	`DISABLE ALL TRIGGERS`
`DROP CLUSTER`	`8`	`DROP CLUSTER`
`DROP FLASHBACK ARCHIVE` (Release 11.2)	`220`	`DROP FLASHBACK ARCHIVE`
`DROP ROLLBACK SEG`	`38`	`DROP ROLLBACK SEG`
`DROP TABLESPACE`	`41`	`DROP TABLESPACE`
`ENABLE ALL TRIGGERS`	`120`	`ENABLE ALL TRIGGERS`
`FLASHBACK`	`128`	`FLASHBACK`
`FLASHBACK DATABASE`	`204`	`FLASHBACK DATABASE`
`PURGE DBA_RECYCLEBIN`	`198`	`PURGE DBA_RECYCLEBIN`
`PURGE TABLESPACE`	`199`	`PURGE TABLESPACE`
`SHUTDOWN`	`20005`	`SHUTDOWN`
`STARTUP`	`20004`	`STARTUP`
`SUPER USER TRANSACTION CONTROL` (Release 11.2)	`20000`	`SUPER USER TRANSACTION CONTROL`
`SUPER USER DDL`	`20002`	`SUPER USER DDL`
`SUPER USER DML`	`20003`	`SUPER USER DML`
`SYSTEM GRANT`	`108`	`SYSTEM GRANT`
`SYSTEM REVOKE`	`109`	`SYSTEM REVOKE`
`TRUNCATE CLUSTER`	`86`	`TRUNCATE CLUSTER`

Table A-24 lists the Oracle Database system management event attributes.

Table A-24 Oracle Database System Management Event Attributes

Attribute Name	Data Type
`CLIENT_APPINFO`	`VARCHAR2(4000)`
`CLIENT_ID`	`VARCHAR2(4000)`
`COMMENT_TEXT`	`VARCHAR2(4000)`
`CONTEXTID`	`VARCHAR2(4000)`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`INSTANCE_NUMBER`	`NUMBER`
`OBJECT_ID`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`PROXY_SESSIONID`	`NUMBER`
`SCN`	`NUMBER`
`SESSION_ACTIONS`	`VARCHAR2(255)`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SQL_BIND`^Foot 1	`VARCHAR2(4000)`
`SQL_TEXT`^Foot 2	`VARCHAR2(4000)`
`STATEMENTID`	`NUMBER`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`UNDO_SQL_TEXT`	`VARCHAR2(4000)`
`USER_GUID`	`VARCHAR2(32)`
`USERNAME`	`VARCHAR2(4000)`

^Footnote 1SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2SQL_TEXT variable could be truncated to 4000 characters.

A.14 Unknown or Uncategorized Events

Unknown or uncategorized events track audited activity that cannot be categorized, such as ALTER SUMMARY statements. The Uncategorized Activity Report, described in Section 3.3.4.4, uses these events.

Table A-25 lists the Oracle Database unknown or uncategorized source database events and the equivalent Oracle Audit Vault events.

Table A-25 Oracle Database Unknown or Uncategorized Audit Events

Event Name Description	Source Event	Audit Vault Event
`ALTER SUMMARY`	`172`	`ALTER SUMMARY`
`COMMENT`	`29`	`COMMENT`
`CREATE SUMMARY`	`171`	`CREATE SUMMARY`
`DROP SUMMARY`	`173`	`DROP SUMMARY`
`NO-OP`	`27`	`NO-OP`
`SUPER USER UNKNOWN`	`20006`	`SUPER USER UNKNOWN`
`UNKNOWN`	`0`	`UNKNOWN`
`USER COMMENT`	`117`	`USER COMMENT`

Table A-26 lists the Oracle Database unknown or uncategorized event attributes.

Table A-26 Oracle Database Unknown or Uncategorized Event Attributes

Attribute Name	Data Type
`CLIENT_APPINFO`	`VARCHAR2(4000)`
`CLIENT_ID`	`VARCHAR2(4000)`
`COMMENT_TEXT`	`VARCHAR2(4000)`
`CONTEXTID`	`VARCHAR2(4000)`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`INSTANCE_NUMBER`	`NUMBER`
`OBJECT_ID`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`PROXY_SESSIONID`	`NUMBER`
`SCN`	`NUMBER`
`SESSION_ACTIONS`	`VARCHAR2(255)`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SQL_BIND`^Foot 1	`VARCHAR2(4000)`
`SQL_TEXT`^Foot 2	`VARCHAR2(4000)`
`STATEMENTID`	`NUMBER`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`UNDO_SQL_TEXT`	`VARCHAR2(4000)`
`USER_GUID`	`VARCHAR2(32)`
`USERNAME`	`VARCHAR2(4000)`

^Footnote 1SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2SQL_TEXT variable could be truncated to 4000 characters.

A.15 User Session Events

User session events track audited authentication events for users who log in to the database. The User Sessions Report, described in Section 3.3.2.7, uses these events.

Table A-27 lists the Oracle Database user session source database events and the equivalent Oracle Audit Vault events.

Table A-27 Oracle Database User Session Audit Events

Event Name Description	Source Event	Audit Vault Event
`ALTER SESSION`	`42`	`ALTER SESSION`
`COMMIT`	`44`	`COMMIT`
`CREATE RESTORE POINT`	`206`	`CREATE RESTORE POINT`
`CREATE SESSION`	`129`	`CREATE SESSION`
`DROP RESTORE POINT`	`207`	`DROP RESTORE POINT`
`LOGOFF`	`101`	`LOGOFF`
`LOGOFF BY CLEANUP`	`102`	`LOGOFF BY CLEANUP`
`LOGON`	`100`	`LOGON`
`PROXY AUTHENTICATION ONLY`	`208`	`PROXY AUTHENTICATION ONLY`
`PURGE USER_RECYCLEBIN`	`197`	`PURGE USER_RECYCLEBIN`
`ROLLBACK`	`45`	`ROLLBACK`
`SAVEPOINT`	`46`	`SAVEPOINT`
`SESSION REC`	`103`	`SESSION REC`
`SET ROLE`	`55`	`SET ROLE`
`SET TRANSACTION`	`48`	`SET TRANSACTION`
`SUPER USER LOGON`	`20001`	`SUPER USER LOGON`

Table A-28 lists the Oracle Database user session event attributes.

Table A-28 Oracle Database User Session Event Attributes

Attribute Name	Data Type
`AUTHENTICATION_METHOD`	`VARCHAR2(255)`
`CLIENT_APPINFO`	`VARCHAR2(4000)`
`CLIENT_ID`	`VARCHAR2(4000)`
`COMMENT_TEXT`	`VARCHAR2(4000)`
`CONTEXTID`	`VARCHAR2(4000)`
`ENDUSER`	`VARCHAR2(4000)`
`EVENT_STATUS`	`VARCHAR2(30)`
`EVENT_TIME`	`TIMESTAMP WITH LOCAL TIME ZONE`
`HOST_IP`	`VARCHAR2(255)`
`HOST_NAME`	`VARCHAR2(255)`
`HOST_TERMINAL`	`VARCHAR2(255)`
`INSTANCE_NUMBER`	`NUMBER`
`LOGOFF_DLOCK`	`NUMBER`
`LOGOFF_LREAD`	`NUMBER`
`LOGOFF_LWRITE`	`NUMBER`
`LOGOFF_PREAD`	`NUMBER`
`OBJECT_ID`	`NUMBER`
`OSUSER_NAME`	`VARCHAR2(4000)`
`PARENT_CONTEXTID`	`VARCHAR2(4000)`
`PRIVILEGES_USED`	`VARCHAR2(4000)`
`PROCESS#`	`NUMBER`
`PROXY_SESSIONID`	`NUMBER`
`SCN`	`NUMBER`
`SESSION_ACTIONS`	`VARCHAR2(255)`
`SOURCE_EVENTID`	`VARCHAR2(255)`
`SQL_BIND`^Foot 1	`VARCHAR2(4000)`
`SQL_TEXT`^Foot 2	`VARCHAR2(4000)`
`STATEMENTID`	`NUMBER`
`SUB_CONTEXTID`	`VARCHAR2(4000)`
`TARGET_OBJECT`	`VARCHAR2(4000)`
`TARGET_OWNER`	`VARCHAR2(4000)`
`THREAD#`	`NUMBER`
`TOOLS_USED`	`VARCHAR2(4000)`
`UNDO_SQL_TEXT`	`VARCHAR2(4000)`
`USER_GUID`	`VARCHAR2(32)`
`USERNAME`	`VARCHAR2(4000)`

^Footnote 1SQL_BIND variable could be truncated to 4000 characters.

^Footnote 2SQL_TEXT variable could be truncated to 4000 characters.